Research & Advisories

Tenant-triggered code execution on the DNS server via LUA record injection through the zone metadata editor.

OIDC/SAML account linking trusts an unverified email claim, allowing takeover of a local administrator account (nOAuth pattern).

Fail-open privilege assignment: OIDC/SAML auto-provisioning grants Administrator when the default permission template cannot be resolved.

Privilege escalation via getMinimalPermissionTemplateId(): the least-privilege default resolves to Administrator.

SOA/NS write restriction for zone_content_edit_own_as_client bypassed by changing the record type in the same request.

Missing CSRF protection on GET-triggered state-changing endpoints (DNSSEC key toggle, template/supermaster/permission-template deletion).

Installer IP allow-list bypass via a spoofable X-Forwarded-For header.

Array-form request headers bypass cross-origin sensitive-header stripping (Authorization, Cookie, Proxy-Authorization forwarded to the redirect target).

Incomplete regular-expression escaping in the sensitiveHeaders option lets metacharacter-named credential headers silently bypass cross-origin stripping.

Arbitrary code execution via a malicious logging config (dictConfig) when loading an untrusted Hydra configuration.

instantiate() blocklist bypass via a timeit.timeit / pickle.loads chain, reaching code execution past the blocklist.

YAML NaN/Inf values bypass the built-in guards and panic via the OAS 3.1 validation path.

Incomplete fix for GHSA-p6wj-qrr4-pgh5: three unpatched nil-Items panic paths in openapi3filter.

Uncontrolled recursion on circular allOf/anyOf/oneOf schemas causes a fatal process crash.

Prototype-pollution gadget in the Axios default instance allows an inherited request-method override (a safe GET can go out as DELETE, POST, PUT, or PATCH).

Authenticated (admin) server-side template injection to remote code execution via Bazar semantic templates.

Unauthenticated ActivityPub signature-verification bypass via !openssl_verify(...) accepting int(-1).

Unauthenticated server-side request forgery via the ActivityPub Signature.keyId.

Second-order SQL injection in the page-delete API via an unescaped page tag (ApiController::deletePage).

Reflected XSS via an unescaped archived-revision time parameter in handlers/page/show.php.

Reflected XSS via an unescaped id parameter in Bazar widget HTML attributes.