deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-41425
Published: 2023-11-07
Description: Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://wondercms.com; https://gist.github.com/prodigiousMind/fc69a79629c4ba9ee88a7ad526043413; http://wondercms.com
CVE: CVE-2023-42659
Published: 2023-11-07
Description: 
In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified.  An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application.

CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2023; https://www.progress.com/ws_ftp; https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2023
CVE: CVE-2023-47359
Published: 2023-11-07
Description: Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in a memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://0xariana.github.io/blog/real_bugs/vlc/mms; https://lists.debian.org/debian-lts-announce/2023/11/msg00034.html; https://0xariana.github.io/blog/real_bugs/vlc/mms
CVE: CVE-2023-47360
Published: 2023-11-07
Description: Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://0xariana.github.io/blog/real_bugs/vlc/mms; https://lists.debian.org/debian-lts-announce/2023/11/msg00034.html; https://0xariana.github.io/blog/real_bugs/vlc/mms
CVE: CVE-2023-4272
Published: 2023-11-07
Description: A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory. 


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-1251
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2023-4295
Published: 2023-11-07
Description: A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-416, CWE-190, CWE-416
References: http://packetstormsecurity.com/files/176109/Arm-Mali-CSF-Overflow-Use-After-Free.html; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; http://packetstormsecurity.com/files/176109/Arm-Mali-CSF-Overflow-Use-After-Free.html
CVE: CVE-2023-5179
Published: 2023-11-07
Description: An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to an out-of-bounds read. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution. 





CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.opendesign.com/security-advisories; https://www.opendesign.com/security-advisories
CVE: CVE-2022-45078
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Solwin Infotech User Blocker.This issue affects User Blocker: from n/a through 1.5.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/user-blocker/wordpress-user-blocker-plugin-1-5-5-auth-csv-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/user-blocker/wordpress-user-blocker-plugin-1-5-5-auth-csv-injection-vulnerability?_s_id=cve
CVE: CVE-2022-45348
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in anmari amr users.This issue affects amr users: from n/a through 4.59.4.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/amr-users/wordpress-amr-users-plugin-4-59-4-csv-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/amr-users/wordpress-amr-users-plugin-4-59-4-csv-injection-vulnerability?_s_id=cve
CVE: CVE-2022-45360
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Scott Reilly Commenter Emails.This issue affects Commenter Emails: from n/a through 2.6.1.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/commenter-emails/wordpress-commenter-emails-plugin-2-6-1-csv-injection?_s_id=cve; https://patchstack.com/database/vulnerability/commenter-emails/wordpress-commenter-emails-plugin-2-6-1-csv-injection?_s_id=cve
CVE: CVE-2022-45370
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/comments-import-export-woocommerce/wordpress-wordpress-comments-import-export-plugin-2-3-1-csv-injection?_s_id=cve; https://patchstack.com/database/vulnerability/comments-import-export-woocommerce/wordpress-wordpress-comments-import-export-plugin-2-3-1-csv-injection?_s_id=cve
CVE: CVE-2022-45810
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a through 5.5.2.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/email-subscribers/wordpress-icegram-express-email-subscribers-newsletters-and-marketing-automation-plugin-plugin-5-5-2-csv-injection?_s_id=cve; https://patchstack.com/database/vulnerability/email-subscribers/wordpress-icegram-express-email-subscribers-newsletters-and-marketing-automation-plugin-plugin-5-5-2-csv-injection?_s_id=cve
CVE: CVE-2022-46801
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/site-reviews/wordpress-site-reviews-plugin-6-2-0-unauth-csv-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/site-reviews/wordpress-site-reviews-plugin-6-2-0-unauth-csv-injection-vulnerability?_s_id=cve
CVE: CVE-2022-46803
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin – Noptin.This issue affects Simple Newsletter Plugin – Noptin: from n/a through 1.9.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/newsletter-optin-box/wordpress-simple-newsletter-plugin-noptin-plugin-1-9-5-unauth-csv-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/newsletter-optin-box/wordpress-simple-newsletter-plugin-noptin-plugin-1-9-5-unauth-csv-injection-vulnerability?_s_id=cve
CVE: CVE-2022-46804
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Narola Infotech Solutions LLP Export Users Data Distinct.This issue affects Export Users Data Distinct: from n/a through 1.3.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-1236, CWE-1236
References: https://patchstack.com/database/vulnerability/export-users-data-distinct/wordpress-export-users-data-distinct-plugin-1-3-csv-injection?_s_id=cve; https://patchstack.com/database/vulnerability/export-users-data-distinct/wordpress-export-users-data-distinct-plugin-1-3-csv-injection?_s_id=cve
CVE: CVE-2022-46809
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX – Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/reviewx/wordpress-reviewx-plugin-1-6-6-csv-injection?_s_id=cve; https://patchstack.com/database/vulnerability/reviewx/wordpress-reviewx-plugin-1-6-6-csv-injection?_s_id=cve
CVE: CVE-2022-46821
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails & Newsletters with Jackmail: from n/a through 1.2.22.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/jackmail-newsletters/wordpress-emails-newsletters-with-jackmail-plugin-1-2-22-csv-injection?_s_id=cve; https://patchstack.com/database/vulnerability/jackmail-newsletters/wordpress-emails-newsletters-with-jackmail-plugin-1-2-22-csv-injection?_s_id=cve
CVE: CVE-2023-0898
Published: 2023-11-07
Description: 
General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the application.





