diff --git a/benchmarks/independent/candidates-v3-php.json b/benchmarks/independent/candidates-v3-php.json new file mode 100644 index 0000000..4acc296 --- /dev/null +++ b/benchmarks/independent/candidates-v3-php.json @@ -0,0 +1,1808 @@ +{ + "schema_version": 1, + "status": "candidates (not reserved, not frozen)", + "research": "research-2026-09-30-php.md", + "researched_on": "2026-09-30", + "note": "Web research only: GitHub advisory records and commit/compare metadata via gh api. No candidate repository was cloned, scanned or run through any project tool. `sites` come from the advisory text; where only a file (or only a class) is named, `site_files` and `sink_evidence` carry what the advisory states and the function must be resolved at freeze. `benign.proposal` is an API-side proposal made with freeze.py's filter; freeze.py and a reviewer decide.", + "recommended_selection": [ + "gitlist-commandline-cmdi", + "qloapps-customermessage-bo-query-sqli", + "roundcube-markasjunk-cmd-learn-rce", + "winter-filter-numberrange-sqli", + "maccms10-template-blacklist-rce", + "sharp-editor-iframe-srcdoc-xss", + "privatebin-jsonld-request-uri-injection", + "openstamanager-group-name-html-injection", + "wp-geo-my-wp-info-window-lfi", + "kirby-realpath-sibling-traversal", + "mineadmin-appstore-identifier-traversal", + "elfinder-fsock-dns-rebinding-ssrf", + "easyappointments-caldav-ssrf", + "wp-graphql-updatepost-publish-bypass", + "sylius-mollie-thankyou-order-idor", + "wp-podlove-generation-guard-poi" + ], + "cases": [ + { + "id": "grav-blueprint-bare-function-rce", + "repo": "https://github.com/getgrav/grav", + "language": "php", + "also": [], + "wordpress": false, + "family": "injection", + "subtype": "code injection (callable allow-list bypass → arbitrary PHP function)", + "advisory": [ + "CVE-2026-75827", + "GHSA-f8wv-xp27-6gq7" + ], + "published": "2026-09-17", + "lane": "A (reviewed, composer)", + "vulnerable_versions": "<= 2.0.14", + "fixed_version": "2.0.15", + "vulnerable": "24e8717ae317d50941472479f748b974f4034c51", + "fixed": "af31066e9b6a5e6b5e675cc3368f4a741fe3ea21", + "ancestry": "parent; ancestor of tag 2.0.15", + "fix_named_by_advisory": false, + "fix_note": "The advisory links no commit. Found in the release compare 2.0.14...2.0.15 (14 commits, each security fix labelled): `af31066e` '[security] Gate the blueprint bare-function data directive on a positive allowlist', 1 file (Blueprint.php +11-1). A later commit in the same release, `c51987f5` 'Trust blueprint dynamic-data providers by provenance, not by allowlist', reworks the same gate.", + "fix_changed_files": [ + "system/src/Grav/Common/Data/Blueprint.php" + ], + "sink": "system/src/Grav/Common/Data/Blueprint.php:455-458 `call_user_func_array($o, $params)` (bare-function dynamic-data provider), gated by `Blueprint::isSafeDynamicCall()` (Blueprint.php:514-536), whose bare-function branch uses only the denylist `Utils::isDangerousFunction()`; twin sink system/src/Grav/Framework/Flex/FlexDirectory.php:936-938 `call_user_func_array($function, $params)`", + "source": "a blueprint `data-*@` directive naming a bare PHP function (e.g. `error_log`) with attacker parameters, resolved by `Blueprint::init()`", + "sites": [ + "system/src/Grav/Common/Data/Blueprint.php::isSafeDynamicCall", + "system/src/Grav/Common/Data/Blueprint.php::init" + ], + "site_files": [ + "system/src/Grav/Framework/Flex/FlexDirectory.php" + ], + "sink_evidence": "call_user_func_array($o, $params)", + "site_derivation": "file paths and function names quoted by the advisory", + "privilege": "authenticated account that can edit pages/blueprint data (per the advisory's root-cause section; verify)", + "license": "MIT", + "repo_size_mb": 34, + "default_branch": "develop", + "languages_pct": { + "PHP": 100 + }, + "confidence": "high", + "caveats": [ + "guard bypass: the vulnerable pin already has a denylist check", + "the enclosing function of the call_user_func_array line is not named by this advisory (sink_evidence is used instead)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "4f1340631b9d28d119986f43f65887c92a21959b", + "tip": "8661b3b5644821235c7f669a073db6bfa551f4d0", + "subject": "Deduplicate repeated debugger deprecation traces", + "files": [ + "CHANGELOG.md", + "system/src/Grav/Common/Debugger.php", + "tests/unit/Grav/Common/DebuggerDeprecationsTest.php" + ], + "lines": 172, + "branch": "develop", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": false + }, + { + "id": "backpack-stats-host-header-cmdi", + "repo": "https://github.com/Laravel-Backpack/CRUD", + "language": "php", + "also": [], + "wordpress": false, + "family": "injection", + "subtype": "OS command injection", + "advisory": [ + "CVE-2026-54182", + "GHSA-mrc5-3mm3-45c5" + ], + "published": "2026-08-20", + "lane": "A", + "vulnerable_versions": "7.x < 7.0.36 (also 4.1.x < 4.1.72, 5.x < 5.6.2, 6.x < 6.8.13)", + "fixed_version": "7.0.36", + "vulnerable": "baae0420b6ebefaf5fe4cd88c1fc358feb9c2816", + "fixed": "282ba2a0b88749fb1888b3836678ba462d7023f0", + "ancestry": "parent; the fixed commit is tag 7.0.36", + "fix_named_by_advisory": false, + "fix_note": "The advisory links only release tags. The compare 7.0.35...7.0.36 contains exactly one commit, `282ba2a0` 'refactor stats to use guzzle only' (src/Stats.php +6-31), matching the advisory's 'makeCurlRequest was replaced with the Guzzle-based path'.", + "fix_changed_files": [ + "src/Stats.php" + ], + "sink": "`Backpack\\CRUD\\Stats::makeCurlRequest` builds a shell command and passes it to `exec()`", + "source": "HTTP `Host` header, on every production request through `BackpackServiceProvider::boot()` (1-in-100 random gate)", + "sites": [ + "src/Stats.php::makeCurlRequest" + ], + "site_files": [ + "src/BackpackServiceProvider.php" + ], + "sink_evidence": "", + "site_derivation": "class and method named by the advisory; the path src/Stats.php follows from the PSR-4 class name and is confirmed only by the fix commit's file list", + "privilege": "unauthenticated", + "license": "MIT", + "repo_size_mb": 76, + "default_branch": "main", + "languages_pct": { + "PHP": 80, + "Blade": 17 + }, + "confidence": "high", + "caveats": [ + "needs exec() and curl available, and a Host header that the web server passes through (the advisory rates AC:H)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "dd25c2086b8ea2cb765993b65876c66ab824eef0", + "tip": "608652b1020ba274781f222d2959d7780a559a08", + "subject": "fix color display (#5992)", + "files": [ + "src/resources/views/crud/columns/color.blade.php" + ], + "lines": 8, + "branch": "main", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": false + }, + { + "id": "winter-filter-numberrange-sqli", + "repo": "https://github.com/wintercms/winter", + "language": "php", + "also": [ + "javascript" + ], + "wordpress": false, + "family": "injection", + "subtype": "SQL injection", + "advisory": [ + "CVE-2026-32593", + "GHSA-m7jc-g4rc-jmvh" + ], + "published": "2026-08-12", + "lane": "A", + "vulnerable_versions": "<= 1.2.12", + "fixed_version": "1.2.13", + "vulnerable": "555e67c84b503b60aa0a5775382087c5da97b7ca", + "fixed": "50713de95adf5298536d93f4d999652525d36d43", + "ancestry": "parent; ancestor of tag v1.2.13, not of v1.2.12", + "fix_named_by_advisory": true, + "fix_note": "Advisory workaround names commit `50713de9` 'Use parameter binding for filter scope values in conditions statements' (modules/backend/widgets/Filter.php +64-24, plus a test).", + "fix_changed_files": [ + "modules/backend/tests/widgets/FilterWidgetTest.php", + "modules/backend/widgets/Filter.php" + ], + "sink": "`Backend\\Widgets\\Filter` builds SQL for a `numberrange` scope configured with a `conditions` key", + "source": "the filter widget's AJAX handler (`numbersFromAjax`, per the advisory title)", + "sites": [ + "modules/backend/widgets/Filter.php::numbersFromAjax" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "class `Backend\\Widgets\\Filter` and `numbersFromAjax` named by the advisory; path confirmed by the fix commit", + "privilege": "authenticated backend user with access to an affected list view", + "license": "MIT", + "repo_size_mb": 68, + "default_branch": "develop", + "languages_pct": { + "PHP": 70, + "JavaScript": 19, + "Less": 8 + }, + "confidence": "medium", + "caveats": [ + "no built-in view uses the vulnerable scope/config combination: exploitable only with a plugin that registers a numberrange scope with `conditions` (the sink is in core, the configuration is not)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "555e67c84b503b60aa0a5775382087c5da97b7ca", + "tip": "2a342f94ae7cc9d20852337aa980f075106420d6", + "subject": "Improved Ukrainian translation (#1467)", + "files": [ + "modules/backend/lang/uk/lang.php" + ], + "lines": 46, + "branch": "develop", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "mantisbt-tokenizer-eval-rce", + "repo": "https://github.com/mantisbt/mantisbt", + "language": "php", + "also": [], + "wordpress": false, + "family": "injection", + "subtype": "code injection (eval)", + "advisory": [ + "CVE-2026-49273", + "GHSA-v84x-qvhg-f36r" + ], + "published": "2026-07-15", + "lane": "A", + "vulnerable_versions": ">= 1.3.0, <= 2.28.3", + "fixed_version": "2.28.4", + "vulnerable": "e7041ecc80c8d35f76a7ea1027a8a231244f7dc5", + "fixed": "78c0af63d1fe0118004744cab21ca3bf2cea0f5c", + "ancestry": "parent; ancestor of tag release-2.28.4", + "fix_named_by_advisory": true, + "fix_note": "Advisory patch link `78c0af63` 'Remove use of eval() in Tokenizer class' (core/classes/Tokenizer.class.php +2-6).", + "fix_changed_files": [ + "core/classes/Tokenizer.class.php" + ], + "sink": "`Tokenizer` (reached through `ConfigParser`) calls `eval()` with a `return;` prefix; PHP hoists class declarations past the return", + "source": "non-string configuration value submitted to adm_config_set.php (Manage Configuration)", + "sites": [], + "site_files": [ + "core/classes/Tokenizer.class.php", + "adm_config_set.php" + ], + "sink_evidence": "eval(", + "site_derivation": "the advisory names adm_config_set.php, ConfigParser, Tokenizer and eval(); the Tokenizer file path and the enclosing function are not named (path from the fix commit)", + "privilege": "administrator", + "license": "GitHub: none [verify]", + "repo_size_mb": 89, + "default_branch": "master", + "languages_pct": { + "PHP": 82, + "CSS": 10 + }, + "confidence": "high", + "caveats": [ + "function-level site must be resolved at freeze by reading the file (the advisory names only the class)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "f734bff6ea55d50d62db4ce518aae1536ab3da72", + "tip": "c867fcc0c1198298bf90b3e29bc63410aaefc9e0", + "subject": "Web UI: use project category commands", + "files": [ + "manage_proj_cat_add.php", + "manage_proj_cat_copy.php", + "manage_proj_cat_delete.php", + "manage_proj_cat_update.php" + ], + "lines": 58, + "branch": "master", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": false + }, + { + "id": "gitlist-commandline-cmdi", + "repo": "https://github.com/klaussilveira/gitlist", + "language": "php", + "also": [], + "wordpress": false, + "family": "injection", + "subtype": "OS command / argument injection", + "advisory": [ + "CVE-2026-82668", + "GHSA-v64j-pgc3-qgc9" + ], + "published": "2026-08-31", + "lane": "B (unreviewed, GitHub fix reference)", + "vulnerable_versions": "2.0.0", + "fixed_version": "3.0.0-beta", + "vulnerable": "f67609d52c1812fa8a7ed80eae5e795cfd72115f", + "fixed": "88cf2866083d5f7c20d9d565c45f828a7ad1516b", + "ancestry": "parent; ancestor