deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-428q-q3vv-3fq3
Package: api-platform/core (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-696: Incorrect Behavior Order
Vulnerable versions: >= 4.1.0-alpha.1, < 4.1.5
Patched in: 4.1.5

Summary: GraphQL grant on a property might be cached with different objects

Details:
### Original message:

I found an issue with security grants on on properties in the GraphQL ItemNormalizer:

If you use something like `#[ApiProperty(security: 'is_granted("PROPERTY_READ", [object, property])')]` on a member of an entity, the grant gets cached and is only evaluated once, even if the `object` in question is a different one.

There is the `ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe()` method that seems to be intended to prevent this: https://github.com/api-platform/core/blob/88f5ac50d20d6510686a7552310cc567fcca45bf/src/GraphQl/Serializer/ItemNormalizer.php#L160-L164  
and in its usage on line 90 it does indeed not create a cache key, but the `parent::normalize()` that is called afterwards still creates the cache key and causes the issue.

### Impact

It grants access to properties that it should not.

### Workarounds

Override the ItemNormalizer.

Patched at: https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8
GitHub Security Advisory: GHSA-cg3c-245w-728m
Package: api-platform/core (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 4.1.0-alpha.1, < 4.1.5
Patched in: 4.1.5

Summary: GraphQL query operations security can be bypassed

Details:
### Summary

Using the Relay special `node` type you can bypass the configured security on an operation.

### Details

Here is an example of how to apply security configurations for the GraphQL operations:

```php
#[ApiResource(
    security: "is_granted('ROLE_USER')",
    operations: [ /* ... */ ],
    graphQlOperations: [
        new Query(security: "is_granted('ROLE_USER')"),
        //...
    ],
)]
class Book { /* ... */ }
```

This indeed checks `is_granted('ROLE_USER')` as expected for a GraphQL query like the following:

```php
‌query {
    book(id: "/books/1") {
        title
    }
}
```

But the security check can be bypassed by using the `node` field (that is available by default) on the root query type like that:

```php
‌query {
    node(id: "/books/1") {
        ... on Book {
            title
        }
    }
}
```

This does not execute any security checks and can therefore be used to access any entity without restrictions by everyone that has access to the API.

### Impact

Everyone using GraphQl with the `security` attribute. Not sure whereas this works with custom resolvers nor if this also applies on mutation.

Patched at https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568
GitHub Security Advisory: GHSA-cg3c-245w-728m
Package: api-platform/graphql (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 4.1.0-alpha.1, < 4.1.5
Patched in: 4.1.5

Summary: GraphQL query operations security can be bypassed

Details:
### Summary

Using the Relay special `node` type you can bypass the configured security on an operation.

### Details

Here is an example of how to apply security configurations for the GraphQL operations:

```php
#[ApiResource(
    security: "is_granted('ROLE_USER')",
    operations: [ /* ... */ ],
    graphQlOperations: [
        new Query(security: "is_granted('ROLE_USER')"),
        //...
    ],
)]
class Book { /* ... */ }
```

This indeed checks `is_granted('ROLE_USER')` as expected for a GraphQL query like the following:

```php
‌query {
    book(id: "/books/1") {
        title
    }
}
```

But the security check can be bypassed by using the `node` field (that is available by default) on the root query type like that:

```php
‌query {
    node(id: "/books/1") {
        ... on Book {
            title
        }
    }
}
```

This does not execute any security checks and can therefore be used to access any entity without restrictions by everyone that has access to the API.

### Impact

Everyone using GraphQl with the `security` attribute. Not sure whereas this works with custom resolvers nor if this also applies on mutation.

