Alanturing881

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both space and tab. As a result, an entry padded with a tab keeps the literal tab in the resolved address string. Applications that make exact string match security decisions on the resolved client IP, such as an allowlist, a blocklist, a per IP rate limit key, or audit log correlation, can be evaded because the tab corrupted string no longer matches the expected value. This does not cross the trust boundary, since a tab corrupted string is not a valid IP and cannot be mistaken for a trusted proxy. The issue is fixed in @fastify/forwarded 3.0.2.

**Name of the Vulnerable Software and Affected Versions** Wagtail versions prior to 7.0.8 Wagtail versions prior to 7.3.3 Wagtail versions prior to 7.4.2 **Description** A low-level user granted the "Can submit translation" permission can create translations for any page, regardless of whether they have the necessary permissions for those specific pages. **Recommendations** Update to version 7.0.8 Update to version 7.3.3 Update to version 7.4.2

**Name of the Vulnerable Software and Affected Versions** File Browser (affected versions not specified) **Description** File Browser fails to properly validate symbolic links, allowing scoped users or unauthenticated public-share recipients to access files outside their intended directory boundaries. While the software prevents lexical `../` traversal, it does not stop handlers from following symlinks that point to locations outside the user's scope. This occurs in two ways: when a symlink is the final path component, or when a file is accessed through a symlinked ancestor directory. This issue affects reading, writing (including TUS resumable uploads), share creation, and public-share serving. An attacker can use these flaws to read out-of-scope file contents, overwrite files, or create public shares for restricted data. Technical details include vulnerabilities in the following endpoints and functions: - API Endpoints: `GET /api/raw/{path}`, `GET /api/resources/{path}`, `POST /api/resources/{path}`, `POST /api/tus/{path}`, `PATCH /api/tus/{path}`, `POST /api/share/{path}`, and `GET /api/public/dl/{hash}`. - Vulnerable Parameters: `path` and `override`. - Vulnerable Functions: `stat()`, `readListing()`, `getFiles()`, `writeFile()`, `tusPostHandler()`, and `tusPatchHandler()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.