CVSS Score: 5.3 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-311-23; https://www.cisa.gov/news-events/ics-advisories/icsa-23-311-23
CVE: CVE-2022-38702
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/wp-csv-exporter/wordpress-wp-csv-exporter-plugin-1-3-6-authenticated-csv-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-csv-exporter/wordpress-wp-csv-exporter-plugin-1-3-6-authenticated-csv-injection-vulnerability?_s_id=cve
CVE: CVE-2022-41616
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/export-users-data-csv/wordpress-export-users-data-csv-plugin-2-1-auth-csv-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/export-users-data-csv/wordpress-export-users-data-csv-plugin-2-1-auth-csv-injection-vulnerability?_s_id=cve
CVE: CVE-2022-42882
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a through 1.5.8.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/simple-csv-xls-exporter/wordpress-simple-csv-xls-exporter-plugin-1-5-8-authenticated-csv-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-csv-xls-exporter/wordpress-simple-csv-xls-exporter-plugin-1-5-8-authenticated-csv-injection-vulnerability?_s_id=cve
CVE: CVE-2022-44738
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: from n/a through 1.1.3.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/posts-and-users-stats/wordpress-posts-and-users-stats-plugin-1-1-3-csv-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/posts-and-users-stats/wordpress-posts-and-users-stats-plugin-1-1-3-csv-injection-vulnerability?_s_id=cve
CVE: CVE-2022-47181
Published: 2023-11-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/a through 1.4.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/email-templates/wordpress-email-templates-plugin-1-4-2-cross-site-request-forgery-csrf?_s_id=cve; https://patchstack.com/database/vulnerability/email-templates/wordpress-email-templates-plugin-1-4-2-cross-site-request-forgery-csrf?_s_id=cve
CVE: CVE-2023-28499
Published: 2023-11-07
Description: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in simonpedge Slide Anything – Responsive Content / HTML Slider and Carousel plugin <= 2.4.9 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/slide-anything/wordpress-slide-anything-plugin-2-4-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slide-anything/wordpress-slide-anything-plugin-2-4-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32966
Published: 2023-11-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab Jazz Popups leads to Stored XSS.This issue affects Jazz Popups: from n/a through 1.8.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/jazz-popups/wordpress-jazz-popups-plugin-1-8-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jazz-popups/wordpress-jazz-popups-plugin-1-8-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-41798
Published: 2023-11-07
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-1236
References: https://patchstack.com/database/vulnerability/directorist/wordpress-directorist-plugin-7-7-0-csv-injection?_s_id=cve; https://patchstack.com/database/vulnerability/directorist/wordpress-directorist-plugin-7-7-0-csv-injection?_s_id=cve
CVE: CVE-2023-46501
Published: 2023-11-07
Description: An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://github.com/Cyber-Wo0dy/CVE-2023-46501; https://github.com/Cyber-Wo0dy/report/blob/main/boltwire/v6.03/boltwire_improper_access_control; https://github.com/Cyber-Wo0dy/CVE-2023-46501
CVE: CVE-2023-46730
Published: 2023-11-07
Description: Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.php endpoint. The /api/upload.php endpoint does not filter URLs which allows a malicious user to cause the server to make resource requests to untrusted domains. Note that protocols like file:// can also be used to access the server disk. The request result (on success) can then be retrieved using /api/download.php. This issue has been addressed in versions 6.8.15, 6.7.54, and 6.6.177. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.4 (HIGH)
CWE: CWE-918
References: https://github.com/Intermesh/groupoffice/commit/99205535e8cec6592fd7f[PII_REDACTED]f27c72d50; https://github.com/Intermesh/groupoffice/security/advisories/GHSA-vw6c-h82w-mvfv; https://github.com/Intermesh/groupoffice/commit/99205535e8cec6592fd7f[PII_REDACTED]f27c72d50
CVE: CVE-2023-46737
Published: 2023-11-07
Description: Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in an endless data attack. The root cause is that Cosign loops through all attestations fetched from the remote registry in pkg/cosign.FetchAttestations. The attacker needs to compromise the registry or make a request to a registry they control. When doing so, the attacker must return a high number of attestations in the response to Cosign. The result will be that the attacker can cause Cosign to go into a long or infinite loop that will prevent other users from verifying their data. In Kyvernos case, an attacker whose privileges are limited to making requests to the cluster can make a request with an image reference to their own registry, trigger the infinite loop and deny other users from completing their admission requests. Alternatively, the attacker can obtain control of the registry used by an organization and return a high number of attestations instead the expected number of attestations. The issue can be mitigated rather simply by setting a limit to the limit of attestations that Cosign will loop through. The limit does not need to be high to be within the vast majority of use cases and still prevent the endless data attack. This issue has been patched in version 2.2.1 and users are advised to upgrade.