Patched at https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568
GitHub Security Advisory: GHSA-qqfq-7cpp-hcqj
Package: contao/contao (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 5.4.0-RC1, < 5.6.1
Patched in: 5.6.1

Summary: Contao does not properly manage privileges for page and article fields

Details:
### Impact

Under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

None.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-qqfq-7cpp-hcqj
Package: contao/contao (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 5.3.0, < 5.3.38
Patched in: 5.3.38

Summary: Contao does not properly manage privileges for page and article fields

Details:
### Impact

Under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

None.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-qqfq-7cpp-hcqj
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 5.4.0-RC1, < 5.6.1
Patched in: 5.6.1

Summary: Contao does not properly manage privileges for page and article fields

Details:
### Impact

Under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

None.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-qqfq-7cpp-hcqj
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 5.3.0, < 5.3.38
Patched in: 5.3.38

Summary: Contao does not properly manage privileges for page and article fields

Details:
### Impact

Under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

None.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-w53m-gxvg-vx7p
Package: contao/contao (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: >= 5.4.0-RC1, < 5.6.1
Patched in: 5.6.1

Summary: Contao can disclose sensitive information in the news module

Details:
### Impact

If a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

Do not add protected news archives to the news feed page.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-w53m-gxvg-vx7p
Package: contao/contao (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: >= 5.0.0-RC1, < 5.3.38
Patched in: 5.3.38

Summary: Contao can disclose sensitive information in the news module

Details:
### Impact

If a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

Do not add protected news archives to the news feed page.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-w53m-gxvg-vx7p
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: >= 5.4.0-RC1, < 5.6.1
Patched in: 5.6.1

Summary: Contao can disclose sensitive information in the news module

Details:
### Impact

If a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

Do not add protected news archives to the news feed page.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-w53m-gxvg-vx7p
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: >= 5.0.0-RC1, < 5.3.38
Patched in: 5.3.38

Summary: Contao can disclose sensitive information in the news module

Details:
### Impact

If a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

Do not add protected news archives to the news feed page.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-2xmj-8wmq-7475
Package: contao/contao (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-612: Improper Authorization of Index Containing Sensitive Information
Vulnerable versions: >= 5.4.0-RC1, < 5.6.1
Patched in: 5.6.1

Summary: Contao discloses sensitive information in the front end search index

Details:
### Impact

Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search.

### Patches

Update to Contao 4.13.56, 5.3.38 or 5.6.1.

### Workarounds

Disable the front end search.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-2xmj-8wmq-7475
Package: contao/contao (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-612: Improper Authorization of Index Containing Sensitive Information
Vulnerable versions: >= 5.0.0-RC1, < 5.3.38
Patched in: 5.3.38

Summary: Contao discloses sensitive information in the front end search index

Details:
### Impact

Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search.

### Patches

Update to Contao 4.13.56, 5.3.38 or 5.6.1.

### Workarounds

Disable the front end search.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-2xmj-8wmq-7475
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-612: Improper Authorization of Index Containing Sensitive Information
Vulnerable versions: >= 5.4.0-RC1, < 5.6.1
Patched in: 5.6.1

Summary: Contao discloses sensitive information in the front end search index

Details:
### Impact

Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search.

### Patches

Update to Contao 4.13.56, 5.3.38 or 5.6.1.

### Workarounds

Disable the front end search.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-2xmj-8wmq-7475
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-612: Improper Authorization of Index Containing Sensitive Information
Vulnerable versions: >= 5.0.0-RC1, < 5.3.38
Patched in: 5.3.38

Summary: Contao discloses sensitive information in the front end search index

Details:
### Impact

Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search.

### Patches

Update to Contao 4.13.56, 5.3.38 or 5.6.1.

### Workarounds

Disable the front end search.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-2xmj-8wmq-7475
Package: contao/contao (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-612: Improper Authorization of Index Containing Sensitive Information
Vulnerable versions: >= 4.9.14, < 4.13.56
Patched in: 4.13.56

Summary: Contao discloses sensitive information in the front end search index

Details:
### Impact

Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search.

### Patches

Update to Contao 4.13.56, 5.3.38 or 5.6.1.

### Workarounds

Disable the front end search.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-2xmj-8wmq-7475
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-612: Improper Authorization of Index Containing Sensitive Information
Vulnerable versions: >= 4.9.14, < 4.13.56
Patched in: 4.13.56

Summary: Contao discloses sensitive information in the front end search index

Details:
### Impact

Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search.

### Patches

Update to Contao 4.13.56, 5.3.38 or 5.6.1.