of tag 3.0.0-beta", + "fix_named_by_advisory": true, + "fix_note": "Advisory names patch `88cf2866` 'Prevent textconv. Fixes #947.' (src/SCM/System/Git/CommandLine.php +2-2, plus a test).", + "fix_changed_files": [ + "src/SCM/System/Git/CommandLine.php", + "tests/unit/SCM/System/Git/CommandLineTest.php" + ], + "sink": "`getDefaultBranch` of src/SCM/System/Git/CommandLine.php (git command line)", + "source": "repository content/arguments reaching the git command line (not stated precisely)", + "sites": [ + "src/SCM/System/Git/CommandLine.php::getDefaultBranch" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "file and function quoted by the advisory (VulDB-generated text)", + "privilege": "not stated ('remotely')", + "license": "BSD-3-Clause", + "repo_size_mb": 6, + "default_branch": "master", + "languages_pct": { + "PHP": 87, + "Twig": 9 + }, + "confidence": "medium", + "caveats": [ + "VulDB auto-generated description; the fix message ('Prevent textconv') suggests git config/attribute abuse rather than shell metacharacters, and the patched lines may not be in getDefaultBranch -- verify at freeze" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": null, + "idea": "no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file)" + }, + "recommended": true + }, + { + "id": "qloapps-customermessage-bo-query-sqli", + "repo": "https://github.com/Qloapps/QloApps", + "language": "php", + "also": [ + "javascript" + ], + "wordpress": false, + "family": "injection", + "subtype": "SQL injection", + "advisory": [ + "CVE-2026-75497", + "GHSA-5w6r-2mxc-fq3v" + ], + "published": "2026-08-25", + "lane": "B", + "vulnerable_versions": "not stated ('Fixed in 123c97c')", + "fixed_version": "commit 123c97c", + "vulnerable": "5b4d65cbb8570a4ba46364ee0f2ded79d294ab84", + "fixed": "123c97c110b7053ea3297d8e58fe95b3c3536560", + "ancestry": "parent", + "fix_named_by_advisory": true, + "fix_note": "Advisory names `123c97c1` 'Fixed: validate request parameters before database query' (PR #1783): classes/CustomerMessage.php +1-1, classes/Address.php +8-8 (twin advisory GHSA-mj48-jjc7-6wqr) and three hotel-module classes.", + "fix_changed_files": [ + "classes/Address.php", + "classes/CustomerMessage.php", + "modules/hotelreservationsystem/classes/HotelBranchRefundRules.php", + "modules/hotelreservationsystem/classes/HotelRoomTypeFeaturePricing.php", + "modules/hotelreservationsystem/classes/HotelRoomTypeGlobalDemandAdvanceOption.php" + ], + "sink": "database query in CustomerMessage.php built from the `bo_query` parameter", + "source": "`bo_query` request parameter", + "sites": [], + "site_files": [ + "classes/CustomerMessage.php" + ], + "sink_evidence": "", + "site_derivation": "the advisory names 'CustomerMessage.php' (basename) and the parameter; the classes/ path is from the fix commit; no function named", + "privilege": "administrator", + "license": "OSL-3.0", + "repo_size_mb": 129, + "default_branch": "develop", + "languages_pct": { + "PHP": 80, + "Smarty": 9, + "JavaScript": 7 + }, + "confidence": "medium", + "caveats": [ + "one fix covers two advisories (Address.php is GHSA-mj48); repo 129 MB, near the size cap", + "function-level site to be resolved at freeze" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "2ae1b491672aa8c6ca0eb766a81bab3cd9a20487", + "tip": "54c12b4efe41fe3d8bc55e43923fbd917e525b10", + "subject": "fixed issues", + "files": [ + "classes/order/Order.php", + "classes/order/OrderPayment.php", + "modules/hotelreservationsystem/classes/HotelBookingDetail.php", + "modules/hotelreservationsystem/classes/HotelRoomInformation.php", + "modules/hotelreservationsystem/classes/ServiceProductOrderDetail.php", + "modules/qlohotelreports/qlohotelreports.php", + "modules/qlohotelreports/views/templates/hook/group-bookings.tpl", + "modules/qlohotelreports/views/templates/hook/group-channels.tpl", + "modules/qlohotelreports/views/templates/hook/group-guests.tpl", + "modules/qlohotelreports/views/templates/hook/group-occupancy.tpl", + "modules/qlohotelreports/views/templates/hook/group-property.tpl", + "modules/qlohotelreports/views/templates/hook/group-revenue.tpl" + ], + "lines": 106, + "branch": "develop", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "roundcube-markasjunk-cmd-learn-rce", + "repo": "https://github.com/roundcube/roundcubemail", + "language": "php", + "also": [ + "javascript" + ], + "wordpress": false, + "family": "injection", + "subtype": "OS command injection", + "advisory": [ + "CVE-2026-74997", + "GHSA-q5rh-mmp4-ppgq" + ], + "published": "2026-08-17", + "lane": "B", + "vulnerable_versions": "< 1.6.18; 1.7.x < 1.7.3", + "fixed_version": "1.6.18 / 1.7.3", + "vulnerable": "a1afb8fd1f00ed4cb9376c072bb5ca5ded64495e", + "fixed": "b8f90e28a46d42e79a69568cba897f8f4223d9cd", + "ancestry": "parent; ancestor of tag 1.6.18", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `14044f84` (master) and `b8f90e28` (1.6 line), both 'Fix RCE via cmd_learn driver of markasjunk plugin' (plugins/markasjunk/drivers/cmd_learn.php +14-10), and a follow-up warning fix `495d2116`. The 1.6-line pin is used because it is an ancestor of tag 1.6.18.", + "fix_changed_files": [ + "CHANGELOG.md", + "plugins/markasjunk/drivers/cmd_learn.php" + ], + "sink": "the markasjunk plugin's cmd_learn driver runs a shell command with placeholder replacement values", + "source": "crafted placeholder replacement values (message/user data) when a message is marked as junk", + "sites": [], + "site_files": [ + "plugins/markasjunk/drivers/cmd_learn.php" + ], + "sink_evidence": "", + "site_derivation": "the advisory names 'the cmd_learn driver of the markasjunk plugin'; the file path follows from that name and is confirmed by the fix commit; no function named", + "privilege": "authenticated webmail user", + "license": "GPL-3.0", + "repo_size_mb": 67, + "default_branch": "master", + "languages_pct": { + "PHP": 90, + "JavaScript": 7 + }, + "confidence": "medium", + "caveats": [ + "only instances that enable the markasjunk plugin with the cmd_learn driver" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "1cddafded973c4bf6faa173accaf8f52ca1ac0d0", + "tip": "747f544708ed1d698b677d333346164a9451aeda", + "subject": "Simplify", + "files": [ + "tests/Framework/TnefDecoderTest.php" + ], + "lines": 6, + "branch": "master", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "tests-only change, on master (the fixed pin is on the 1.6 line)" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "maccms10-template-blacklist-rce", + "repo": "https://github.com/magicblack/maccms10", + "language": "php", + "also": [ + "javascript" + ], + "wordpress": false, + "family": "injection", + "subtype": "code injection (template → PHP, blacklist bypass)", + "advisory": [ + "CVE-2026-71232", + "GHSA-cv48-22qx-mpmx" + ], + "published": "2026-08-05", + "lane": "B", + "vulnerable_versions": "before commit 71ad3bb (2026-06-22)", + "fixed_version": "commit 71ad3bb", + "vulnerable": "2cabecda29947e8f9ea7cd3aa47ab90ed817605b", + "fixed": "71ad3bb29570e110d8e973acff68040a3050ddf0", + "ancestry": "parent", + "fix_named_by_advisory": true, + "fix_note": "Advisory names `71ad3bb2` (application/admin/controller/Template.php +1-1: adds the missing functions to the blacklist regex).", + "fix_changed_files": [ + "application/admin/controller/Template.php" + ], + "sink": "ThinkPHP `{if condition=...}` compiled into raw PHP; the admin template editor only blocks a function blacklist", + "source": "template content saved through the admin template editor", + "sites": [], + "site_files": [ + "application/admin/controller/Template.php" + ], + "sink_evidence": "", + "site_derivation": "file path quoted by the advisory; no function named", + "privilege": "administrator", + "license": "GitHub: NOASSERTION [verify]", + "repo_size_mb": 29, + "default_branch": "master", + "languages_pct": { + "PHP": 66, + "HTML": 23, + "JavaScript": 9 + }, + "confidence": "medium", + "caveats": [ + "guard bypass (incomplete blacklist); the fix is still a blacklist", + "licence not declared on GitHub" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "d9f09011a1523d0bfaed5dea9b2139461f2b0ea8", + "tip": "668ba418e50e96ab32ac612f3b6528beb172b3b7", + "subject": "fix #1356 修正注册API校验器解析错误及缺参报错", + "files": [ + "application/api/controller/User.php", + "application/common/model/User.php", + "tests/regression/user_register_validate.php", + "说明文档/API接口说明V2.txt" + ], + "lines": 166, + "branch": "master", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "review: subject says it fixes a register-API validator" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "kirby-realpath-sibling-traversal", + "repo": "https://github.com/getkirby/kirby", + "language": "php", + "also": [], + "wordpress": false, + "family": "path", + "subtype": "path traversal (prefix containment check)", + "advisory": [ + "CVE-2026-75592", + "GHSA-6j4c-mgqr-qv76" + ], + "published": "2026-09-02", + "lane": "A", + "vulnerable_versions": "< 4.9.5; 5.0.0 - 5.5.1", + "fixed_version": "4.9.5 / 5.5.2", + "vulnerable": "e90257fd7504053e13e93a1e9a5a9a5137aed966", + "fixed": "2b6fab950bc89d505ea89576bf71c8de614cc3b2", + "ancestry": "parent; ancestor of tag 4.9.5 (not of 5.5.2)", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `2b6fab95` 'fix: Ensure containment in ::realpath()' (4.x line: src/Filesystem/Dir.php, src/Filesystem/F.php) and `e0dca5f7` (5.x line, which also carries the Media::thumb fix of GHSA-9vx2-j98c-p72w). The 4.x pin keeps the case to this advisory alone.", + "fix_changed_files": [ + "src/Filesystem/Dir.php", + "src/Filesystem/F.php", + "tests/Filesystem/DirTest.php", + "tests/Filesystem/FTest.php" + ], + "sink": "`Dir::realpath()` / `F::realpath()` containment check accepts a sibling directory sharing the prefix (site vs site2)", + "source": "media handler request path for not-yet-generated thumbnails", + "sites": [ + "src/Filesystem/Dir.php::realpath", + "src/Filesystem/F.php::realpath" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "`Dir::realpath()` and `F::realpath()` named by the advisory; paths confirmed by the fix commit", + "privilege": "unauthenticated", + "license": "GitHub: NOASSERTION [verify]", + "repo_size_mb": 66, + "default_branch": "main", + "languages_pct": { + "PHP": 77, + "Vue": 15 + }, + "confidence": "medium", + "caveats": [ + "only deployments whose index root has a sibling directory with the same name prefix", + "Kirby is under a proprietary licence (GitHub NOASSERTION); must be cleared before publishing" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "99e6aaa1dbcc997ebf2725b11f87a4bcaed9933c", + "tip": "3989964ac1cb32fdfce69b2410280093f6ede46c", + "subject": "fix: Stuck unsaved changes for untouched fields (#8355)", + "files": [ + "config/fields/object.php", + "config/fields/toggle.php", + "src/Form/Field.php", + "tests/Form/Field/ObjectFieldTest.php", + "tests/Form/Field/ToggleFieldTest.php", + "tests/Form/FieldTest.php" + ], + "lines": 80, + "branch": "main", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "on the default branch (5.x); the fixed pin is on the 4.x line" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "mineadmin-appstore-identifier-traversal", + "repo": "https://github.com/mineadmin/MineAdmin", + "language": "php", + "also": [], + "wordpress": false, + "family": "path", + "subtype": "path traversal", + "advisory": [ + "CVE-2026-55224", + "GHSA-59xm-4m8c-g3xj" + ], + "published": "2026-08-18", + "lane": "A", + "vulnerable_versions": "< 3.2.0-alpha.2", + "fixed_version": "3.2.0-alpha.2", + "vulnerable": "ac0dcad616c5d304c249d1db4a6675f65cf736dc", + "fixed": "ca41902a2a5422676227e5088f4cc1dec06044f1", + "ancestry": "parent; the fixed commit is tag v3.2.0-alpha.2", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `ca41902a` 'fix(app-store): 修复app-store几处安全风险。 (#728)' (Service.php +81-9, IndexController.php +4-0).", + "fix_changed_files": [ + "plugin/mine-admin/app-store/src/Controller/IndexController.php", + "plugin/mine-admin/app-store/src/Service/Service.php" + ], + "sink": "`BASE_PATH . '/plugin/' . $params['identifier']` in download()/install()/unInstall(), then `Plugin::install($params['identifier'])`", + "source": "`identifier` request parameter of the app-store plugin endpoints", + "sites": [ + "plugin/mine-admin/app-store/src/Service/Service.php::download", + "plugin/mine-admin/app-store/src/Service/Service.php::install", + "plugin/mine-admin/app-store/src/Service/Service.php::unInstall" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "file path and methods quoted by the advisory", + "privilege": "authenticated admin with app-store access (verify)", + "license": "Apache-2.0", + "repo_size_mb": 53, + "default_branch": "3.2", + "languages_pct": { + "PHP": 99 + }, + "confidence": "high", + "caveats": [ + "Hyperf framework (not Laravel/Symfony)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "243956c6d08532ff0a6f36a4cfbb7c6b499c1de2", + "tip": "c2f97b772c101053fb8606215ac8676f8e50896c", + "subject": "feat(install): 添加前端项目下载与依赖安装功能 (#735)", + "files": [ + "app/Command/InstallCommand.php" + ], + "lines": 193, + "branch": "3.2", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "facturascripts-uploadedfile-move-traversal", + "repo": "https://github.com/NeoRazorX/facturascripts", + "language": "php", + "also": [], + "wordpress": false, + "family": "path", + "subtype": "path traversal (arbitrary file write)", + "advisory": [ + "GHSA-hgjx-r89m-m7v4" + ], + "published": "2026-07-14", + "lane": "A", + "vulnerable_versions": ">= 2025, <= 2026.2", + "fixed_version": "not stated", + "vulnerable": "6baefcdc00c24970a568ff86d971b46be0fd7d75", + "fixed": "d3770be64a3e1516a32aa9eb36e8907c53e28b14", + "ancestry": "parent", + "fix_named_by_advisory": false, + "fix_note": "The advisory links no commit and states no patched version. File history of Core/UploadedFile.php has `d3770be6` 'Fix uploaded file path traversal' (2026-05-19; UploadedFile.php +38-4 plus tests). Inferred, not confirmed by the advisory.", + "fix_changed_files": [ + "Core/UploadedFile.php", + "Test/Core/UploadedFileTest.php" + ], + "sink": "`UploadedFile::move($destiny, $destinyName)` concatenates the client filename into `move_uploaded_file()`", + "source": "`getClientOriginalName()` of an uploaded file", + "sites": [ + "Core/UploadedFile.php::move" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "file and method quoted by the advisory", + "privilege": "authenticated user", + "license": "LGPL-3.0", + "repo_size_mb": 60, + "default_branch": "master", + "languages_pct": { + "PHP": 90, + "Twig": 9 + }, + "confidence": "medium", + "caveats": [ + "fix commit inferred from file history", + "the advisory's affected range ends at 2026.2 while the inferred fix is dated 2026-05-19 -- confirm at freeze that the fixed pin is really unaffected" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "d6fc3f051781c83041c7318a980c915daeb00d50", + "tip": "add96d2bbee5a391bc123dfcf263e57bb53ad6f5", + "subject": "test: add API smoke test", + "files": [ + "Test/Core/Controller/ApiSmokeTest.php" + ], + "lines": 192, + "branch": "master", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "tests-only change" + }, + "idea": null + }, + "recommended": false + }, + { + "id": "wp-geo-my-wp-info-window-lfi", + "repo": "https://github.com/Fitoussi/geo-my-wp", + "language": "php", + "also": [ + "javascript" + ], + "wordpress": true, + "family": "path", + "subtype": "local file inclusion", + "advisory": [ + "CVE-2026-85200", + "GHSA-6hw9-7gx5-mw88" + ], + "published": "2026-09-12", + "lane": "B", + "vulnerable_versions": "<= 4.5.5.3", + "fixed_version": "4.5.5.4", + "vulnerable": "1dbb7b1672a45a8f88fdcd379ceb07b6cf2beceb", + "fixed": "5a768bf1c6e44ded83a65be8789f3587515665ac", + "ancestry": "parent", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `5a768bf1` 'Release 4.5.5.4' (5 files: includes/gmw-functions.php +93-6, the posts/members locator functions files, version bumps). A release commit, but small and on-topic.", + "fix_changed_files": [ + "geo-my-wp.php", + "includes/gmw-functions.php", + "plugins/members-locator/includes/gmw-members-locator-functions.php", + "plugins/posts-locator/includes/gmw-posts-locator-functions.php", + "readme.txt" + ], + "sink": "include of a file chosen through `gmw_posts_locator_ajax_info_window_loader`", + "source": "AJAX request parameters (unauthenticated)", + "sites": [ + "plugins/posts-locator/includes/gmw-posts-locator-functions.php::gmw_posts_locator_ajax_info_window_loader" + ], + "site_files": [ + "includes/gmw-functions.php" + ], + "sink_evidence": "", + "site_derivation": "function named by the advisory text; files from the advisory's own trac reference links (gmw-functions.php#L1945/L1987, gmw-posts-locator-functions.php#L964/L975); the function-to-file pairing is an assumption to confirm at freeze", + "privilege": "unauthenticated", + "license": "GitHub: none [verify]", + "repo_size_mb": 9, + "default_branch": "master", + "languages_pct": { + "PHP": 47, + "JavaScript": 44, + "CSS": 9 + }, + "confidence": "medium", + "caveats": [ + "WordPress plugin; GitHub shows no licence (plugin header GPL presumed, verify)", + "release commit (small)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": null, + "idea": "no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file)" + }, + "recommended": true + }, + { + "id": "elfinder-fsock-dns-rebinding-ssrf", + "repo": "https://github.com/Studio-42/elFinder", + "language": "php", + "also": [ + "javascript" + ], + "wordpress": false, + "family": "untrusted_destination", + "subtype": "SSRF (DNS rebinding guard bypass)", + "advisory": [ + "CVE-2026-81889", + "GHSA-8x3q-jpjh-qh5c" + ], + "published": "2026-08-31", + "lane": "A", + "vulnerable_versions": "<= 2.1.69", + "fixed_version": "2.1.70", + "vulnerable": "dd73e702820c146a192969800ee674ecdb208365", + "fixed": "6d997386cd0f1abab4706c220b46b0aea0ecff51", + "ancestry": "parent; ancestor of tag 2.1.70-src (tag 2.1.70 is a build branch with no common history)", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `6d997386` 'Merge commit from fork' (php/elFinder.class.php +113-12, i18n) and the build commit `191372c1`. `6d997386` has a single parent `dd73e702` (the fix of the sibling ZIP-extraction advisory).", + "fix_changed_files": [ + "js/i18n/elfinder.en.js", + "js/i18n/elfinder.ja.js", + "php/elFinder.class.php" + ], + "sink": "`fsock_get_contents()` fallback reconnects by hostname after the URL validation resolved it (TOCTOU)", + "source": "URL submitted for server-side upload", + "sites": [ + "php/elFinder.class.php::fsock_get_contents" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "function named by the advisory, file linked by the advisory", + "privilege": "depends on the integrating connector", + "license": "GitHub: NOASSERTION [verify]", + "repo_size_mb": 43, + "default_branch": "master", + "languages_pct": { + "JavaScript": 65, + "PHP": 29 + }, + "confidence": "medium", + "caveats": [ + "only when PHP lacks cURL", + "guard bypass (DNS rebinding); repository is 65% JavaScript", + "licence NOASSERTION on GitHub (verify)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": null, + "idea": "no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file)" + }, + "recommended": true + }, + { + "id": "easyappointments-caldav-ssrf", + "repo": "https://github.com/alextselegidis/easyappointments", + "language": "php", + "also": [ + "javascript" + ], + "wordpress": false, + "family": "untrusted_destination", + "subtype": "SSRF", + "advisory": [ + "CVE-2026-52840", + "GHSA-pm5p-7w5h-jm5q" + ], + "published": "2026-07-29", + "lane": "A", + "vulnerable_versions": "<= 1.5.2", + "fixed_version": "1.6.0", + "vulnerable": "725eafa647308846ce887657db12771a829e42ef", + "fixed": "4abb10545d83ac1a57d03f6502376ee67696ea7c", + "ancestry": "parent of 4abb1054; ancestor of tag 1.6.0", + "fix_named_by_advisory": true, + "fix_note": "Advisory links four linear commits of 2026-05-26: `4abb1054` 'fix: harden caldav url validation against ssrf' (the validation), then `6b34b78c`, `2da2baed`, `6eb9336a` (opt-in private-host toggle and its relocation). The first carries the fix and is used as the fixed pin; `6eb9336a` is the end of the chain if the maintainer prefers it.", + "fix_changed_files": [ + "CHANGELOG.md", + "application/controllers/Caldav.php", + "application/libraries/Caldav_sync.php" + ], + "sink": "`$this->caldav_sync->test_connection($caldav_url, ...)` → Guzzle REPORT request", + "source": "`caldav_url` request parameter of Caldav::connect_to_server", + "sites": [ + "application/controllers/Caldav.php::connect_to_server", + "application/libraries/Caldav_sync.php::test_connection" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "controller path and method quoted by the advisory; the library path follows from `$this->caldav_sync` and the fix commit", + "privilege": "authenticated backend user (admin, provider or secretary)", + "license": "GPL-3.0", + "repo_size_mb": 49, + "default_branch": "main", + "languages_pct": { + "PHP": 89, + "JavaScript": 9 + }, + "confidence": "high", + "caveats": [ + "fix spread over four linear commits (v2 allowed up to three; the first commit alone is the fix)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "6084d99b59bd060d64506b3981e0bdddff59418f", + "tip": "1b51132026c78ebec3e732e045587306853d77be", + "subject": "Minor translation change.", + "files": [ + "application/language/german/translations_lang.php" + ], + "lines": 2, + "branch": "main", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "koel-podcast-enclosure-ipv6-ssrf", + "repo": "https://github.com/koel/koel", + "language": "php", + "also": [ + "typescript" + ], + "wordpress": false, + "family": "untrusted_destination", + "subtype": "SSRF (guard bypass via IPv6 transition addresses)", + "advisory": [ + "CVE-2026-54494", + "GHSA-rjg7-r26h-cfp2" + ], + "published": "2026-07-15", + "lane": "A", + "vulnerable_versions": "<= 9.7.0", + "fixed_version": "9.7.1", + "vulnerable": "8ee1de0f5589ef34d3e3bbb9c9555a5de69eaf06", + "fixed": "5f6ce2cefd08f437a269236b677ad971517ccbb6", + "ancestry": "parent; ancestor of tag v9.7.1", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `5f6ce2ce` 'fix: close remaining SSRF advisories (DNS rebinding, IPv6 transition, bail) (#2549)', 28 files; one commit that closes several SSRF advisories (same family).", + "fix_changed_files": [ + "app/Ai/Tools/AddRadioStation.php", + "app/Helpers/Network.php", + "app/Helpers/SafeHttp.php", + "app/Http/Requests/API/Radio/RadioStationStoreRequest.php", + "app/Http/Requests/API/Radio/RadioStationUpdateRequest.php", + "app/Http/Requests/Subsonic/CreateInternetRadioStationRequest.php", + "app/Http/Requests/Subsonic/UpdateInternetRadioStationRequest.php", + "app/Providers/AppServiceProvider.php", + "app/Rules/HasAudioContentType.php", + "app/Rules/SafeUrl.php", + "app/Services/DownloadService.php", + "app/Services/Network/Network.php", + "app/Services/Network/SafeHttp.php", + "app/Services/Podcast/PodcastService.php", + "app/Services/Radio/RadioStreamProxy.php", + "app/Services/Streamer/Adapters/PodcastStreamerAdapter.php", + "app/Values/Podcast/EpisodePlayable.php", + "composer.json", + "composer.lock", + "tests/Fakes/FakeNetwork.php", + "tests/Feature/RadioStationTest.php", + "tests/Integration/Services/Podcast/PodcastServiceTest.php", + "tests/Integration/Values/EpisodePlayableTest.php", + "tests/TestCase.php", + "tests/Unit/Helpers/SafeHttpTest.php", + "tests/Unit/Services/Network/NetworkTest.php", + "tests/Unit/Services/Network/SafeHttpTest.php", + "tests/Unit/Services/Radio/RadioStreamProxyTest.php" + ], + "sink": "`EpisodePlayable::createForEpisode()` → `Http::sink($file)->get($url)`, guarded only by `Network::isPublicHost()`", + "source": "`` of an attacker-hosted RSS feed subscribed by any user", + "sites": [ + "app/Helpers/Network.php::isPublicHost", + "app/Values/Podcast/EpisodePlayable.php::createForEpisode" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "app/Helpers/Network.php and isPublicHost quoted by the advisory; EpisodePlayable path from the class name `App\\Values\\Podcast\\EpisodePlayable`", + "privilege": "authenticated user", + "license": "MIT", + "repo_size_mb": 29, + "default_branch": "master", + "languages_pct": { + "PHP": 55, + "TypeScript": 27, + "Vue": 18 + }, + "confidence": "medium", + "caveats": [ + "large multi-advisory fix commit (28 files), same family", + "exploitation needs NAT64/6to4 routing" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "74d949b28b9a830b1e917d5790bdd0ef3a0dfd1f", + "tip": "eafb61deaad021b4a4d934d278bfbb937a053715", + "subject": "test: serve a real response to the radio stream connector (#2671)", + "files": [ + "tests/Integration/Services/Radio/RadioStreamConnectorTest.php", + "tests/Unit/Services/Radio/RadioStreamConnectorTest.php" + ], + "lines": 178, + "branch": "master", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "tests-only change" + }, + "idea": null + }, + "recommended": false + }, + { + "id": "pagible-admin-proxy-dns-rebinding-ssrf", + "repo": "https://github.com/aimeos/pagible", + "language": "php", + "also": [ + "javascript" + ], + "wordpress": false, + "family": "untrusted_destination", + "subtype": "SSRF (DNS rebinding guard bypass)", + "advisory": [ + "CVE-2026-49262", + "GHSA-mmj8-wcvw-6789" + ], + "published": "2026-06-26", + "lane": "A", + "vulnerable_versions": "< 0.10.4", + "fixed_version": "0.10.4", + "vulnerable": "03f03b2f81b20b1c1625ff227235c43791ddbb33", + "fixed": "09a8205d513ec89ed22cdd7bdae0f4c181cee082", + "ancestry": "parent; ancestor of tag 0.10.4", + "fix_named_by_advisory": false, + "fix_note": "The advisory links no commit. The compare 0.10.3...0.10.4 has three commits; `09a8205d` 'Fixed SSRF via DNS rebinding in admin proxy' (admin/src/Controllers/AdminController.php +21-7, core/src/Utils.php +22-4).", + "fix_changed_files": [ + "admin/src/Controllers/AdminController.php", + "admin/tests/AdminControllerTest.php", + "core/src/Utils.php" + ], + "sink": "`AdminController::proxy` → Guzzle request after `\\Aimeos\\Cms\\Utils::isValidUrl($url)`", + "source": "`url` query parameter of `/cmsproxy`", + "sites": [ + "admin/src/Controllers/AdminController.php::proxy", + "core/src/Utils.php::isValidUrl" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "class::method names quoted by the advisory; paths from the fix commit", + "privilege": "authenticated (proxy token)", + "license": "MIT", + "repo_size_mb": 73, + "default_branch": "master", + "languages_pct": { + "PHP": 57, + "JavaScript": 16, + "CSS": 12, + "Vue": 11 + }, + "confidence": "medium", + "caveats": [ + "guard bypass (DNS rebinding)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "36cbcdb6ea44c9b4eab019887656ed76c57b44cb", + "tip": "bc5a10a515bd4413bd336bab5f7952f2da876393", + "subject": "Fixed admin test", + "files": [ + "admin/tests/AdminControllerTest.php" + ], + "lines": 2, + "branch": "master", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "tests-only change" + }, + "idea": null + }, + "recommended": false + }, + { + "id": "wp-graphql-updatepost-publish-bypass", + "repo": "https://github.com/wp-graphql/wp-graphql", + "language": "php", + "also": [ + "javascript" + ], + "wordpress": true, + "family": "access_control", + "subtype": "missing object-level capability check", + "advisory": [ + "CVE-2026-88974", + "GHSA-5mmc-8pc9-wggg" + ], + "published": "2026-09-23", + "lane": "A", + "vulnerable_versions": "< 2.22.2 (confirmed 2.19.0)", + "fixed_version": "2.22.2", + "vulnerable": "d53b0e566f20a8df0664559cb6432d52a7cd285c", + "fixed": "55441663eaa33c3f2e05de038c8286c845916461", + "ancestry": "parent; ancestor of tag wp-graphql/v2.22.2", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `55441663` (PR #4270) whose subject is 'do not invoke bare callable-string field definitions in Model'; it also changes plugins/wp-graphql/src/Mutation/PostObjectUpdate.php (+27-0) -- two fixes in one commit.", + "fix_changed_files": [ + "plugins/wp-graphql/src/Model/Model.php", + "plugins/wp-graphql/src/Mutation/PostObjectUpdate.php", + "plugins/wp-graphql/tests/wpunit/ModelFieldMemoizationTest.php", + "plugins/wp-graphql/tests/wpunit/PostObjectMutationsTest.php" + ], + "sink": "`updatePost` mutation checks only `$post_type_object->cap->edit_posts`", + "source": "GraphQL `updatePost` mutation input (status PUBLISH, published post id)", + "sites": [], + "site_files": [ + "plugins/wp-graphql/src/Mutation/PostObjectUpdate.php" + ], + "sink_evidence": "", + "site_derivation": "the advisory names src/Mutation/PostObjectUpdate.php; the repository is a monorepo (plugins/wp-graphql/ prefix from the fix commit); no function named", + "privilege": "Contributor", + "license": "GPL-3.0", + "repo_size_mb": 120, + "default_branch": "main", + "languages_pct": { + "PHP": 68, + "JavaScript": 26 + }, + "confidence": "medium", + "caveats": [ + "fix commit also carries an unrelated Model.php change", + "function-level site to resolve at freeze" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": null, + "idea": "no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file)" + }, + "recommended": true + }, + { + "id": "sylius-mollie-thankyou-order-idor", + "repo": "https://github.com/Sylius/MolliePlugin", + "language": "php", + "also": [], + "wordpress": false, + "family": "access_control", + "subtype": "IDOR (missing ownership check)", + "advisory": [ + "CVE-2026-68501", + "GHSA-x83g-979r-f5fh" + ], + "published": "2026-07-31", + "lane": "A", + "vulnerable_versions": "< 2.2.8; 3.0.0-3.2.3; 3.3.0", + "fixed_version": "2.2.8 / 3.2.4 / 3.3.1", + "vulnerable": "7400f1489a4b699df97ced9499acde4faaa476d5", + "fixed": "01316b3ad3cf82e3c5ad160115d0a2cf89174e49", + "ancestry": "first parent of a merge; ancestor of tag v3.3.1", + "fix_named_by_advisory": true, + "fix_note": "Advisory links three merge commits (one per branch). `01316b3a` (PR #354, 3.3 line) is used: PageRedirectController.php +17-6, QrCodeAction.php +9-11, PaymentWebhookController.php (the sibling webhook advisory GHSA-rc52-c4hv-w89p).", + "fix_changed_files": [ + "UPGRADE-3.3.md", + "assets/shop/js/mollie/app.js", + "src/Controller/Shop/PageRedirectController.php", + "src/Controller/Shop/PaymentWebhookController.php", + "src/Controller/Shop/QrCodeAction.php", + "tests/Unit/Controller/Shop/PageRedirectControllerTest.php", + "tests/Unit/Controller/Shop/PaymentWebhookControllerTest.php" + ], + "sink": "`findOneBy(['id' => $orderId])` without ownership/session check, returning the order token (302 Location) and QR code", + "source": "`orderId` of GET /{_locale}/thank-you and /{_locale}/get-code", + "sites": [ + "src/Controller/Shop/PageRedirectController.php::thankYouAction", + "src/Controller/Shop/QrCodeAction.php::fetchQrCodeFromOrder" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "Class::method names quoted by the advisory; paths from the fix commit", + "privilege": "unauthenticated", + "license": "MIT", + "repo_size_mb": 9, + "default_branch": "3.4", + "languages_pct": { + "PHP": 90 + }, + "confidence": "high", + "caveats": [ + "merge commit; one fix covers two advisories (webhook forgery GHSA-rc52 is the other)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "5ffb17c6fa4a254a62ef7285b4fd57a1a9619deb", + "tip": "ad215c9c0fc3df201c196d2ef893a1e8c9ff3aab", + "subject": "Refactor `PaymentMethodLogoUploader` to use `FilesystemAdapterInterface` instead of `Gaufrette\\Filesystem`.", + "files": [ + "config/services/uploader.xml", + "src/Uploader/PaymentMethodLogoUploader.php" + ], + "lines": 15, + "branch": "3.4", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "paymenter-checkout-config-override", + "repo": "https://github.com/Paymenter/Paymenter", + "language": "php", + "also": [], + "wordpress": false, + "family": "access_control", + "subtype": "unvalidated URL-writable properties override provisioning parameters", + "advisory": [ + "CVE-2026-47198", + "GHSA-5q4q-834j-g8g4" + ], + "published": "2026-06-30", + "lane": "A", + "vulnerable_versions": "< 1.5.1", + "fixed_version": "1.5.1", + "vulnerable": "9d305ea444f7aa3a73f84583c28be0f06da61969", + "fixed": "75719ae46b4096505a252e24c302961b700251f1", + "ancestry": "parent; ancestor of tag v1.5.1", + "fix_named_by_advisory": false, + "fix_note": "The advisory links no commit. The compare v1.5.0...v1.5.1 has 17 commits; `75719ae4` 'Merge commit from fork' changes only app/Livewire/Products/Checkout.php (+7-1).", + "fix_changed_files": [ + "app/Livewire/Products/Checkout.php" + ], + "sink": "`$checkoutConfig` (`#[Url]`, alias `config`) keys stored by Cart.php into service properties, later passed to createServer()", + "source": "`config[...]` query parameters of the checkout page", + "sites": [], + "site_files": [ + "app/Livewire/Products/Checkout.php", + "app/Livewire/Cart.php" + ], + "sink_evidence": "", + "site_derivation": "file paths quoted by the advisory; no function named", + "privilege": "authenticated customer", + "license": "MIT", + "repo_size_mb": 15, + "default_branch": "master", + "languages_pct": { + "PHP": 87, + "Blade": 12 + }, + "confidence": "medium", + "caveats": [ + "mass-assignment shape (CWE-20/639); classed access_control by its CWE", + "fix commit inferred from the release compare" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "8299b27e37e263b9b6b5fd0c166c762120719830", + "tip": "e60567981acfb12e3c8d13e513e2959edd8b9d1c", + "subject": "fix: reCAPTCHA v3 not working after Livewire navigation", + "files": [ + "themes/default/views/components/captcha/recaptcha-v3.blade.php" + ], + "lines": 24, + "branch": "master", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "review: subject mentions reCAPTCHA (anti-abuse)" + }, + "idea": null + }, + "recommended": false + }, + { + "id": "wp-buddypress-messages-rest-idor", + "repo": "https://github.com/buddypress/buddypress", + "language": "php", + "also": [], + "wordpress": true, + "family": "access_control", + "subtype": "IDOR in REST permission callback", + "advisory": [ + "CVE-2026-53673", + "GHSA-j3j5-5m8v-7gvc" + ], + "published": "2026-06-10", + "lane": "A", + "vulnerable_versions": "< 14.5.0 (confirmed 14.4.0)", + "fixed_version": "14.5.0", + "vulnerable": "56b1fd3b40549f542936b12e265fd08a59df72ae", + "fixed": "27d41e9749a878103b3a673b37dfc92b7f8f2cb7", + "ancestry": "parent", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `27d41e97` 'Improve security of messages endpoint.' (class-bp-messages-rest-controller.php +113-42, tests). The