Yu Sun

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download polyhaven asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution.

**Name of the Vulnerable Software and Affected Versions** Datasets versions prior to 5.01 **Description** A symlink-following issue exists in the `Extractor.extract()` function. Local attackers can write arbitrary files by pre-planting symbolic links (shortcuts that point to another file or directory) at predictable output paths. In shared-cache environments, this allows the redirection of archive extraction to arbitrary filesystem locations, which can lead to the overwriting of sensitive files, privilege escalation, or code execution. **Recommendations** Update to the version containing commit ad2d853. As a temporary mitigation, restrict access to the `Extractor.extract()` function to prevent unauthorized users from triggering archive extractions.

**Name of the Vulnerable Software and Affected Versions** FlashAttention versions prior to 2.8.3.post1 **Description** A symlink attack exists in the `download and copy()` function within hopper/setup.py. The issue occurs because NVIDIA toolchain archives are extracted without validating symlinks or filtering tar members. A local attacker can place a symlink in the predictable cache directory to redirect extracted binaries to a location of their choice, allowing arbitrary file write with the privileges of the victim during the build process. **Recommendations** Update FlashAttention to the version containing commit 0816ef1.

**Name of the Vulnerable Software and Affected Versions** Dify versions prior to 1.16.0-rc1 **Description** A SQL injection issue exists in the MyScale vector store backend. This occurs when unsanitized search parameters are passed to the `search by full text()` function without proper escaping or parameterization. This flaw allows attackers to execute arbitrary SQL commands to read, modify, or delete data within the underlying ClickHouse database. **Recommendations** Update Dify to version 1.16.0-rc1 or later. As a temporary mitigation, restrict access to the `search by full text()` function in the MyScale vector store backend.

**Name of the Vulnerable Software and Affected Versions** Cognee versions prior to 1.2.0 **Description** Improper access control allows unauthenticated attackers to overwrite the global LLM provider configuration. By self-registering an account and calling the '/api/v1/settings' endpoint, which lacks admin or superuser checks, an attacker can exploit the process-wide singleton configuration cache. This enables the redirection of all instance-wide LLM operations to an attacker-controlled endpoint, leading to the exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users. **Recommendations** Update Cognee to version 1.2.0 or later. Restrict access to the '/api/v1/settings' endpoint to prevent unauthorized configuration changes.

**Name of the Vulnerable Software and Affected Versions** Mem0 versions prior to 0.2.8 **Description** The self-hosted server component contains a missing authorization flaw. The 'POST /configure' endpoint allows the modification of global LLM provider and embedder configurations. While the system verifies authentication via JWT or `X-API-Key`, it fails to validate the caller's role. Consequently, any authenticated user with a distributed API key can redirect all LLM and embedder traffic to a server controlled by an attacker. This malicious configuration is persisted in PostgreSQL and remains active after server restarts, affecting all users and API keys on the instance. **Recommendations** Update to the version containing commit ae7f406. As a temporary workaround, restrict access to the 'POST /configure' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MoviePilot (affected versions not specified) **Description** Path traversal exists in the AliPan, U115, and Rclone cloud storage download handlers. The issue occurs because the local destination path is created by concatenating the configured download directory with a filename retrieved from remote cloud API metadata without performing path validation or basename normalization. An attacker controlling a filename returned by a remote cloud storage API can use traversal sequences such as `../` to write downloaded content outside the intended directory, which may lead to the overwriting of arbitrary configuration or plugin files accessible by the application process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** F5-TTS versions prior to 1.1.21 **Description** A path traversal issue exists in the finetune Gradio handlers. Unauthenticated attackers can write arbitrary files by providing unsanitized project names that are passed directly to the `os.path.join()` function without validation to ensure the resulting path remains within the intended base directory. By supplying absolute path arguments, such as `/tmp/EVIL`, an attacker can override the base directory and create directories containing attacker-controlled JSON content at any filesystem path writable by the server process. **Recommendations** Update F5-TTS to version 1.1.21 or later.

**Name of the Vulnerable Software and Affected Versions** AI Tensor Engine for ROCm (AITER) versions prior to 0.1.15 **Description** An unauthenticated remote code execution issue exists in the `MessageQueue.recv()` function within `shm broadcast.py`. This occurs because a ZMQ SUB socket lacks authentication, HMAC, or format validation, allowing remote attackers to execute arbitrary code by sending a malicious pickle payload. Attackers can achieve this by reaching the writer XPUB endpoint on the cluster network or by providing a forged Handle containing an attacker-controlled `remote subscribe addr`. This allows the delivery of a crafted pickle payload that executes code as the inference worker process across every remote reader worker. **Recommendations** Update to a version later than 0.1.14.

**Name of the Vulnerable Software and Affected Versions** Banana Slides versions prior to 0.4.0 **Description** The AI service backend contains a path traversal issue in the `generate image()` function. This occurs due to an incomplete path prefix check using `os.path.startswith()` without a trailing separator, which fails to properly confine file access to the intended uploads directory. Unauthenticated attackers can exploit this by providing crafted markdown image references in user-controlled page descriptions. This allows the application to read arbitrary image-format files from sibling directories that share the same prefix as the uploads folder via `PIL Image.open()`. **Recommendations** Update Banana Slides to the version containing commit e8bc490. As a temporary mitigation, restrict the use of the `generate image()` function.