### Workarounds

Disable the front end search.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-7m47-r75r-cx8v
Package: contao/contao (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 5.4.0-RC1, < 5.6.1
Patched in: 5.6.1

Summary: Contao applies improper access control in the back end voters

Details:
### Impact

The table access voter in the back end doesn't check if a user is allowed to access the corresponding module.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

Do not rely solely on the voter and additionally check `USER_CAN_ACCESS_MODULE`.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-7m47-r75r-cx8v
Package: contao/contao (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 5.0.0, < 5.3.38
Patched in: 5.3.38

Summary: Contao applies improper access control in the back end voters

Details:
### Impact

The table access voter in the back end doesn't check if a user is allowed to access the corresponding module.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

Do not rely solely on the voter and additionally check `USER_CAN_ACCESS_MODULE`.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-7m47-r75r-cx8v
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 5.4.0-RC1, < 5.6.1
Patched in: 5.6.1

Summary: Contao applies improper access control in the back end voters

Details:
### Impact

The table access voter in the back end doesn't check if a user is allowed to access the corresponding module.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

Do not rely solely on the voter and additionally check `USER_CAN_ACCESS_MODULE`.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-7m47-r75r-cx8v
Package: contao/core-bundle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 5.0.0, < 5.3.38
Patched in: 5.3.38

Summary: Contao applies improper access control in the back end voters

Details:
### Impact

The table access voter in the back end doesn't check if a user is allowed to access the corresponding module.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

Do not rely solely on the voter and additionally check `USER_CAN_ACCESS_MODULE`.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
GitHub Security Advisory: GHSA-9hp3-f5g8-rccg
Package: solspace/craft-freeform (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 5.0.0, < 5.10.16
Patched in: 5.10.16

Summary: The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability

Details:
Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).
GitHub Security Advisory: GHSA-gqp9-jh35-439m
Package: badaso/core (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: <= 2.9.11
Patched in: unpatched

Summary: Badaso CMS file upload vulnerability

Details:
An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.
GitHub Security Advisory: GHSA-2f28-69j7-85hf
Package: alextselegidis/easyappointments (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 1.5.2-beta.1
Patched in: 1.5.2-beta.1

Summary: Easy!Appointments SQL injection vulnerability

Details:
alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter.
GitHub Security Advisory: GHSA-mqh4-2mm8-g7w9
Package: vrana/adminer (COMPOSER)
Severity: HIGH (CVSS 8.6)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 4.8.1
Patched in: unpatched

Summary: Adminer PHP Object Injection issue leads to Denial of Service

Details:
Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:[PII_REDACTED]), leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which forces excessive memory usage, rendering Adminer’s interface unresponsive and causing a server-level DoS. While the server may recover after several minutes, multiple simultaneous requests can cause a complete crash requiring manual intervention.
GitHub Security Advisory: GHSA-crcq-738g-pqvc
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: >= 5.0.0-RC1, <= 5.8.6
Patched in: 5.8.7

Summary: Craft CMS Potential Remote Code Execution via Twig SSTI

Details:
Note that users must have administrator access to the Craft Control Panel, and [allowAdminChanges](https://craftcms.com/docs/5.x/reference/config/general.html#allowadminchanges) must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment.

https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production

Note: This is a follow-up to [GHSA-f3cw-hg6r-chfv](https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv)

Users should update to the patched versions (4.16.6 and 5.8.7) to mitigate the issue.

Resources: https://github.com/craftcms/cms/pull/17612
GitHub Security Advisory: GHSA-crcq-738g-pqvc
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: >= 4.0.0-RC1, <= 4.16.5
Patched in: 4.16.6

Summary: Craft CMS Potential Remote Code Execution via Twig SSTI

Details:
Note that users must have administrator access to the Craft Control Panel, and [allowAdminChanges](https://craftcms.com/docs/5.x/reference/config/general.html#allowadminchanges) must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment.

https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production

Note: This is a follow-up to [GHSA-f3cw-hg6r-chfv](https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv)

Users should update to the patched versions (4.16.6 and 5.8.7) to mitigate the issue.

Resources: https://github.com/craftcms/cms/pull/17612