commit is dated 2026-07-07, after the advisory; confirm at freeze that the release carrying it is 14.5.0.", + "fix_changed_files": [ + "src/bp-messages/classes/class-bp-messages-rest-controller.php", + "tests/phpunit/testcases/messages/test-controller.php" + ], + "sink": "`get_item_permissions_check` validates the supplied user_id instead of the logged-in user; reused by update/delete", + "source": "`user_id` parameter of the messages REST API", + "sites": [ + "src/bp-messages/classes/class-bp-messages-rest-controller.php::get_item_permissions_check" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "method named by the advisory; file path from the fix commit", + "privilege": "authenticated (any user)", + "license": "GitHub: none [verify]", + "repo_size_mb": 79, + "default_branch": "master", + "languages_pct": { + "PHP": 76, + "CSS": 14, + "SCSS": 6 + }, + "confidence": "medium", + "caveats": [ + "the GitHub repository is the project's own mirror of its development SVN", + "no GitHub licence metadata (GPL-2.0+ per project, verify)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "e530c9c056200bdcc55442ce81eb3372d20d7879", + "tip": "ea5cb85f4d8a86bc518fff5e22a83abd07eb727b", + "subject": "PHPDoc: Improve parameter descriptions.", + "files": [ + "src/bp-activity/bp-activity-embeds.php", + "src/bp-activity/bp-activity-filters.php", + "src/bp-activity/bp-activity-functions.php", + "src/bp-activity/bp-activity-template.php", + "src/bp-activity/classes/class-bp-activity-activity.php", + "src/bp-activity/classes/class-bp-activity-oembed-extension.php", + "src/bp-blogs/bp-blogs-functions.php", + "src/bp-blogs/classes/class-bp-blogs-template.php", + "src/bp-core/bp-core-attachments.php", + "src/bp-friends/bp-friends-activity.php", + "src/bp-groups/bp-groups-activity.php", + "src/bp-groups/bp-groups-functions.php", + "src/bp-groups/bp-groups-template.php", + "src/bp-groups/classes/class-bp-groups-invitation-manager.php", + "src/bp-groups/classes/class-bp-groups-membership-requests-template.php", + "src/bp-members/bp-members-membership-requests.php", + "src/bp-members/bp-members-template.php", + "src/bp-members/classes/class-bp-members-invitation-manager.php", + "src/bp-members/classes/class-bp-members-invitations-template.php", + "src/bp-messages/classes/class-bp-messages-notices-list-table.php", + "src/bp-notifications/bp-notifications-template.php", + "src/bp-notifications/classes/class-bp-notifications-template.php", + "src/bp-templates/bp-legacy/buddypress-functions.php", + "src/bp-templates/bp-nouveau/includes/activity/functions.php", + "src/bp-templates/bp-nouveau/includes/blogs/functions.php", + "src/bp-templates/bp-nouveau/includes/classes/class-bp-buttons-group.php", + "src/bp-templates/bp-nouveau/includes/functions.php", + "src/bp-templates/bp-nouveau/includes/groups/functions.php", + "src/bp-templates/bp-nouveau/includes/members/template-tags.php", + "src/bp-templates/bp-nouveau/includes/messages/functions.php", + "src/bp-templates/bp-nouveau/includes/notifications/functions.php", + "src/bp-templates/bp-nouveau/includes/template-tags.php", + "src/bp-templates/bp-nouveau/includes/xprofile/functions.php", + "src/bp-xprofile/bp-xprofile-template.php" + ], + "lines": 132, + "branch": "master", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": false + }, + { + "id": "sharp-editor-iframe-srcdoc-xss", + "repo": "https://github.com/code16/sharp", + "language": "php", + "also": [ + "typescript" + ], + "wordpress": false, + "family": "output_encoding", + "subtype": "stored XSS (sanitizer allow-list)", + "advisory": [ + "CVE-2026-61823", + "GHSA-qxg3-46rw-79j8" + ], + "published": "2026-09-25", + "lane": "A", + "vulnerable_versions": "< 9.22.5", + "fixed_version": "9.22.5", + "vulnerable": "67743149309054493ec8f5505173fc57aaff760f", + "fixed": "ec509a22c808a5bd9dfad6a0a85c92ce6f411e21", + "ancestry": "parent; ancestor of tag v9.22.5", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `ec509a22` 'Improve sanitization' (src/Utils/Sanitization/FormatsSanitizedValue.php +4-2, test). The same commit fixes the sibling GHSA-vj3q-vp3g-j9c8.", + "fix_changed_files": [ + "src/Utils/Sanitization/FormatsSanitizedValue.php", + "tests/Unit/Form/Fields/Formatters/EditorFormatterTest.php" + ], + "sink": "Symfony HtmlSanitizer config allows the iframe `srcdoc` attribute; the value is rendered as live HTML", + "source": "Editor field content saved by a user with edit permission", + "sites": [], + "site_files": [ + "src/Utils/Sanitization/FormatsSanitizedValue.php" + ], + "sink_evidence": "srcdoc", + "site_derivation": "file path quoted by the advisory; no function named", + "privilege": "authenticated editor", + "license": "MIT", + "repo_size_mb": 109, + "default_branch": "9.x", + "languages_pct": { + "PHP": 66, + "Vue": 23, + "TypeScript": 9 + }, + "confidence": "medium", + "caveats": [ + "the flaw is a sanitizer allow-list entry, not a missing escape call" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "ec509a22c808a5bd9dfad6a0a85c92ce6f411e21", + "tip": "7c601fffe930fc321a5d8bcb25cb072d50a6fc08", + "subject": "Update version to v9.22.5", + "files": [ + "src/SharpInternalServiceProvider.php" + ], + "lines": 2, + "branch": "9.x", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "privatebin-jsonld-request-uri-injection", + "repo": "https://github.com/PrivateBin/PrivateBin", + "language": "php", + "also": [ + "javascript" + ], + "wordpress": false, + "family": "output_encoding", + "subtype": "reflected JSON injection (CWE-116)", + "advisory": [ + "CVE-2026-55891", + "GHSA-xrjc-c68j-hp7w" + ], + "published": "2026-08-28", + "lane": "A", + "vulnerable_versions": "<= 2.0.4", + "fixed_version": "2.0.5", + "vulnerable": "e0dd4c025c19a182b6a4c6fb77a8bf81ceff6899", + "fixed": "75f056dcda955d94c17ec5a4f8c54a9b7bfcee07", + "ancestry": "first parent of a merge; ancestor of tag 2.0.5", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `75f056dc` 'Merge commit from fork' (first-parent diff: lib/Request.php +2-2, lib/Configuration.php, CHANGELOG, test). Its first parent `e0dd4c02` is the fix of the sibling attachment-XSS advisory GHSA-f2xf-7x3g-4272.", + "fix_changed_files": [ + "CHANGELOG.md", + "lib/Configuration.php", + "lib/Request.php", + "tst/RequestTest.php" + ], + "sink": "`Controller::_jsonld()` splices `$_urlBase` into a .jsonld template with `str_replace()`", + "source": "`$_SERVER['REQUEST_URI']` via `Request::getRequestUri()` (FILTER_SANITIZE_URL keeps quotes and angle brackets)", + "sites": [ + "lib/Request.php::getRequestUri", + "lib/Controller.php::_jsonld" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "Class::method names quoted by the advisory; paths lib/*.php from the fix commit", + "privilege": "unauthenticated", + "license": "GitHub: NOASSERTION [verify]", + "repo_size_mb": 16, + "default_branch": "master", + "languages_pct": { + "PHP": 46, + "JavaScript": 38, + "CSS": 16 + }, + "confidence": "high", + "caveats": [ + "the fix changes Request.php only; Controller::_jsonld is a declared site outside the diff", + "response type is JSON-LD, not HTML", + "licence NOASSERTION on GitHub (zlib-style per project, verify)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "5bbb4e00788d2ba32212341e54313098f86a0817", + "tip": "48ae4ed5d3d4dde0d0026878a4e2ba3408686277", + "subject": "fix: quote administration storage path", + "files": [ + "bin/administration", + "tst/AdministrationEmptyDirsTest.php" + ], + "lines": 54, + "branch": "master", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "review: 'quote administration storage path' may be a shell-quoting fix" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "openstamanager-group-name-html-injection", + "repo": "https://github.com/devcode-it/openstamanager", + "language": "php", + "also": [ + "javascript" + ], + "wordpress": false, + "family": "output_encoding", + "subtype": "stored HTML injection", + "advisory": [ + "CVE-2026-44701", + "GHSA-crx4-7mmq-j74j" + ], + "published": "2026-08-26", + "lane": "A", + "vulnerable_versions": "<= 2.10.1", + "fixed_version": "2.11-beta", + "vulnerable": "57a2734e2121aa8fcd456eff7c59f03e29e69176", + "fixed": "0b88ad1963871abfa5e134004ca0c74c496d8d2f", + "ancestry": "parent; ancestor of tag v2.11-beta", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `0b88ad19` 'fix: HTML Injection in modules/utenti/edit.php' (edit.php +2-2, ajax/select.php, src/AJAX.php, src/Modules.php) and a broader input-filter refactor `7c9eafe9`. The first is used.", + "fix_changed_files": [ + "modules/utenti/ajax/select.php", + "modules/utenti/edit.php", + "src/AJAX.php", + "src/Modules.php" + ], + "sink": "`''.$group->getTranslation('title').''` in modules/utenti/edit.php", + "source": "group name saved when creating a user group", + "sites": [ + "modules/utenti/edit.php::" + ], + "site_files": [], + "sink_evidence": "$group->getTranslation('title')", + "site_derivation": "file and code quoted by the advisory", + "privilege": "authenticated user able to create groups", + "license": "GPL-3.0", + "repo_size_mb": 43, + "default_branch": "master", + "languages_pct": { + "PHP": 80, + "JavaScript": 17 + }, + "confidence": "high", + "caveats": [ + "second advisory commit (7c9eafe9, global GET/POST filtering) is not in the pinned pair" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "a99b8f921dfbc53c2290316925a4e01ce1333eee", + "tip": "570eff68c5049b3a336a83e5de5d5b09e6cb219a", + "subject": "fix: definizione variabile", + "files": [ + "modules/fatture/src/Gestori/Scadenze.php" + ], + "lines": 2, + "branch": "master", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "symfony-ux-live-child-tag-xss", + "repo": "https://github.com/symfony/ux", + "language": "php", + "also": [ + "typescript", + "javascript" + ], + "wordpress": false, + "family": "output_encoding", + "subtype": "XSS (unescaped tag name)", + "advisory": [ + "CVE-2026-49210", + "GHSA-38x5-rcv4-xf7x" + ], + "published": "2026-06-19", + "lane": "A", + "vulnerable_versions": "ux-live-component >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0", + "fixed_version": "2.36.0 / 3.1.0", + "vulnerable": "a6e9bf808476ae43895cf80f088af392a79537ea", + "fixed": "fbc5e9a1bda7e4556be21bb1d970f382760ed9a9", + "ancestry": "parent; ancestor of tag v2.36.0", + "fix_named_by_advisory": true, + "fix_note": "Advisory links `fbc5e9a1` '[LiveComponent] Reject malicious child component tags' (ChildComponentPartialRenderer.php +7-0, test).", + "fix_changed_files": [ + "src/LiveComponent/src/Util/ChildComponentPartialRenderer.php", + "src/LiveComponent/tests/Functional/EventListener/InterceptChildComponentRenderSubscriberTest.php" + ], + "sink": "`ChildComponentPartialRenderer::createHtml()` interpolates `$childTag` into HTML", + "source": "client JSON `children[id].tag` parsed by `LiveComponentSubscriber` and passed through `InterceptChildComponentRenderSubscriber`", + "sites": [ + "src/LiveComponent/src/Util/ChildComponentPartialRenderer.php::createHtml" + ], + "site_files": [], + "sink_evidence": "", + "site_derivation": "FQCN::method quoted by the advisory; monorepo path from the fix commit", + "privilege": "unauthenticated (Accept header gate; CORS or same-origin needed)", + "license": "MIT", + "repo_size_mb": 59, + "default_branch": "3.x", + "languages_pct": { + "PHP": 61, + "TypeScript": 22, + "JavaScript": 10, + "Twig": 7 + }, + "confidence": "medium", + "caveats": [ + "the advisory calls it primarily defense in depth (custom Accept header cannot be sent cross-origin