deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-gj7p-595x-qwf5
Package: dev.dsf:dsf-fhir-server (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 2.1.0
Patched in: unpatched

Summary: Data Sharing Framework is Missing Session Timeout for OIDC Sessions

Details:
### Affected Components
DSF FHIR Server with enabled [OIDC authentication](https://dsf.dev/operations/v2.1.0/fhir/oidc.html).
DSF BPE Server with enabled [OIDC authentication](https://dsf.dev/operations/v2.1.0/bpe/oidc.html).

### Summary
OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.

### Impact
If a user logs in via OIDC and leaves their browser without explicitly logging out, the session remains valid indefinitely. Another person using the same browser can access the DSF UI with the previous user's permissions. This is a realistic threat in hospital environments with shared workstations.

Only affects OIDC browser sessions, not relevant for mTLS machine-to-machine communication.

### Fix (commits f4ecb00, 7d25fea)
- Added configurable session timeout via `dev.dsf.server.auth.oidc.session.timeout` (default: `PT30M`).
- Enabled `logoutWhenIdTokenIsExpired(true)` in OpenID configuration to tie session lifetime to token lifetime.
- Websocket sessions are now closed with `VIOLATED_POLICY` when credentials expire, prevents stale websocket connections from continuing to receive events after session timeout.
GitHub Security Advisory: GHSA-gj7p-595x-qwf5
Package: dev.dsf:dsf-common-jetty (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 2.1.0
Patched in: unpatched

Summary: Data Sharing Framework is Missing Session Timeout for OIDC Sessions

Details:
### Affected Components
DSF FHIR Server with enabled [OIDC authentication](https://dsf.dev/operations/v2.1.0/fhir/oidc.html).
DSF BPE Server with enabled [OIDC authentication](https://dsf.dev/operations/v2.1.0/bpe/oidc.html).

### Summary
OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired.

### Impact
If a user logs in via OIDC and leaves their browser without explicitly logging out, the session remains valid indefinitely. Another person using the same browser can access the DSF UI with the previous user's permissions. This is a realistic threat in hospital environments with shared workstations.

Only affects OIDC browser sessions, not relevant for mTLS machine-to-machine communication.

### Fix (commits f4ecb00, 7d25fea)
- Added configurable session timeout via `dev.dsf.server.auth.oidc.session.timeout` (default: `PT30M`).
- Enabled `logoutWhenIdTokenIsExpired(true)` in OpenID configuration to tie session lifetime to token lifetime.
- Websocket sessions are now closed with `VIOLATED_POLICY` when credentials expire, prevents stale websocket connections from continuing to receive events after session timeout.
GitHub Security Advisory: GHSA-75vw-3m5v-fprh
Package: edu.stanford.nlp:stanford-corenlp (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: <= 4.3.2
Patched in: 4.4.0

Summary: corenlp is vulnerable to Improper Restriction of XML External Entity Reference

Details:
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
GitHub Security Advisory: GHSA-gcj8-76p4-g2fq
Package: org.apache.pdfbox:pdfbox-examples (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.0.0, <= 3.0.7
Patched in: 3.0.8

Summary: Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

Details:
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the 
ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.


Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example 
has been changed accordingly and is available in the project repository.
GitHub Security Advisory: GHSA-gcj8-76p4-g2fq
Package: org.apache.pdfbox:pdfbox-examples (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.0.24, <= 2.0.36
Patched in: 2.0.37

Summary: Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

Details:
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

This issue affects the 
ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7.


Users are recommended to update to version 2.0.37 or 3.0.8 once available. Until then, they should apply the fix provided in GitHub PR 427.

The ExtractEmbeddedFiles example contained a path traversal vulnerability (CWE-22) mentioned in CVE-2026-23907. However the change in the releases 2.0.36 and 3.0.7 is flawed because it doesn't consider the file path separator. Because of that, a user having writing rights on /home/ABC could be victim to a malicious PDF resulting in a write attempt to any path starting with /home/ABC, e.g. "/home/ABCDEF".

Users who have copied this example into their production code should apply the mentioned change. The example 
has been changed accordingly and is available in the project repository.
GitHub Security Advisory: GHSA-jf89-3q6q-vcgr
Package: org.apache.storm:storm-client (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 2.8.6
Patched in: 2.8.6

Summary: Apache Storm: Deserialization of Untrusted Data vulnerability

Details:
Deserialization of Untrusted Data vulnerability in Apache Storm.

Versions Affected:
before 2.8.6.


Description:
When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the "TGT" credential field, leading to remote code execution in both the Nimbus and Worker JVMs.


Mitigation:
2.x users should upgrade to 2.8.6.


Users who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6.

