V4Lkyrius

**Name of the Vulnerable Software and Affected Versions** Verlihub versions 0.9.8d-RC2 and earlier **Description** The issue allows remote attackers to execute arbitrary commands via shell metacharacters in an argument when user triggers are enabled. This is due to a problem in the cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon. **Recommendations** For Verlihub versions 0.9.8d-RC2 and earlier, consider disabling the cTrigger::DoIt function or user triggers until a patch is available to prevent the execution of arbitrary commands. Restrict access to the trigger mechanism to minimize the risk of exploitation. Avoid using arguments that contain shell metacharacters in the affected function.

**Name of the Vulnerable Software and Affected Versions** Verlihub versions 0.9.8d-RC2 and earlier **Description** The issue allows local users to overwrite arbitrary files via a symlink attack on the /tmp/trigger.tmp temporary file, specifically through the cTrigger::DoIt function in the trigger mechanism in the daemon. **Recommendations** For versions 0.9.8d-RC2 and earlier, consider restricting access to the cTrigger::DoIt function until a patch is available. As a temporary workaround, avoid using the trigger mechanism in the daemon to minimize the risk of exploitation.