without preflight)", + "component framework in a monorepo (UX packages)" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": null, + "idea": "no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file)" + }, + "recommended": false + }, + { + "id": "wp-podlove-generation-guard-poi", + "repo": "https://github.com/podlove/podlove-publisher", + "language": "php", + "also": [ + "javascript", + "typescript" + ], + "wordpress": true, + "family": "deserialization", + "subtype": "PHP object injection → arbitrary file deletion (in-plugin POP chain)", + "advisory": [ + "CVE-2026-16099", + "GHSA-q83h-6954-x259" + ], + "published": "2026-08-16", + "lane": "C (WordPress, deserialization)", + "vulnerable_versions": "<= 4.5.3", + "fixed_version": "4.5.4 (not stated in the advisory; first release after the fix)", + "vulnerable": "4eedbd66796942ab052de2dbd6311a24cc75c4a7", + "fixed": "ea878175f2612d54888d9e2aa49ae4db93b724fd", + "ancestry": "linear chain of 3 commits (4eedbd66 → d49c4d7f → b59d7962 → ea878175); ancestor of tag 4.5.4", + "fix_named_by_advisory": false, + "fix_note": "The advisory links wp.org trac only. The GitHub history of the referenced files has three consecutive commits of 2026-07-26: `d49c4d7f` 'fix: constrain image lock deletion' (generation_guard.php), `b59d7962` 'fix: harden shownotes REST input' (rest_api.php +173-20), `ea878175` 'fix: limit model unserialization' (lib/model/base.php). The pair spans all three (vulnerable = parent of d49c4d7f).", + "fix_changed_files": [ + "lib/model/base.php", + "lib/model/job.php", + "tests/phpunit/integration/BaseModelSerializationTest.php" + ], + "sink": "unserialize() of model data (lib/model/base.php#L552) instantiating `Podlove\\ImageCache\\GenerationGuard`, whose `__destruct()` calls `wp_delete_file()`", + "source": "shownotes REST input handled by `create_link_item` (contributor+)", + "sites": [ + "lib/modules/shownotes/rest_api.php::create_link_item", + "lib/image_cache/generation_guard.php::__destruct" + ], + "site_files": [ + "lib/model/base.php" + ], + "sink_evidence": "", + "site_derivation": "create_link_item and GenerationGuard::__destruct named by the advisory; files from the advisory's own trac reference links", + "privilege": "Contributor", + "license": "MIT", + "repo_size_mb": 33, + "default_branch": "master", + "languages_pct": { + "PHP": 63, + "JavaScript": 18, + "Vue": 10, + "TypeScript": 6 + }, + "confidence": "medium", + "caveats": [ + "fix inferred from file history (three commits)", + "the advisory text describes the impact (file deletion) under CWE-502" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "af187ad4bba2739839a0aa1e6cf2cabd6f9b99f5", + "tip": "50da8db0f5a85afaf27cd6199940be0403b368ec", + "subject": "fix PHP warning", + "files": [ + "lib/modules/contributors/contributor_list_table.php" + ], + "lines": 2, + "branch": "master", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": true + }, + { + "id": "wp-admin-columns-ids-to-collection-poi", + "repo": "https://github.com/codepress/admin-columns", + "language": "php", + "also": [ + "javascript", + "typescript" + ], + "wordpress": true, + "family": "deserialization", + "subtype": "PHP object injection (bundled POP chain)", + "advisory": [ + "CVE-2026-7654", + "GHSA-h6x4-229g-5f43" + ], + "published": "2026-06-06", + "lane": "C", + "vulnerable_versions": "<= 7.0.18", + "fixed_version": "7.0.19 (not stated; first release after the fix)", + "vulnerable": "ea6db9a02e014fdde69c24b809ad3711f2a691e3", + "fixed": "c64e9aaecd202ea9e8c0e110b10a06e7441f9863", + "ancestry": "parent; ancestor of tag 7.0.19", + "fix_named_by_advisory": false, + "fix_note": "The advisory links wp.org trac only. The compare 7.0.18...7.0.19 has one commit touching the named file: `c64e9aae` 'Update IdsToCollection.php' (+1-1). An identical change `25e276e0` sits on the 7.1 development line. Inferred; the commit message does not say what changed.", + "fix_changed_files": [ + "classes/Formatter/IdsToCollection.php" + ], + "sink": "`unserialize()` without `allowed_classes` in `IdsToCollection::get_ids_from_string()`", + "source": "post meta values set by a Contributor", + "sites": [ + "classes/Formatter/IdsToCollection.php::get_ids_from_string" + ], + "site_files": [ + "classes/Formatter/Meta.php" + ], + "sink_evidence": "unserialize(", + "site_derivation": "Class::method named by the advisory; files from its trac reference links", + "privilege": "Contributor", + "license": "GPL-3.0", + "repo_size_mb": 37, + "default_branch": "main", + "languages_pct": { + "PHP": 69, + "Svelte": 10, + "SCSS": 7, + "JavaScript": 6, + "TypeScript": 6 + }, + "confidence": "medium", + "caveats": [ + "fix inferred (one-line change, uninformative message) -- confirm at freeze that it adds allowed_classes" + ], + "benign": { + "fixed_side": "the fixed pin (both runs) is the fixed-side control", + "proposal": { + "base": "7d20b2c8ab843d265e0b3561d3c33e6dddb58dc5", + "tip": "e998321863c4842445d8c71e48aaf4510cbfa498", + "subject": "Todo ans PHP code fixer", + "files": [ + "classes/ColumnCollection.php", + "classes/DI/Container.php", + "classes/Exception/IteratorException.php", + "classes/Formatter/ImplodeRecursive.php", + "classes/Formatter/Post/DatePublishFormatted.php", + "classes/Formatter/Post/DescriptivePostStatus.php", + "classes/Formatter/Post/PostStatusIcon.php", + "classes/ListScreenCollection.php", + "classes/ListTable/RenderColumnTrait.php", + "classes/Table/TableScreenCollection.php" + ], + "lines": 40, + "branch": "main", + "how": "API proposal (freeze.py filter applied to default-branch commits after the fix date); confirm at freeze", + "flag": "" + }, + "idea": null + }, + "recommended": false + } + ] +} diff --git a/benchmarks/independent/population-v3-php.toml b/benchmarks/independent/population-v3-php.toml new file mode 100644 index 0000000..1af8a4f --- /dev/null +++ b/benchmarks/independent/population-v3-php.toml @@ -0,0 +1,421 @@ +# Independent evaluation population v3 (PHP). Reserved 2026-09-30. +# +# RESERVED, NOT SCANNED. Chosen by web research alone (research-2026-09-30-php.md, candidates-v3-php.json): +# advisories published 2026-06-01 or later, taken newest first per family under criteria fixed before any +# advisory was read, never by how easy a case looks for this analyzer; 470 advisories examined, 26 candidates. +# No repository was cloned, no scanner or project tooling run on any of them, and none is referenced anywhere in +# this project's development tree (checked against every github.com URL under benchmarks/, src/, tests/ and +# .kiro/, which includes populations v1 and v2). +# +# Why a v3: the PHP quick-mode rules were written on 2026-09-30 while looking at PMPro, population-v1's PHP cases, +# Ultimate Member, MediaWiki and WP Statistics, so no PHP number measured so far qualifies them, and population v2 +# is reserved for other qualification. v3 is PHP cases nobody in this project has looked at. +# +# HOLD-OUT RULES (v1's and v2's): no scanner, quick rule, engine, plane task or model is run on any of these +# repositories, and no trace, probe or census of them is made, before the population is FROZEN and protocol-v3.md +# is committed. Freezing reads git history, file lists and the fix commit's diff only. No rule, fact, query, +# prompt or scoring change may cite these cases before their evaluation is recorded; any analyzer change made +# after a v3 result is a retune that v3 cannot qualify. tests/test_independent_population.py fails the moment one +# of these repositories is named anywhere under benchmarks/, src/ or tests/ outside this directory. +# +# SELECTION RULE (research-2026-09-30-php.md, "Recommended balanced selection"), applied mechanically: family +# targets injection 5, output_encoding 3, path 3, untrusted_destination 2, access_control 2, deserialization 1; +# within a family, candidates whose fix commit the advisory names come first, then newest first by publication; +# take the first n. +# +# Maintainer's decision 2026-09-30, "Recommended 16, minus v2 mentions": the advisories that +# research-2026-09-26.md (population v2's research) names in its passed-over note are excluded, and each slot +# they held goes to the next candidate in its family by the same rule. Excluded as v2 mentions: Winter, elFinder, +# Easy!Appointments (all three in the recommended 16), and Grav, Backpack CRUD and Koel (alternates). +# - injection: winter-filter-numberrange-sqli -> mantisbt-tokenizer-eval-rce (next named fix, 2026-07-15). +# - untrusted_destination: elfinder-fsock-dns-rebinding-ssrf -> pagible-admin-proxy-dns-rebinding-ssrf (koel, +# next in line, is a v2 mention; pagible's fix is inferred). easyappointments-caldav-ssrf -> EMPTY: the family +# has no remaining candidate among the 26 (the research's further alternates were never verified and hold no +# record), so the slot is left empty rather than bending the rule. The population holds 15 cases. +# +# `sites` are the sink or execution locations the ADVISORY names (`path::function`, `` for file scope), +# declared before any scan. Where an advisory names only a file (`site_files`), the function is resolved at +# freeze from the fix commit's diff of that file (maintainer's decision 2, "Resolve the function at freeze"), and +# the freeze record gives each site's basis. Protocol v3 credits a finding at a declared site as well as one +# matching the fix's changed lines. +# +# Fixes the advisory does not name (`fix_named_by_advisory = false`) are confirmed at freeze: the diff must change +# the declared sink file and function, or the case is dropped and the next candidate taken by the rule. +# +# Licences marked "verify" must be checked before any result is published. Kirby is under a proprietary licence: +# it stays in the population, but its results are unpublishable without the licensor's permission. + +schema_version = 1 +status = "reserved" +language = "php" +reserved_on = "2026-09-30" +selected_by = "maintainer" +selection = "Recommended 16, minus v2 mentions (15 cases; one untrusted_destination slot empty)" +research = "research-2026-09-30-php.md" +candidates = "candidates-v3-php.json" +protocol = "protocol-v3.md" +multi_language_members = ["wp-geo-my-wp-info-window-lfi", "wp-graphql-updatepost-publish-bypass", "wp-podlove-generation-guard-poi"] +also_reserved = ["population-v1.toml", "population-v2.toml", "../push/ghost-reserved.toml"] + +[[case]] +id = "gitlist-commandline-cmdi" +repo = "https://github.com/klaussilveira/gitlist" +language = "php" +also = [] +wordpress = false +family = "injection" +subtype = "OS command / argument injection" +advisory = ["CVE-2026-82668", "GHSA-v64j-pgc3-qgc9"] +published = "2026-08-31" +vulnerable = "f67609d52c1812fa8a7ed80eae5e795cfd72115f" +fixed = "88cf2866083d5f7c20d9d565c45f828a7ad1516b" +ancestry = "parent; ancestor of tag 3.0.0-beta" +fix_named_by_advisory = true +sink = "`getDefaultBranch` of src/SCM/System/Git/CommandLine.php (git command line)" +source = "repository content/arguments reaching the git command line (not stated precisely)" +sites = ["src/SCM/System/Git/CommandLine.php::getDefaultBranch"] +site_files = [] +site_derivation = "file and function quoted by the advisory (VulDB-generated text)" +privilege = "not stated ('remotely')" +license = "BSD-3-Clause" +confidence = "medium" +caveats = ["VulDB auto-generated description; the fix message ('Prevent textconv') suggests git config/attribute abuse rather than shell metacharacters, and the patched lines may not be in