deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8c39-xppg-479c
Package: pterodactyl/panel (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 1.12.0
Patched in: 1.12.0

Summary: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

Details:
### Summary
Pterodactyl does not revoke _active_ SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked.

### Details
When a user opens a connection to a server using the Wings SFTP server instance the permissions are checked and returned from the authentication API call made to the Panel. However, credentials are not checked again after the initial handshake. Thus, if a user is removed from a server in the panel or have their permissions modified, those permissions are not updated in the SFTP connection.

As a result, a user that has already gained access to a server's files via the SFTP subsystem will maintain those permissions until disconnected (via Wings restart, or a manual disconnection on their end).

> [!NOTE]
>
> This issue impacts the SFTP subsystem for server files specifically. There is no exposure of Wings private data, or any data outside of a server's local filesystem. Additionally, a user must have been _connected to SFTP at the time of their permissions being revoked_ in order for this issue to be exploited. If a user was not connected, they would not be able to connect once their permissions were reduced.

### Fix
Please upgrade to `wings@1.12.0` and `panel@1.12.0` to resolve this issue. Patches are available via the implementation PRs, but it is recommended to apply by upgrading the entire instance.
GitHub Security Advisory: GHSA-mrfv-m5wm-5w6w
Package: paragonie/sodium_compat (COMPOSER)
Severity: MODERATE (CVSS 4.5)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 1.24.0
Patched in: 1.24.0

Summary: libsodium has Incomplete List of Disallowed Inputs

Details:
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

This advisoory lists packages in the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.
GitHub Security Advisory: GHSA-mrfv-m5wm-5w6w
Package: paragonie/sodium_compat (COMPOSER)
Severity: MODERATE (CVSS 4.5)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: >= 2, < 2.5.0
Patched in: 2.5.0

Summary: libsodium has Incomplete List of Disallowed Inputs

Details:
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

This advisoory lists packages in the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.
GitHub Security Advisory: GHSA-824x-88xg-cwrv
Package: redaxo/source (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-24: Path Traversal: '../filedir'
Vulnerable versions: <= 5.20.1
Patched in: 5.20.2

Summary: Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

Details:
### Summary
Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality.
<img width="664" height="899" alt="image" src="https://github.com/user-attachments/assets/fd1ca69e-b275-4daf-9a62-621cde6525f5" />
<img width="2358" height="445" alt="image" src="https://github.com/user-attachments/assets/fad81152-9e1b-413e-9823-09540a23e2fb" />


### Details
The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories.  
An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive.

Vulnerable code:
- `redaxo/src/addons/backup/pages/export.php` (lines 72-76) – directly uses `$_POST['EXPDIR']`
- `redaxo/src/addons/backup/lib/backup.php` (lines ~413 & ~427) – concatenates unsanitized user input with base path

This allows disclosure of sensitive files such as:
- `redaxo/data/core/config.yml` → database credentials + password hashes of all backend users
- `.env`, custom configuration files, logs, uploaded malicious files, etc.

### Affected versions
≤ 5.20.1 (confirmed working)

### Patched versions
None (as of 2025-12-09)

### PoC – Extracting database credentials and password hashes
1. Log in as any user with Backup permission
2. Go to Backup → Export → Files

<img width="1240" height="960" alt="image" src="https://github.com/user-attachments/assets/bc05ba18-9664-4be2-b637-4fec3a0f409a" />

3. Intercept the request with Burp Suite 

<img width="2184" height="478" alt="image" src="https://github.com/user-attachments/assets/9fa754a1-2cd0-4d3d-a5cc-cfa34c8a1718" />

4. Change one `EXPDIR[]` value to `../../../../var/www/html/redaxo/data/core`

<img width="978" height="591" alt="image" src="https://github.com/user-attachments/assets/d15f5c7f-b72c-44cc-9be2-da8d3f26f124" />

5. Send request → download archive
<img width="423" height="131" alt="image" src="https://github.com/user-attachments/assets/db8a8bda-cdaf-4dea-812f-1e312da908e2" />

6. Extract and open `data/core/config.yml`
<img width="859" height="281" alt="image" src="https://github.com/user-attachments/assets/c8112ce1-5a1d-435f-953b-7eb4e711e042" />

Result: plaintext database password 
<img width="2534" height="1198" alt="image" src="https://github.com/user-attachments/assets/218ae917-868a-437e-98b0-6471b82c0b10" />

### Impact
Full compromise of the REDAXO installation:
- Database takeover
- Password hash extraction → offline cracking → admin access
- When combined with other vulnerabilities → RCE

CVSS 4.0 vector & score below.