**Name of the Vulnerable Software and Affected Versions** MoviePilot version v2 **Description** An issue exists in the image proxy endpoint '/api/v1/system/img/{proxy}' that allows authenticated attackers to request arbitrary URLs. By providing a `resource token` cookie and a URL with a domain that matches the allowlist, attackers can bypass internal network protections. This occurs because the `is safe url()` function in `SecurityUtils` only verifies domain membership and fails to block private, loopback, or link-local addresses. This can lead to the enumeration of internal services, such as Jellyfin, Emby, or Plex, and the exfiltration of data from internal network resources. Server-side request forgery (SSRF) is a flaw where an attacker can force a server to make requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** manga-image-translator (affected versions not specified) **Description** Remote code execution is possible in the shared API server mode due to unsafe deserialization of untrusted pickle data within the `share.py` module. The endpoints '/execute/{method name}' and '/simple execute/{method name}' use `pickle.loads()` to deserialize HTTP request bodies controlled by an attacker. A remote attacker can provide a crafted pickle payload to these endpoints to execute arbitrary code in the server process, which can lead to full container compromise when the software is running as root in the default Docker deployment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** XX-Net version 5.16.6 **Description** A WebSocket frame parsing issue exists in the `WebSocket receive worker` routine of `simple http server.py`. The server unconditionally reads 4 bytes as a masking key, even if the MASK bit is not set in the frame header. This causes the first 4 bytes of the payload to be consumed as a mask key and the remaining payload to be incorrectly XOR-decoded, leading to corrupted application data. Additionally, the system fails to validate the RSV bit, opcode, and FIN fragmentation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** agno version 2.6.5 **Description** A SQL injection issue exists in the ClickHouse vector database backend. Attackers can inject arbitrary SQL expressions by providing malicious metadata keys and values to the `delete by metadata()` function. This is possible due to unsafe f-string interpolation within the `clickhousedb.py` file, which could allow the deletion of all rows, targeting of specific rows, or information extraction using blind or error-based SQL injection techniques. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** xiaomusic version 0.5.7 **Description** An unauthenticated path traversal issue exists in the 'GET /music/{file path:path}' endpoint. This occurs due to an incomplete path prefix check and a missing trailing separator in the comparison logic. Unauthenticated attackers can bypass path restrictions by crafting traversal sequences to request files from sibling directories that share the `music path` prefix, allowing the retrieval of arbitrary files from the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ai-goofish-monitor (affected versions not specified) **Description** An unauthenticated arbitrary file read issue exists in Windows deployments. Remote attackers can read arbitrary files by supplying absolute Windows paths or backslash-based traversal sequences to the 'GET /api/prompts/{filename}' endpoint. The flaw stems from an incomplete path traversal guard that only blocks forward slashes and '..', allowing the `os.path.join` function to discard the intended prompts directory prefix when absolute paths are provided, thereby exposing files accessible to the application process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DeepCode versions prior to commit c991dc2 **Description** A path traversal issue exists in the SPA catch-all route within `new ui/backend/main.py`. Unauthenticated attackers can read arbitrary files by providing percent-encoded path segments to the 'GET /{full path:path}' endpoint. By encoding slashes as %2F and dots as %2E%2E, the Starlette path normalization is bypassed, allowing the joined path to move outside the `FRONTEND DIST` directory. This can expose sensitive data, including SSH private keys, TLS certificates, and application secrets, via a single HTTP request. **Recommendations** Update to a version containing commit c991dc2 or later.

**Name of the Vulnerable Software and Affected Versions** Agent Zero versions prior to 1.15 **Description** An issue allows unauthenticated attackers to read arbitrary files by providing crafted paths to the image file serving endpoint. The system relies only on an extension allowlist while the path containment check is disabled. This allows access to any file with an image extension readable by the process, including those outside the agent workspace, user home directories, and mounted volumes. Additionally, the lack of path canonicalization—the process of converting a path to its simplest, standard form—enables symlink-based escapes. **Recommendations** Update Agent Zero to version 1.15 or later.

**Name of the Vulnerable Software and Affected Versions** Gradio versions prior to 6.15.0 **Description** A cookie injection issue exists due to a shared module-level HTTP client used across all users in the reverse proxy endpoint. This allows remote attackers who control any HF Space to return a parent-domain cookie. The shared client stores this cookie and automatically replays it into subsequent proxy requests to other legitimate Spaces, enabling cross-Space session fixation for all users of the same Gradio deployment. **Recommendations** Update to version 6.15.0 or later.

**Name of the Vulnerable Software and Affected Versions** Taipy version 4.1.1 **Description** An issue exists in the `ElementLibrary.get resource()` function within `taipy/gui/extension/library.py` that allows unauthenticated attackers to access files outside the intended library directory. This occurs due to an incomplete path containment check using `str.startswith()` without a trailing path separator. Attackers can use crafted GET requests containing path traversal segments to target sibling directories that share a common prefix. Because the Flask path converter and Werkzeug WSGI layer preserve these segments, the resolved path still satisfies the flawed comparison, enabling unauthorized file access. **Recommendations** Apply the fix implemented in commit 129fd40 for version 4.1.1.