getDefaultBranch -- verify at freeze"] + +[[case]] +id = "qloapps-customermessage-bo-query-sqli" +repo = "https://github.com/Qloapps/QloApps" +language = "php" +also = ["javascript"] +wordpress = false +family = "injection" +subtype = "SQL injection" +advisory = ["CVE-2026-75497", "GHSA-5w6r-2mxc-fq3v"] +published = "2026-08-25" +vulnerable = "5b4d65cbb8570a4ba46364ee0f2ded79d294ab84" +fixed = "123c97c110b7053ea3297d8e58fe95b3c3536560" +ancestry = "parent" +fix_named_by_advisory = true +sink = "database query in CustomerMessage.php built from the `bo_query` parameter" +source = "`bo_query` request parameter" +sites = [] +site_files = ["classes/CustomerMessage.php"] +site_derivation = "the advisory names 'CustomerMessage.php' (basename) and the parameter; the classes/ path is from the fix commit; no function named" +privilege = "administrator" +license = "OSL-3.0" +confidence = "medium" +caveats = ["one fix covers two advisories (Address.php is GHSA-mj48); repo 129 MB, near the size cap", "function-level site to be resolved at freeze"] + +[[case]] +id = "roundcube-markasjunk-cmd-learn-rce" +repo = "https://github.com/roundcube/roundcubemail" +language = "php" +also = ["javascript"] +wordpress = false +family = "injection" +subtype = "OS command injection" +advisory = ["CVE-2026-74997", "GHSA-q5rh-mmp4-ppgq"] +published = "2026-08-17" +vulnerable = "a1afb8fd1f00ed4cb9376c072bb5ca5ded64495e" +fixed = "b8f90e28a46d42e79a69568cba897f8f4223d9cd" +ancestry = "parent; ancestor of tag 1.6.18" +fix_named_by_advisory = true +sink = "the markasjunk plugin's cmd_learn driver runs a shell command with placeholder replacement values" +source = "crafted placeholder replacement values (message/user data) when a message is marked as junk" +sites = [] +site_files = ["plugins/markasjunk/drivers/cmd_learn.php"] +site_derivation = "the advisory names 'the cmd_learn driver of the markasjunk plugin'; the file path follows from that name and is confirmed by the fix commit; no function named" +privilege = "authenticated webmail user" +license = "GPL-3.0" +confidence = "medium" +caveats = ["only instances that enable the markasjunk plugin with the cmd_learn driver"] + +[[case]] +id = "maccms10-template-blacklist-rce" +repo = "https://github.com/magicblack/maccms10" +language = "php" +also = ["javascript"] +wordpress = false +family = "injection" +subtype = "code injection (template → PHP, blacklist bypass)" +advisory = ["CVE-2026-71232", "GHSA-cv48-22qx-mpmx"] +published = "2026-08-05" +vulnerable = "2cabecda29947e8f9ea7cd3aa47ab90ed817605b" +fixed = "71ad3bb29570e110d8e973acff68040a3050ddf0" +ancestry = "parent" +fix_named_by_advisory = true +sink = "ThinkPHP `{if condition=...}` compiled into raw PHP; the admin template editor only blocks a function blacklist" +source = "template content saved through the admin template editor" +sites = [] +site_files = ["application/admin/controller/Template.php"] +site_derivation = "file path quoted by the advisory; no function named" +privilege = "administrator" +license = "GitHub: NOASSERTION; no licence declared by the project [verify before publishing]" +confidence = "medium" +caveats = ["guard bypass (incomplete blacklist); the fix is still a blacklist", "licence not declared on GitHub"] + +[[case]] +id = "mantisbt-tokenizer-eval-rce" +repo = "https://github.com/mantisbt/mantisbt" +language = "php" +also = [] +wordpress = false +family = "injection" +subtype = "code injection (eval)" +advisory = ["CVE-2026-49273", "GHSA-v84x-qvhg-f36r"] +published = "2026-07-15" +vulnerable = "e7041ecc80c8d35f76a7ea1027a8a231244f7dc5" +fixed = "78c0af63d1fe0118004744cab21ca3bf2cea0f5c" +ancestry = "parent; ancestor of tag release-2.28.4" +fix_named_by_advisory = true +sink = "`Tokenizer` (reached through `ConfigParser`) calls `eval()` with a `return;` prefix; PHP hoists class declarations past the return" +source = "non-string configuration value submitted to adm_config_set.php (Manage Configuration)" +sites = [] +site_files = ["core/classes/Tokenizer.class.php", "adm_config_set.php"] +sink_evidence = "eval(" +site_derivation = "the advisory names adm_config_set.php, ConfigParser, Tokenizer and eval(); the Tokenizer file path and the enclosing function are not named (path from the fix commit)" +privilege = "administrator" +license = "GitHub: none; GPL per project [verify before publishing]" +confidence = "high" +caveats = ["function-level site must be resolved at freeze by reading the file (the advisory names only the class)"] + +[[case]] +id = "sharp-editor-iframe-srcdoc-xss" +repo = "https://github.com/code16/sharp" +language = "php" +also = ["typescript"] +wordpress = false +family = "output_encoding" +subtype = "stored XSS (sanitizer allow-list)" +advisory = ["CVE-2026-61823", "GHSA-qxg3-46rw-79j8"] +published = "2026-09-25" +vulnerable = "67743149309054493ec8f5505173fc57aaff760f" +fixed = "ec509a22c808a5bd9dfad6a0a85c92ce6f411e21" +ancestry = "parent; ancestor of tag v9.22.5" +fix_named_by_advisory = true +sink = "Symfony HtmlSanitizer config allows the iframe `srcdoc` attribute; the value is rendered as live HTML" +source = "Editor field content saved by a user with edit permission" +sites = [] +site_files = ["src/Utils/Sanitization/FormatsSanitizedValue.php"] +sink_evidence = "srcdoc" +site_derivation = "file path quoted by the advisory; no function named" +privilege = "authenticated editor" +license = "MIT" +confidence = "medium" +caveats = ["the flaw is a sanitizer allow-list entry, not a missing escape call"] + +[[case]] +id = "privatebin-jsonld-request-uri-injection" +repo = "https://github.com/PrivateBin/PrivateBin" +language = "php" +also = ["javascript"] +wordpress = false +family = "output_encoding" +subtype = "reflected JSON injection (CWE-116)" +advisory = ["CVE-2026-55891", "GHSA-xrjc-c68j-hp7w"] +published = "2026-08-28" +vulnerable = "e0dd4c025c19a182b6a4c6fb77a8bf81ceff6899" +fixed = "75f056dcda955d94c17ec5a4f8c54a9b7bfcee07" +ancestry = "first parent of a merge; ancestor of tag 2.0.5" +fix_named_by_advisory = true +sink = "`Controller::_jsonld()` splices `$_urlBase` into a .jsonld template with `str_replace()`" +source = "`$_SERVER['REQUEST_URI']` via `Request::getRequestUri()` (FILTER_SANITIZE_URL keeps quotes and angle brackets)" +sites = ["lib/Request.php::getRequestUri", "lib/Controller.php::_jsonld"] +site_files = [] +site_derivation = "Class::method names quoted by the advisory; paths lib/*.php from the fix commit" +privilege = "unauthenticated" +license = "GitHub: NOASSERTION; project files state a zlib-style licence [verify before publishing]" +confidence = "high" +caveats = ["the fix changes Request.php only; Controller::_jsonld is a declared site outside the diff", "response type is JSON-LD, not HTML", "licence NOASSERTION on GitHub (zlib-style per project, verify)"] + +[[case]] +id = "openstamanager-group-name-html-injection" +repo = "https://github.com/devcode-it/openstamanager" +language = "php" +also = ["javascript"] +wordpress = false +family = "output_encoding" +subtype = "stored HTML injection" +advisory = ["CVE-2026-44701", "GHSA-crx4-7mmq-j74j"] +published = "2026-08-26" +vulnerable = "57a2734e2121aa8fcd456eff7c59f03e29e69176" +fixed = "0b88ad1963871abfa5e134004ca0c74c496d8d2f" +ancestry = "parent; ancestor of tag v2.11-beta" +fix_named_by_advisory = true +sink = "`''.$group->getTranslation('title').''` in modules/utenti/edit.php" +source = "group name saved when creating a user group" +sites = ["modules/utenti/edit.php::"] +site_files = [] +sink_evidence = "$group->getTranslation('title')" +site_derivation = "file and code quoted by the advisory" +privilege = "authenticated user able to create groups" +license = "GPL-3.0" +confidence = "high" +caveats = ["second advisory commit (7c9eafe9, global GET/POST filtering) is not in the pinned pair"] + +[[case]] +id = "wp-geo-my-wp-info-window-lfi" +repo = "https://github.com/Fitoussi/geo-my-wp" +language = "php" +also = ["javascript"] +wordpress = true +family = "path" +subtype = "local file inclusion" +advisory = ["CVE-2026-85200", "GHSA-6hw9-7gx5-mw88"] +published = "2026-09-12" +vulnerable = "1dbb7b1672a45a8f88fdcd379ceb07b6cf2beceb" +fixed = "5a768bf1c6e44ded83a65be8789f3587515665ac" +ancestry = "parent" +fix_named_by_advisory = true +sink = "include of a file chosen through `gmw_posts_locator_ajax_info_window_loader`" +source = "AJAX request parameters (unauthenticated)" +sites = ["plugins/posts-locator/includes/gmw-posts-locator-functions.php::gmw_posts_locator_ajax_info_window_loader"] +site_files = ["includes/gmw-functions.php"] +site_derivation = "function named by the advisory text; files from the advisory's own trac reference links (gmw-functions.php#L1945/L1987, gmw-posts-locator-functions.php#L964/L975); the function-to-file pairing is an assumption to confirm at freeze" +privilege = "unauthenticated" +license = "GitHub: none; GPL per project [verify before publishing]" +confidence = "medium" +caveats = ["WordPress plugin; GitHub shows no licence (plugin header GPL presumed, verify)", "release commit (small)"] + +[[case]] +id = "kirby-realpath-sibling-traversal" +repo = "https://github.com/getkirby/kirby" +language = "php" +also = [] +wordpress = false +family = "path" +subtype = "path traversal (prefix containment check)" +advisory = ["CVE-2026-75592", "GHSA-6j4c-mgqr-qv76"] +published = "2026-09-02" +vulnerable = "e90257fd7504053e13e93a1e9a5a9a5137aed966" +fixed = "2b6fab950bc89d505ea89576bf71c8de614cc3b2" +ancestry = "parent; ancestor of tag 4.9.5 (not of 5.5.2)" +fix_named_by_advisory = true +sink = "`Dir::realpath()` / `F::realpath()` containment check accepts a sibling directory sharing the prefix (site vs site2)" +source = "media handler request path for not-yet-generated thumbnails" +sites = ["src/Filesystem/Dir.php::realpath", "src/Filesystem/F.php::realpath"] +site_files = [] +site_derivation = "`Dir::realpath()` and `F::realpath()` named by the advisory; paths confirmed by the fix commit" +privilege = "unauthenticated" +license = "Kirby licence (proprietary, GitHub NOASSERTION) -- not OSI; results unpublishable without permission" +confidence = "medium" +caveats = ["only deployments whose index root has a sibling directory with the same name prefix", "Kirby is under a proprietary licence (GitHub NOASSERTION); must be cleared before publishing"] + +[[case]] +id = "mineadmin-appstore-identifier-traversal" +repo = "https://github.com/mineadmin/MineAdmin" +language = "php" +also = [] +wordpress = false +family = "path" +subtype = "path traversal" +advisory = ["CVE-2026-55224", "GHSA-59xm-4m8c-g3xj"] +published = "2026-08-18" +vulnerable = "ac0dcad616c5d304c249d1db4a6675f65cf736dc" +fixed = "ca41902a2a5422676227e5088f4cc1dec06044f1" +ancestry = "parent; the fixed commit is tag v3.2.0-alpha.2" +fix_named_by_advisory = true +sink = "`BASE_PATH . '/plugin/' . $params['identifier']` in download()/install()/unInstall(), then `Plugin::install($params['identifier'])`" +source = "`identifier` request parameter of the app-store plugin endpoints" +sites = ["plugin/mine-admin/app-store/src/Service/Service.php::download", "plugin/mine-admin/app-store/src/Service/Service.php::install", "plugin/mine-admin/app-store/src/Service/Service.php::unInstall"] +site_files = [] +site_derivation = "file path and methods quoted by the advisory" +privilege = "authenticated admin with app-store access (verify)" +license = "Apache-2.0" +confidence = "high" +caveats = ["Hyperf framework (not