Credit: This issue was discovered by K.
GitHub Security Advisory: GHSA-f2hp-qw27-8wfq
Package: org.apache.storm:storm-webapp (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.8.6
Patched in: 2.8.6

Summary:  Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata

Details:
Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI


Versions Affected: before 2.8.6


Description: The Storm UI visualization component interpolates topology metadata including component IDs, stream names, and grouping values directly into HTML via innerHTML in parseNode() and parseEdge() without sanitization at any layer. An authenticated user with topology submission rights could craft a topology containing malicious HTML/JavaScript in component identifiers (e.g., a bolt ID containing an onerror event handler). This payload flows through Nimbus → Thrift → the Visualization API → vis.js tooltip rendering, resulting in stored cross-site scripting. 

In multi-tenant deployments where topology submission is available to less-trusted users but the UI is accessed by operators or administrators, this enables privilege escalation through script execution in an admin's browser session.


Mitigation: 2.x users should upgrade to 2.8.6. Users who cannot upgrade immediately should monkey-patch the parseNode() and parseEdge() functions in the visualization JavaScript file to HTML-escape all API-supplied values including nodeId, :capacity, :latency, :component, :stream, and :grouping before interpolation into tooltip HTML strings, and should additionally restrict topology submission to trusted users via Nimbus ACLs as a defense-in-depth measure. A guide on how to do this is available in the release notes of 2.8.6.

Credit: This issue was discovered while investigating another report by K.
GitHub Security Advisory: GHSA-mrqg-xmgm-rc5g
Package: org.xwiki.platform:xwiki-platform-legacy-oldcore (MAVEN)
Severity: MODERATE (CVSS 8.2)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 17.5.0-rc-1, < 17.10.1
Patched in: 17.10.1

Summary: XWiki's REST APIs can list all pages/spaces, leading to unavailability

Details:
### Impact
REST API endpoints like `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties` list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.

### Patches
This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1.

### Workarounds
We're not aware of any workarounds apart from upgrading the affected modules.
GitHub Security Advisory: GHSA-mrqg-xmgm-rc5g
Package: org.xwiki.platform:xwiki-platform-legacy-oldcore (MAVEN)
Severity: MODERATE (CVSS 8.2)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.8
Patched in: 17.4.8

Summary: XWiki's REST APIs can list all pages/spaces, leading to unavailability

Details:
### Impact
REST API endpoints like `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties` list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.

### Patches
This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1.

### Workarounds
We're not aware of any workarounds apart from upgrading the affected modules.
GitHub Security Advisory: GHSA-mrqg-xmgm-rc5g
Package: org.xwiki.platform:xwiki-platform-legacy-oldcore (MAVEN)
Severity: MODERATE (CVSS 8.2)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.8-rc-1, < 16.10.16
Patched in: 16.10.16

Summary: XWiki's REST APIs can list all pages/spaces, leading to unavailability

Details:
### Impact
REST API endpoints like `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties` list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.

### Patches
This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1.

### Workarounds
We're not aware of any workarounds apart from upgrading the affected modules.
GitHub Security Advisory: GHSA-mrqg-xmgm-rc5g
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: MODERATE (CVSS 8.2)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 17.5.0-rc-1, < 17.10.1
Patched in: 17.10.1

Summary: XWiki's REST APIs can list all pages/spaces, leading to unavailability

Details:
### Impact
REST API endpoints like `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties` list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.

### Patches
This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1.

### Workarounds
We're not aware of any workarounds apart from upgrading the affected modules.
GitHub Security Advisory: GHSA-mrqg-xmgm-rc5g
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: MODERATE (CVSS 8.2)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.8
Patched in: 17.4.8

Summary: XWiki's REST APIs can list all pages/spaces, leading to unavailability

Details:
### Impact
REST API endpoints like `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties` list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.

### Patches
This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1.

### Workarounds
We're not aware of any workarounds apart from upgrading the affected modules.
GitHub Security Advisory: GHSA-mrqg-xmgm-rc5g
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: MODERATE (CVSS 8.2)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.8-rc-1, < 16.10.16
Patched in: 16.10.16

Summary: XWiki's REST APIs can list all pages/spaces, leading to unavailability

Details:
### Impact
REST API endpoints like `/xwiki/rest/wikis/xwiki/spaces/AnnotationCode/pages/AnnotationConfig/objects/AnnotationCode.AnnotationConfig/0/properties` list all available pages as part of the metadata for database list properties, which can exhaust available resources on large wikis.

### Patches
This problem has been patched by applying the configured query limit also to the available values for database list properties in XWiki 16.10.16, 17.4.8 and 17.10.1.

### Workarounds
We're not aware of any workarounds apart from upgrading the affected modules.
GitHub Security Advisory: GHSA-w4fj-87j5-f25c
Package: org.xwiki.platform:xwiki-platform-web-templates (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 17.5.0-rc-1, < 17.10.1
Patched in: 17.10.1

Summary: XWiki has Reflected Cross-Site Scripting (XSS) in page history compare

Details:
### Impact
A reflected cross-site scripting vulnerability (XSS) in the compare view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance.

