Liyander

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.39.3 **Description** The application server exposes an unauthenticated endpoint that generates S3 `PutObject` presigned URLs using credentials stored in a workspace datasource. The route is protected only by recaptcha middleware and does not require authentication, table permissions, datasource permissions, or builder access. An attacker who knows a workspace ID and S3 datasource ID can request a signed upload URL by providing attacker-controlled `bucket` and `key` values in the request body. This allows unauthenticated arbitrary object writes to any location where the stored S3 datasource credentials have `PutObject` access, potentially leading to data corruption, overwriting public assets, or abuse of cloud credentials. **API Endpoint:** `/api/attachments/:datasourceId/url` **Vulnerable Parameters:** `bucket` and `key` **Recommendations** Update Budibase to version 3.39.3.

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.39.0 **Description** An issue exists in the open-source low-code platform where the webhook schema-building endpoint is registered under builderRoutes, but the generic authorization middleware fails to enforce authorization for all paths matching the "/api/webhooks/schema" endpoint. This allows an unauthenticated caller to update the body schema for a known webhook and mutate the corresponding automation trigger output schema. **Recommendations** Update to version 3.39.0.

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.5.113 Description PraisonAI, a multi-agent teams system, contains a Path Traversal vulnerability in the Action Orchestrator feature. An attacker, or a compromised agent, can write to arbitrary files outside of the configured workspace directory by supplying relative path segments (`../`) in the target path. This allows overwriting sensitive system files or dropping executable payloads on the host. The vulnerability resides in `src/praisonai/praisonai/cli/features/action orchestrator.py` (lines 402, 409, 423) where the code fails to validate that the final path remains within the workspace directory. A malicious `ActionStep` payload can be constructed to target files outside the workspace, potentially leading to Remote Code Execution (RCE) or system corruption. Recommendations Update to version 1.5.113 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 1.5.113 **Description** PraisonAI is a multi-agent teams system. The templates installation feature is susceptible to a "Zip Slip" Arbitrary File Write attack. When downloading and extracting template archives from external sources, the application uses Python’s `zipfile.extractall()` without verifying if the files within the archive resolve outside of the intended extraction directory. A specially crafted ZIP archive can contain file entries with relative paths that, when extracted, can overwrite arbitrary files on the victim’s filesystem. The vulnerable code is located in `src/praisonai/praisonai/cli/features/templates.py` (Line 852) and uses the `zipfile.extractall()` function. A proof-of-concept involves creating a malicious ZIP archive with file entries containing directory traversal sequences (e.g., '../../../../../../../tmp/zip slip pwned.txt') and tricking a user into installing the template. This can lead to system corruption or Remote Code Execution (RCE). **Recommendations** Update to PraisonAI version 1.5.113 or later.

**Name of the Vulnerable Software and Affected Versions** Directus versions prior to 11.17.0 **Description** Directus GraphQL endpoints ('/graphql' and '/graphql/system') did not prevent repeated execution of expensive relational queries through GraphQL aliasing. An authenticated user could exploit this to cause CPU, memory, and I/O exhaustion, potentially degrading or crashing the service. The issue stemmed from a lack of resolver deduplication within a single request, allowing an attacker to multiply database load linearly with the number of aliases used. Rate limiting was disabled by default, exacerbating the problem. Any authenticated user, even with minimal permissions, could trigger this condition. **Recommendations** Update to version 11.17.0 or later.

**Name of the Vulnerable Software and Affected Versions** Tandoor Recipes versions prior to 2.6.0 **Description** The application is designed for managing recipes, planning meals, and creating shopping lists. A hidden query parameter, `?debug=true`, within the Recipe API endpoint reveals the complete raw SQL query being executed. This includes table names, column names, JOIN relationships, WHERE conditions, and multi-tenant space IDs, potentially exposing access control logic. This parameter functions even in production mode (when `DEBUG=False` in Django) and is accessible to any authenticated user, regardless of their privilege level. An attacker with limited privileges could map the entire database schema and reverse-engineer the authorization model. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Tandoor Recipes versions prior to 2.6.0 **Description** Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions prior to 2.6.0 have an issue in the FDC (USDA FoodData Central) search endpoint where the `query` parameter is directly interpolated into the upstream API URL without URL-encoding. This allows an attacker to inject additional URL parameters using `&` characters within the `query` value. This can lead to overriding the API key, manipulating upstream query behavior, and causing server crashes (HTTP 500), resulting in a Denial of Service condition. The API endpoint vulnerable is the FDC search endpoint. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Tandoor Recipes versions prior to 2.6.0 **Description** The application is designed for managing recipes, planning meals, and creating shopping lists. Prior to version 2.6.0, the image processing pipeline does not remove EXIF metadata, rescale images, or validate image size for WebP and GIF formats. This results in sensitive EXIF data, including GPS coordinates, camera model, timestamps, and software information, being stored and served to all users who can view the recipe when WebP images are uploaded. A developer comment in the source code acknowledges this as a known issue. **Recommendations** Update to version 2.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Mesop versions 1.2.2 and below **Description** Mesop, a Python-based UI framework, contains a Path Traversal vulnerability. This allows a user providing an untrusted `state token` through the UI stream payload to target files on the disk when using the standard file-based runtime backend. This can lead to application denial of service, potentially through crash loops when reading non-msgpack target files as configurations, or arbitrary file manipulation. The vulnerability is particularly impactful on systems utilizing the `FileStateSessionBackend`. An attacker can craft a malicious Protobuf payload and send it to the `/ui` stream endpoint, exploiting the unconditional passing of the `state token` to `FileStateSessionBackend. make file path(self, token)`, which resolves OS traversal semantics. The `state token` is collected from the untrusted incoming protobuf message struct: `mesop.protos.ui pb2.UserEvent`. **Recommendations** Update Mesop to version 1.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** Mesop versions 1.2.2 and below **Description** Mesop, a Python-based UI framework, contains a flaw where an explicit web endpoint within the ai/ testing module infrastructure directly accepts untrusted Python code strings without authentication. This results in unrestricted remote code execution. The issue resides in the `/exec-py` route of a lightweight Flask server located in `ai/sandbox/wsgi app.py`. This route accepts base-64 encoded payloads in the `code` parameter, which are then evaluated and executed on the system. The payload is saved to the operating system and executed using the `execute module()` function. Successful exploitation grants attackers host-machine command rights. **Recommendations** Update to version 1.2.3 or later.