Kaminuma

**Name of the Vulnerable Software and Affected Versions** @strapi/upload versions prior to 5.33.3 **Description** In the Upload plugin, Content API endpoints failed to enforce administrator-configured MIME type restrictions defined in `plugin.upload.security.allowedTypes` and `deniedTypes`. While these restrictions were active for the Admin Panel, the `enforceUploadSecurity` security check was missing from the Content API controller. Consequently, the `uploadFiles` and `replaceFile` handlers, as well as the `upload` wrapper, bypassed MIME detection and allow/deny lists. An authenticated user with Content API upload permissions could upload disallowed file types, such as HTML and SVG. If uploaded files are served from the same origin as the admin panel, an attacker could upload a malicious HTML or SVG file. When opened by an administrator, this file could execute JavaScript within the admin origin, potentially leading to admin-session hijacking and unauthorized administrative actions via the admin API. **Recommendations** Update @strapi/upload to version 5.33.3 or later.

**Name of the Vulnerable Software and Affected Versions** baserCMS versions prior to 5.2.3 **Description** baserCMS contains an OS command injection flaw in its core update functionality. An authenticated administrator can execute arbitrary OS commands on the server because user-controlled input is passed directly to the `exec()` function without sufficient validation or escaping. This design issue allows for Remote Code Execution (RCE), enabling the retrieval of server information, reading or writing arbitrary files, and accessing application configuration data such as database credentials. Technical details include: - **API Endpoint:** `/baser/admin/baser-core/plugins/get core update` - **Vulnerable Parameters:** `php` - **Function Names:** `PluginsController::get core update()`, `PluginsService::getCoreUpdate()`, and `exec()` **Recommendations** Update baserCMS to version 5.2.3. As a temporary mitigation, restrict access to the `/baser/admin/baser-core/plugins/get core update` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** baserCMS versions prior to 5.2.3 **Description** baserCMS is a website development framework. A path traversal flaw exists in the theme file management API, specifically at the ''/baser/api/admin/bc-theme-file/theme files/add.json'' endpoint. An authenticated administrator can manipulate the path parameter using '..' sequences to create PHP files in locations outside the intended theme directory. This could lead to remote code execution (RCE). The vulnerable parameter is the `path` parameter. **Recommendations** Update to version 5.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** WordPress versions 6.9 through 6.9.1 **Description** WordPress core is susceptible to unauthorized access. The Notes feature, introduced in WordPress 6.9, allows for collaborative annotations on posts within the block editor. However, the REST API `create item permissions check()` method within the comments controller did not confirm that the authenticated user possesses `edit post` permission for the specific post when creating a note. This allows authenticated attackers with Subscriber-level access to create notes on any post, including those authored by others, private posts, and posts in any status. **Recommendations** Update WordPress to a version beyond 6.9.1.