### Patches
The problem has been patched by properly escaping the URL parameters.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/3c8a2ec[PII_REDACTED]15c2db937574fcd360c788c#diff-a5e75a4e3820a63c02a32666dda67c73ee7885ab8e7f67e52cfcb3be5a13326e) can be applied manually to `templates/changesdoc.vm` in the deployed WAR.

### Attribution

XWiki thanks Mike Cole @mikecole-mg for discovering and reporting this vulnerability.
GitHub Security Advisory: GHSA-w4fj-87j5-f25c
Package: org.xwiki.platform:xwiki-platform-web-templates (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.8
Patched in: 17.4.8

Summary: XWiki has Reflected Cross-Site Scripting (XSS) in page history compare

Details:
### Impact
A reflected cross-site scripting vulnerability (XSS) in the compare view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance.

### Patches
The problem has been patched by properly escaping the URL parameters.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/3c8a2ec[PII_REDACTED]15c2db937574fcd360c788c#diff-a5e75a4e3820a63c02a32666dda67c73ee7885ab8e7f67e52cfcb3be5a13326e) can be applied manually to `templates/changesdoc.vm` in the deployed WAR.

### Attribution

XWiki thanks Mike Cole @mikecole-mg for discovering and reporting this vulnerability.
GitHub Security Advisory: GHSA-w4fj-87j5-f25c
Package: org.xwiki.platform:xwiki-platform-web-templates (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 10.4-rc-1, < 16.10.16
Patched in: 16.10.16

Summary: XWiki has Reflected Cross-Site Scripting (XSS) in page history compare

Details:
### Impact
A reflected cross-site scripting vulnerability (XSS) in the compare view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance.

### Patches
The problem has been patched by properly escaping the URL parameters.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/3c8a2ec[PII_REDACTED]15c2db937574fcd360c788c#diff-a5e75a4e3820a63c02a32666dda67c73ee7885ab8e7f67e52cfcb3be5a13326e) can be applied manually to `templates/changesdoc.vm` in the deployed WAR.

### Attribution

XWiki thanks Mike Cole @mikecole-mg for discovering and reporting this vulnerability.
GitHub Security Advisory: GHSA-822v-8w6h-5jxp
Package: org.dromara.warm:warm-flow-plugin-modes-sb (MAVEN)
Severity: LOW (CVSS 6.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 1.8.5
Patched in: 1.8.5

Summary: Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression

Details:
A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
GitHub Security Advisory: GHSA-hwqh-2684-54fc
Package: org.springframework.cloud:spring-cloud-gateway (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-15: External Control of System or Configuration Setting
Vulnerable versions: = 4.2.0
Patched in: 4.2.1

Summary: Spring Cloud Gateway's SSL bundle configuration silently bypassed

Details:
When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead.

Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally, if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1, which are the current supported open source releases.
GitHub Security Advisory: GHSA-jm43-hrq7-r7w6
Package: org.xwiki.platform:xwiki-platform-refactoring-default (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: >= 7.4.5, < 8.0-milestone-1
Patched in: 16.4.7

Summary: XWiki allows privilege escalation through link refactoring

Details:
### Impact

Pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained in xobjects that should have never been executed. 
This vulnerability affects all version of XWiki since 8.2 and 7.4.5.

### Patches

The patch consists in only setting the `originalMetadataAuthor` when performing such change, so that it's displayed in the history but it has no impact on the right evaluation (i.e. the original author of the changes is still used for right computation). 

This patch has been applied on XWiki 16.4.7, 17.1.0RC1, 16.10.4.

### Workarounds

There's no workaround for this vulnerability, except preventing to perform any refactoring operation with users having more than edit rights. 
Administrators are strongly advised to upgrade. If not possible, the patch only impacts module `xwiki-platform-refactoring-default` so it's possible to apply the commit and rebuild and deploy only that module.

### CVSS explanation

Attack vector: Network - Always for XWiki.
Complexity: Low - The set of operations to perform the attack is quite easy.
Attack requirements: None - Any system is vulnerable, it doesn't depend on specific condition other than user interaction.
Privileges required: Low - The attacker only needs edit rights.
User interaction: Active - To be successful the attack needs someone with more rights to perform a move/rename of a specific page.
Confidentiality: High - The attack might lead to execution of any script.
Integrity: High - The attack might lead to execution of any script.
Availability: High - The attack might lead to execution of any script.
Subsequent system impacts: None for any criteria. Only current system is affected.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
GitHub Security Advisory: GHSA-445c-vh5m-36rj
Package: org.apache.logging.log4j:log4j-core (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-117: Improper Output Neutralization for Logs, CWE-684: Incorrect Provision of Specified Functionality
Vulnerable versions: >= 3.0.0-beta1, <= 3.0.0-beta3
Patched in: unpatched

Summary: Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility

Details:
Apache Log4j Core's [`Rfc5424Layout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout), in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:

  *  The `newLineEscape` attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.
  *  The `useTlsMessageFormat` attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.

Users of the `SyslogAppender` are not affected, as its configuration attributes were not modified.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.