### Credits
Discovered by: Łukasz Rybak
GitHub Security Advisory: GHSA-v64r-7wg9-23pr
Package: craftcms/cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-202: Exposure of Sensitive Information Through Data Queries, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 3.0.0, <= 4.16.16
Patched in: 4.16.17

Summary: Unauthenticated Craft CMS users can trigger a database backup

Details:
Unauthenticated users can trigger database backup operations the `updater/backup` action, potentially leading to resource exhaustion or information disclosure.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

References:

https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04

## Affected Endpoints

- `POST /admin/actions/updater/backup` (unauthenticated)

## Vulnerability Details

### Root Cause
All `updater/*` actions are explicitly configured with anonymous access:

```php
// BaseUpdaterController.php  
protected array|bool|int $allowAnonymous = self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE;
```

### Attack Vector
1. Send unauthenticated POST request to `/admin/actions/updater/backup`
2. Database backup executes with configured `backupCommand`
GitHub Security Advisory: GHSA-v64r-7wg9-23pr
Package: craftcms/cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-202: Exposure of Sensitive Information Through Data Queries, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 5.0.0-RC1, <= 5.8.20
Patched in: 5.8.21

Summary: Unauthenticated Craft CMS users can trigger a database backup

Details:
Unauthenticated users can trigger database backup operations the `updater/backup` action, potentially leading to resource exhaustion or information disclosure.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

References:

https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04

## Affected Endpoints

- `POST /admin/actions/updater/backup` (unauthenticated)

## Vulnerability Details

### Root Cause
All `updater/*` actions are explicitly configured with anonymous access:

```php
// BaseUpdaterController.php  
protected array|bool|int $allowAnonymous = self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE;
```

### Attack Vector
1. Send unauthenticated POST request to `/admin/actions/updater/backup`
2. Database backup executes with configured `backupCommand`
GitHub Security Advisory: GHSA-742x-x762-7383
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: >= 4.0.0-RC1, <= 4.16.16
Patched in: 4.16.17

Summary: Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

Details:
For this to work, users must have administrator access to the Craft Control Panel, and [allowAdminChanges](https://craftcms.com/docs/5.x/reference/config/general.html#allowadminchanges) must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment.

https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production

Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available.

It is possible to craft a malicious payload using the Twig `map` filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

References:

https://github.com/craftcms/cms/commit/d82680f4a05f9576883bb83c3f6243d33ca73ebe

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04
GitHub Security Advisory: GHSA-742x-x762-7383
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: >= 5.0.0-RC1, <= 5.8.20
Patched in: 5.8.21

Summary: Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

Details:
For this to work, users must have administrator access to the Craft Control Panel, and [allowAdminChanges](https://craftcms.com/docs/5.x/reference/config/general.html#allowadminchanges) must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment.

https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production

Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available.

It is possible to craft a malicious payload using the Twig `map` filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

References:

https://github.com/craftcms/cms/commit/d82680f4a05f9576883bb83c3f6243d33ca73ebe

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04
GitHub Security Advisory: GHSA-x27p-wfqw-hfcc
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 3.5.0, <= 4.16.16
Patched in: 4.16.17

Summary: Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation

Details:
The Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the `_file` input, specifically its `url` parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the `url`, forcing the server to make requests to these restricted services. The fetched content is then saved as an asset, which can subsequently be accessed and exfiltrated, leading to potential data exposure and infrastructure compromise. This exploitation requires specific GraphQL permissions for asset management within the targeted volume.

Users should update to the patched 5.8.21 and 4.16.17 releases to mitigate the issue.

References:

https://github.com/craftcms/cms/commit/013db636fdb38f3ce5657fd196b6d952f98ebc52

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04

---

### Required Permissions

The exploitation requires a few permissions to be enabled in the used GraphQL schema:
- "Edit assets in the `<VolumeName>` volume"
- "Create assets in the `<VolumeName>` volume"

### Steps to Reproduce

1. Log in to the Craft CMS control panel as an admin.

2. Create a new volume if you haven’t yet.

3. Create a new schema (or use the full/public schema) and enable the permissions mentioned above in the **Required Permissions** section.

4. Go to **GraphiQL**: `http://craft.local/admin/graphiql` & set the created schema.

5. Run the following GraphQL mutation to upload an Asset *(Replace the `<VolumeName>` with your volume name)*:

```graphql
mutation {
    save_<VolumeName>_Asset(_file: { 
        url: "http://127.0.0.1:80/index.php"
        filename: "poc.txt"
    }) {
        id
    }
}
```

6. Note that the `index.php` response will be saved as `poc.txt` & its content will be accessible via the asset preview/download functionality.

8. For the PoC, `http://127.0.0.1:80/index.php` was used as an example. However, the `url` parameter can be leveraged to target internal services, cloud metadata endpoints, or any arbitrary external URL.

## Impact

Successful exploitation of this SSRF vulnerability allows attackers to access internal network resources, bypass firewall rules, and conduct network reconnaissance.

In cloud environments (AWS, GCP, Azure), this can lead to the theft of sensitive credentials (e.g., IAM roles, service account tokens) from metadata endpoints, potentially resulting in the full compromise of the underlying infrastructure and the exfiltration of sensitive data.

---

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Users running Craft 3.5.0+ should update to the latest Craft 4.16.17 or 5.8.21 releases.
GitHub Security Advisory: GHSA-x27p-wfqw-hfcc
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 5.0.0-RC1, <= 5.8.20
Patched in: 5.8.21

Summary: Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation

Details:
The Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the `_file` input, specifically its `url` parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the `url`, forcing the server to make requests to these restricted services. The fetched content is then saved as an asset, which can subsequently be accessed and exfiltrated, leading to potential data exposure and infrastructure compromise. This exploitation requires specific GraphQL permissions for asset management within the targeted volume.