CVSS Score: 3.1 (LOW)
CWE: CWE-400, CWE-835
References: https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f; https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9; https://github.com/sigstore/cosign/commit/8ac891ff0e29ddc67965423bee8f826219c6eb0f
CVE: CVE-2023-46744
Published: 2023-11-07
Description: Squidex is an open source headless CMS and content management hub. In affected versions a stored Cross-Site Scripting (XSS) vulnerability enables privilege escalation of authenticated users. The SVG element filtering mechanism intended to stop XSS attacks through uploaded SVG images, is insufficient resulting to stored XSS attacks. Squidex allows the CMS contributors to be granted the permission of uploading an SVG asset. When the asset is uploaded, a filtering mechanism is performed to validate that the SVG does not contain malicious code. The validation logic consists of traversing the HTML nodes in the DOM. In order for the validation to succeed, 2 conditions must be met: 1. No HTML tags included in a "blacklist" called "InvalidSvgElements" are present. This list only contains the element "script". and 2. No attributes of HTML tags begin with "on" (i.e. onerror, onclick) (line 65). If either of the 2 conditions is not satisfied, validation fails and the file/asset is not uploaded. However it is possible to bypass the above filtering mechanism and execute arbitrary JavaScript code by introducing other HTML elements such as an <iframe> element with a "src" attribute containing a "javascript:" value. Authenticated adversaries with the "assets.create" permission, can leverage this vulnerability to upload a malicious SVG as an asset, targeting any registered user that will attempt to open/view the asset through the Squidex CMS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Squidex/squidex/security/advisories/GHSA-xfr4-qg2v-7v5m; https://github.com/Squidex/squidex/security/advisories/GHSA-xfr4-qg2v-7v5m
CVE: CVE-2023-46242
Published: 2023-11-07
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to execute a content with the right of any user via a crafted URL. A user must have `programming` privileges in order to exploit this vulnerability. This issue has been patched in XWiki 14.10.7 and 15.2RC1. Users are advised to upgrade. There are no known workarounds for for this vulnerability.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-94, CWE-352
References: https://github.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hgpw-6p4h-j6h5; https://jira.xwiki.org/browse/XWIKI-20386
CVE: CVE-2023-46244
Published: 2023-11-07
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to write a script in which any velocity content is executed with the right of any other document content author. Since this API require programming right and the user does not have it, the expected result is `$doc.document.authors.contentAuthor` (not executed script), unfortunately with the security vulnerability it is possible for the attacker to get `XWiki.superadmin` which shows that the title was executed with the right of the unmodified document. This has been patched in XWiki versions 14.10.7 and 15.2RC1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://github.com/xwiki/xwiki-platform/commit/11a9170dfe63e59f4066db67f84dbfce4ed619c6; https://github.com/xwiki/xwiki-platform/commit/41d7dca2d30084966ca6a7ee537f39ee8354a7e3; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rmxw-c48h-2vf5
CVE: CVE-2023-46252
Published: 2023-11-07
Description: Squidex is an open source headless CMS and content management hub. Affected versions are missing origin verification in a postMessage handler which introduces a Cross-Site Scripting (XSS) vulnerability. The editor-sdk.js file defines three different class-like functions, which employ a global message event listener: SquidexSidebar, SquidexWidget, and SquidexFormField. The registered event listener takes some action based on the type of the received message. For example, when the SquidexFormField receives a message with the type valueChanged, the value property is updated. The SquidexFormField class is for example used in the editor-editorjs.html file, which can be accessed via the public wwwroot folder. It uses the onValueChanged method to register a callback function, which passes the value provided from the message event to the editor.render. Passing an attacker-controlled value to this function introduces a Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Squidex/squidex/security/advisories/GHSA-7q4f-fprr-5jw8; https://github.com/Squidex/squidex/security/advisories/GHSA-7q4f-fprr-5jw8
CVE: CVE-2023-46253
Published: 2023-11-07
Description: Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution (RCE). Squidex allows users with the `squidex.admin.restore` permission to create and restore backups. Part of these backups are the assets uploaded to an App. For each asset, the backup zip archive contains a `.asset` file with the actual content of the asset as well as a related `AssetCreatedEventV2` event, which is stored in a JSON file. Amongst other things, the JSON file contains the event type (`AssetCreatedEventV2`), the ID of the asset (`46c05041-9588-4179-b5eb-ddfcd9463e1e`), its filename (`test.txt`), and its file version (`0`). When a backup with this event is restored, the `BackupAssets.ReadAssetAsync` method is responsible for re-creating the asset. For this purpose, it determines the name of the `.asset` file in the zip archive, reads its content, and stores the content in the filestore. When the asset is stored in the filestore via the UploadAsync method, the assetId and fileVersion are passed as arguments. These are further passed to the method GetFileName, which determines the filename where the asset should be stored. The assetId is inserted into the filename without any sanitization and an attacker with squidex.admin.restore privileges to run arbitrary operating system commands on the underlying server (RCE).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/Squidex/squidex/security/advisories/GHSA-phqq-8g7v-3pg5; https://github.com/Squidex/squidex/security/advisories/GHSA-phqq-8g7v-3pg5