Kaminuma

**Nome do Software Vulnerável e Versões Afetadas** @strapi/upload versões anteriores a 5.33.3 **Description** No plugin de Upload, os endpoints da Content API não aplicavam as restrições de tipo MIME configuradas pelo administrador em `plugin.upload.security.allowedTypes` e `deniedTypes`. Embora essas restrições estivessem ativas para o Painel de Administração, a verificação de segurança `enforceUploadSecurity` estava ausente no controlador da Content API. Consequentemente, os manipuladores `uploadFiles` e `replaceFile`, bem como o wrapper `upload`, ignoravam a detecção de MIME e as listas de permissão/bloqueio. Um usuário autenticado com permissões de upload na Content API poderia enviar tipos de arquivos não permitidos, como HTML e SVG. Se os arquivos enviados forem servidos na mesma origem que o painel de administração, um invasor poderia enviar um arquivo HTML ou SVG malicioso. Quando aberto por um administrador, esse arquivo poderia executar JavaScript na origem do administrador, permitindo potencialmente o sequestro de sessão administrativa e ações administrativas não autorizadas via API de administração. **Recommendations** Atualize o @strapi/upload para a versão 5.33.3 ou posterior.

**Name of the Vulnerable Software and Affected Versions** baserCMS versions prior to 5.2.3 **Description** baserCMS is a website development framework. Prior to version 5.2.3, it contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to improper handling of user-controlled input that is directly passed to the `exec()` function without sufficient validation or escaping. The vulnerability resides in the `PluginsController::get core update()` controller and `PluginsService::getCoreUpdate()` service, specifically affecting the `/baser/admin/baser-core/plugins/get core update` API endpoint. The vulnerable parameter is `php`, which is concatenated into a command string without any validation or escaping. This allows an attacker to inject arbitrary OS commands by manipulating the `php` parameter in a POST request. Successful exploitation can lead to remote code execution, potentially allowing attackers to retrieve server information, read or write arbitrary files, access application configuration details, and perform OS-level operations beyond application permission boundaries. The vulnerability is not related to UI-level issues like CSRF protection and can be exploited even with valid CSRF tokens. **Recommendations** Versions prior to 5.2.3: Do not accept the PHP executable path from user input and fix the PHP executable on the server side using the `PHP BINARY` constant, for example: `$php = escapeshellarg(PHP BINARY);`. Also, apply `escapeshellarg()` escaping to other command-line arguments, such as the version number and directory. Consider using execution methods that do not involve shell interpretation, like array formats or the Process class.

**Name of the Vulnerable Software and Affected Versions** baserCMS versions prior to 5.2.3 **Description** baserCMS is a website development framework. A path traversal flaw exists in the theme file management API, specifically at the ''/baser/api/admin/bc-theme-file/theme files/add.json'' endpoint. An authenticated administrator can manipulate the path parameter using '..' sequences to create PHP files in locations outside the intended theme directory. This could lead to remote code execution (RCE). The vulnerable parameter is the `path` parameter. **Recommendations** Update to version 5.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** WordPress versions 6.9 through 6.9.1 **Description** WordPress core is susceptible to unauthorized access. The Notes feature, introduced in WordPress 6.9, allows for collaborative annotations on posts within the block editor. However, the REST API `create item permissions check()` method within the comments controller did not confirm that the authenticated user possesses `edit post` permission for the specific post when creating a note. This allows authenticated attackers with Subscriber-level access to create notes on any post, including those authored by others, private posts, and posts in any status. **Recommendations** Update WordPress to a version beyond 6.9.1.