Starplatinu

**Name of the Vulnerable Software and Affected Versions** Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.23 **Description** The local internal-storage backend fails to properly validate user-supplied paths because it checks for directory traversal sequences before converting Windows-style backslashes to forward slashes. An attacker can bypass this guard by using backslashes (......), which are rewritten to forward slashes after validation, allowing access to files outside the storage sandbox. Any authenticated user with the lowest-privilege role can exploit this via the GET '/api/v1/{tenant}/executions/{executionId}/file' endpoint using the `path` parameter. This allows the reading of arbitrary server files accessible by the Kestra process, including the embedded H2 database, internal storage of other tenants, mounted secret files, and the process environment (/proc/self/environ) containing database and secret-backend credentials, resulting in a breach of storage isolation and multi-tenancy boundaries. **Recommendations** Update to version 1.0.45. Update to version 1.3.23. Restrict access to the '/api/v1/{tenant}/executions/{executionId}/file' endpoint or avoid using the `path` parameter until the system is updated.

**Name of the Vulnerable Software and Affected Versions** Filament versions 4.0.0 through 4.11.4 Filament versions prior to 5.6.5 **Description** A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue only applies when recovery codes are enabled and does not affect email-based multi-factor authentication. If an attacker possesses both the user's password and their recovery codes, they can obtain multiple authenticated sessions per recovery code by batching parallel submissions, extending the window of access beyond the intended single-use restriction. **Recommendations** Update to version 4.11.5. Update to version 5.6.5.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.7.0 **Description** The endpoint "/api/tag/getTag" is registered using only the `model.CheckAuth` middleware, missing the `model.CheckAdminRole` and `model.CheckReadonly` checks. This allows any authenticated user, including those with `RoleReader` or `RoleEditor` permissions on read-only workspaces, to perform unauthorized configuration writes. By providing a `sort` argument to the endpoint, an attacker can mutate `model.Conf.Tag.Sort` and trigger the `model.Conf.Save()` function, which atomically rewrites the entire workspace `conf.json` file. This can lead to the rollback of other legitimate configuration settings if a write-race occurs. **Recommendations** Update to version 3.7.0. As a temporary workaround, restrict access to the "/api/tag/getTag" endpoint to authorized administrators only.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.7.0 **Description** Broken access control in the publish-mode allows readers to enumerate metadata from documents that are invisible to the publish service. This occurs because certain search handlers do not filter responses for users with the `RoleReader` role, allowing them to bypass the trust boundary and access information from password-protected or publish-ignored notebooks. An attacker can enumerate all tag strings, asset filenames, widget names, and template names across the entire workspace. The affected API endpoints are: - '/api/search/searchTag' - '/api/search/searchTemplate' - '/api/search/searchWidget' - '/api/search/searchAsset' **Recommendations** Update to version 3.7.0. As a temporary workaround, restrict access to the '/api/search/searchTag', '/api/search/searchTemplate', '/api/search/searchWidget', and '/api/search/searchAsset' endpoints to minimize the risk of metadata enumeration.

**Name of the Vulnerable Software and Affected Versions** Kysely versions prior to 0.28.16 **Description** Improper input handling in the JSON-path compiler allows attackers to access sensitive JSON data. The software fails to escape JSON-path metacharacters such as `.`, `[`, `]`, `*`, `**`, and `?`, only doubling single quotes. When attacker-controlled input is passed to the `key()` or `at()` functions—including in type-safe code where columns are defined as `Record<string, T>`—attackers can use dots as path-leg separators to traverse into sibling and child fields outside the intended scope. This results in unauthorized read access and, in update statements, unauthorized write access to JSON sub-fields across MySQL, PostgreSQL (using `->$` or `->>$` operators), and SQLite. On MySQL and PostgreSQL, the use of `*` or `**` wildcards can be used to enumerate all values at a specific depth or recurse through the entire document. **Recommendations** As a temporary workaround, avoid using the `key()` or `at()` functions with attacker-controlled input in the affected API endpoints until a patch is available. Restrict the input passed to `key()` and `at()` to a known-good character set, rejecting any strings containing JSON-path metacharacters.