Users should update to the patched 5.8.21 and 4.16.17 releases to mitigate the issue.

References:

https://github.com/craftcms/cms/commit/013db636fdb38f3ce5657fd196b6d952f98ebc52

https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04

---

### Required Permissions

The exploitation requires a few permissions to be enabled in the used GraphQL schema:
- "Edit assets in the `<VolumeName>` volume"
- "Create assets in the `<VolumeName>` volume"

### Steps to Reproduce

1. Log in to the Craft CMS control panel as an admin.

2. Create a new volume if you haven’t yet.

3. Create a new schema (or use the full/public schema) and enable the permissions mentioned above in the **Required Permissions** section.

4. Go to **GraphiQL**: `http://craft.local/admin/graphiql` & set the created schema.

5. Run the following GraphQL mutation to upload an Asset *(Replace the `<VolumeName>` with your volume name)*:

```graphql
mutation {
    save_<VolumeName>_Asset(_file: { 
        url: "http://127.0.0.1:80/index.php"
        filename: "poc.txt"
    }) {
        id
    }
}
```

6. Note that the `index.php` response will be saved as `poc.txt` & its content will be accessible via the asset preview/download functionality.

8. For the PoC, `http://127.0.0.1:80/index.php` was used as an example. However, the `url` parameter can be leveraged to target internal services, cloud metadata endpoints, or any arbitrary external URL.

## Impact

Successful exploitation of this SSRF vulnerability allows attackers to access internal network resources, bypass firewall rules, and conduct network reconnaissance.

In cloud environments (AWS, GCP, Azure), this can lead to the theft of sensitive credentials (e.g., IAM roles, service account tokens) from metadata endpoints, potentially resulting in the full compromise of the underlying infrastructure and the exfiltration of sensitive data.

---

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Users running Craft 3.5.0+ should update to the latest Craft 4.16.17 or 5.8.21 releases.
GitHub Security Advisory: GHSA-53vf-c43h-j2x9
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 4.0.0-RC1, <= 4.16.16
Patched in: 4.16.17

Summary: Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Details:
Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Resources:

https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9

https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9
GitHub Security Advisory: GHSA-53vf-c43h-j2x9
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 5.0.0-RC1, <= 5.8.20
Patched in: 5.8.21

Summary: Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

Details:
Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests.

Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Resources:

https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9

https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9
GitHub Security Advisory: GHSA-2267-xqcf-gw2m
Package: facturascripts/facturascripts (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2025.4
Patched in: 2025.7

Summary: FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

Details:
A stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality.

Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed.

Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session.
GitHub Security Advisory: GHSA-mqhg-v22x-pqj8
Package: bagisto/bagisto (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: < 2.3.10
Patched in: 2.3.10

Summary: Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users

Details:
### Summary
SSTI is possible via first name and last name parameters provided by lowest-privileged users.
### Details
1. Go to `http://127.0.0.1:8000/` and login or signup 
2. Go to `http://127.0.0.1:8000/customer/account/profile`
3. Now edit the first name and last name to {{7*7}}
4. Notice it appears as 49

### POC
- Video attached with the report: https://github.com/user-attachments/assets/f93932b5-2a57-4f34-897e-4151a5168912

### Impact
This can lead to RCE, command injection.
GitHub Security Advisory: GHSA-x5rw-qvvp-5cgm
Package: bagisto/bagisto (COMPOSER)
Severity: HIGH (CVSS 7.1)
CWE: CWE-284: Improper Access Control, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 2.3.10
Patched in: 2.3.10

Summary: Bagisto has IDOR in Customer Order Reorder Functionality

Details:
### Summary

An Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud.

### Details

The vulnerability exists in the reorder method within OrderController.php. Unlike other order-related functions like view, cancel, printInvoice that properly validate customer ownership, the reorder function retrieves orders using only the order ID without verifying that the order belongs to the authenticated customer.

Code location: `packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php`

Exposed Route: `packages/Webkul/Shop/src/Routes/customer-routes.php`

```php
Route::get('reorder/{id}', 'reorder')->name('shop.customers.account.orders.reorder');
```

### PoC

I. Create victim account and place an order.
II. Login as attacker.
III. Exploit IDOR and navigate like:  http://target.xxx/customer/account/orders/reorder/1
IV. Check http://target.xxx/checkout/cart and verify exploitation.
V. Victim's order items are now in Attacker's cart.

### PoC via curl:

```
curl -c cookies.txt -X POST "http://target.xxx/customer/login" -d "email=attacker@evil.com&[CREDENTIAL_REDACTED]"

curl -b cookies.txt "http://target.xxx/customer/account/orders/reorder/1"

curl -b cookies.txt "http://target/api/checkout/cart"
```

### Impact

- **Information Disclosure:** Attackers can discover what products other customers have purchased.
- **Potential Fraud:** Attackers could potentially exploit this for social engineering or targeted attacks.