Laravel/Symfony)"] + +[[case]] +id = "pagible-admin-proxy-dns-rebinding-ssrf" +repo = "https://github.com/aimeos/pagible" +language = "php" +also = ["javascript"] +wordpress = false +family = "untrusted_destination" +subtype = "SSRF (DNS rebinding guard bypass)" +advisory = ["CVE-2026-49262", "GHSA-mmj8-wcvw-6789"] +published = "2026-06-26" +vulnerable = "03f03b2f81b20b1c1625ff227235c43791ddbb33" +fixed = "09a8205d513ec89ed22cdd7bdae0f4c181cee082" +ancestry = "parent; ancestor of tag 0.10.4" +fix_named_by_advisory = false +sink = "`AdminController::proxy` → Guzzle request after `\\Aimeos\\Cms\\Utils::isValidUrl($url)`" +source = "`url` query parameter of `/cmsproxy`" +sites = ["admin/src/Controllers/AdminController.php::proxy", "core/src/Utils.php::isValidUrl"] +site_files = [] +site_derivation = "class::method names quoted by the advisory; paths from the fix commit" +privilege = "authenticated (proxy token)" +license = "MIT" +confidence = "medium" +caveats = ["guard bypass (DNS rebinding)"] + +[[case]] +id = "wp-graphql-updatepost-publish-bypass" +repo = "https://github.com/wp-graphql/wp-graphql" +language = "php" +also = ["javascript"] +wordpress = true +family = "access_control" +subtype = "missing object-level capability check" +advisory = ["CVE-2026-88974", "GHSA-5mmc-8pc9-wggg"] +published = "2026-09-23" +vulnerable = "d53b0e566f20a8df0664559cb6432d52a7cd285c" +fixed = "55441663eaa33c3f2e05de038c8286c845916461" +ancestry = "parent; ancestor of tag wp-graphql/v2.22.2" +fix_named_by_advisory = true +sink = "`updatePost` mutation checks only `$post_type_object->cap->edit_posts`" +source = "GraphQL `updatePost` mutation input (status PUBLISH, published post id)" +sites = [] +site_files = ["plugins/wp-graphql/src/Mutation/PostObjectUpdate.php"] +site_derivation = "the advisory names src/Mutation/PostObjectUpdate.php; the repository is a monorepo (plugins/wp-graphql/ prefix from the fix commit); no function named" +privilege = "Contributor" +license = "GPL-3.0" +confidence = "medium" +caveats = ["fix commit also carries an unrelated Model.php change", "function-level site to resolve at freeze"] + +[[case]] +id = "sylius-mollie-thankyou-order-idor" +repo = "https://github.com/Sylius/MolliePlugin" +language = "php" +also = [] +wordpress = false +family = "access_control" +subtype = "IDOR (missing ownership check)" +advisory = ["CVE-2026-68501", "GHSA-x83g-979r-f5fh"] +published = "2026-07-31" +vulnerable = "7400f1489a4b699df97ced9499acde4faaa476d5" +fixed = "01316b3ad3cf82e3c5ad160115d0a2cf89174e49" +ancestry = "first parent of a merge; ancestor of tag v3.3.1" +fix_named_by_advisory = true +sink = "`findOneBy(['id' => $orderId])` without ownership/session check, returning the order token (302 Location) and QR code" +source = "`orderId` of GET /{_locale}/thank-you and /{_locale}/get-code" +sites = ["src/Controller/Shop/PageRedirectController.php::thankYouAction", "src/Controller/Shop/QrCodeAction.php::fetchQrCodeFromOrder"] +site_files = [] +site_derivation = "Class::method names quoted by the advisory; paths from the fix commit" +privilege = "unauthenticated" +license = "MIT" +confidence = "high" +caveats = ["merge commit; one fix covers two advisories (webhook forgery GHSA-rc52 is the other)"] + +[[case]] +id = "wp-podlove-generation-guard-poi" +repo = "https://github.com/podlove/podlove-publisher" +language = "php" +also = ["javascript", "typescript"] +wordpress = true +family = "deserialization" +subtype = "PHP object injection → arbitrary file deletion (in-plugin POP chain)" +advisory = ["CVE-2026-16099", "GHSA-q83h-6954-x259"] +published = "2026-08-16" +vulnerable = "4eedbd66796942ab052de2dbd6311a24cc75c4a7" +fixed = "ea878175f2612d54888d9e2aa49ae4db93b724fd" +ancestry = "linear chain of 3 commits (4eedbd66 → d49c4d7f → b59d7962 → ea878175); ancestor of tag 4.5.4" +fix_named_by_advisory = false +sink = "unserialize() of model data (lib/model/base.php#L552) instantiating `Podlove\\ImageCache\\GenerationGuard`, whose `__destruct()` calls `wp_delete_file()`" +source = "shownotes REST input handled by `create_link_item` (contributor+)" +sites = ["lib/modules/shownotes/rest_api.php::create_link_item", "lib/image_cache/generation_guard.php::__destruct"] +site_files = ["lib/model/base.php"] +site_derivation = "create_link_item and GenerationGuard::__destruct named by the advisory; files from the advisory's own trac reference links" +privilege = "Contributor" +license = "MIT" +confidence = "medium" +caveats = ["fix inferred from file history (three commits)", "the advisory text describes the impact (file deletion) under CWE-502"] diff --git a/benchmarks/independent/research-2026-09-30-php.md b/benchmarks/independent/research-2026-09-30-php.md new file mode 100644 index 0000000..26ac116 --- /dev/null +++ b/benchmarks/independent/research-2026-09-30-php.md @@ -0,0 +1,842 @@ +# Independent evaluation population v3 (PHP): candidate real-world cases + +Research date: 2026-09-30. Method: web research only. I read GitHub advisory records (the global advisory API, reviewed and unreviewed), commit pages, compare views, repository metadata and file histories through `gh api` (read-only) and GitHub search. I did not clone, download or check out any candidate repository, did not run any scanner, rule, engine or project tool on one, and did not read candidate source beyond what an advisory itself quotes. Commit pages were read for their metadata (parents, message, changed-file names and line counts), not their patch text. + +Output: this file and `candidates-v3-php.json` (26 candidates, machine-readable, one record per case in the v2 schema plus research fields). Nothing is reserved yet: the maintainer chooses, then a `population-v3.toml` and a protocol are written and frozen as for v2. + +## Why a v3, and what it must not contain + +PHP quick-mode rules were written on 2026-09-30 while looking at PMPro, population-v1's PHP cases, Ultimate Member, MediaWiki and WP Statistics. None of today's PHP numbers qualifies, and population v2 is reserved for other qualification. v3 must be PHP cases nobody in this project has looked at. + +## Selection criteria (fixed before looking at any advisory) + +From the maintainer's brief, unchanged: +- **Language** PHP. WordPress plugins allowed but capped at half the population; non-WordPress PHP applications and frameworks included. +- **Recency**: advisory published 2026-06-01 or later, taken newest first; a public fix commit or tag diff in a public GitHub repository; identifiable vulnerable and fixed versions. +- **Family spread**: at most about 40% injection; include output_encoding, path, untrusted_destination, deserialization, access_control and OS command injection where advisories exist. Families are the ids of `src/openultrasast/ruleset/families.toml`, and an advisory's family is found from its CWE ids through that file's `cwes` lists (so CWE-434 upload and CWE-74 generic injection map to no family). +- **Declarable site**: the advisory names the vulnerable function or file, so a `sites` entry can be declared from its text alone. +- **Exclusions**: any repository whose `github.com/owner/repo` appears under `benchmarks/`, `src/`, `tests/` or `.kiro/` (341 repositories, extracted by grep and compared case-insensitively); PMPro, Ultimate Member, LearnPress, phpMyFAQ, YesWiki, MediaWiki (including MediaWiki extensions), WP Statistics, froxlor, GoPay, Directorist and Groundhogg by name; repositories over about 150 MB by the GitHub API `size` (153,600 KB); advisories without a fix diff. + +Operational rules, carried over from the v2 research (`research-2026-09-26.md`) and fixed before the first advisory was read: +- **In scope** means a web application, CMS, web framework/bundle or plugin whose vulnerable code is reached from HTTP request handling inside the repository. General-purpose libraries and framework APIs whose attacker input only exists in a calling application, developer tools/CLIs, and client-side JavaScript sinks are rejected (they give the analyzer no in-repo source). +- **Fix**: at most 3 commits, or one commit that is plainly about this weakness; a fix buried in a large unrelated squash or release commit is rejected, as is a fix that changes no PHP line (the fixed pin must differ in PHP). A fix commit the advisory does not name may be taken from the release compare or the named file's history, and is then marked `fix_named_by_advisory: false`. +- **One case per repository.** Old vulnerabilities republished in 2026 under an older CVE id are rejected (v2 did the same). +- **Guard-bypass and incomplete-fix advisories are allowed**, with the caveat recorded. +- **At no point was a case chosen or skipped for how easy it would be for this analyzer.** No rule or query of the project was consulted. + +### Order and quotas + +- **Family quotas** (targeting about 27 candidates): injection 8, output_encoding 4, path 4, untrusted_destination 4, access_control 4, deserialization 3. +- **Passes by family, rarest first**, so that one-case-per-repository does not hand a rare family's only repository to a common family. Rarity was counted from metadata alone (distinct eligible repositories per family after the automatic exclusions, before any advisory text was read): deserialization 1, injection 9, path 10, untrusted_destination 11, access_control 16, output_encoding 21. Within a pass, advisories are taken newest first (by `published_at`); a repository taken in an earlier pass is skipped. +- **Sources (lanes)**, consulted in this order within a pass, and each later lane only for a family still short after the earlier ones: + - **Lane A** — reviewed GitHub advisories, ecosystem composer, published >= 2026-06-01 (582 records; 386 in the six families). `gh api --paginate "/advisories?ecosystem=composer&type=reviewed&published=>=2026-06-01&sort=published&direction=desc"`. + - **Lane B** — unreviewed advisories for the family CWEs of injection, path, deserialization and untrusted_destination (5,246 records), kept when a reference is a `github.com///(commit|pull|compare)/` link and the GitHub API reports the repository's language as PHP (92 records on 56 PHP repositories). Output_encoding and access_control were not fetched, because lane A filled them. + - **Lane C** — deserialization only: unreviewed CWE-502 advisories whose text names WordPress (42), each plugin searched on GitHub for a development repository (SVN mirrors do not count, as in v2), plus the non-WordPress CWE-502 records naming a PHP product (9). The Patchstack one-line records ('Unauthenticated PHP Object Injection in X <= v') never name a function and were not examined individually. + - Lanes B and C were added after lane A left injection 4, path 3 and deserialization 0 against their quotas; the lane rule was fixed then, before any lane-B/C advisory was read. +- **Verification** of every candidate: `gh api repos/O/R/commits/` for the fixed commit (parents, message, changed files); the vulnerable pin is the fixed commit's (first) parent, except where a short linear chain is noted; `compare/...` confirms the fixed commit is an ancestor of the first fixed release wherever a tag exists; repository size, licence and default branch from `repos/O/R`. + +## Counts + +- **Examined: 470** advisories (lane A 379, lane B 40, lane C 51). **Taken: 26. Rejected: 444.** +- Automatic exclusions by metadata count as examined, as in v2; advisories passed over after their family's quota filled were not examined and are listed separately (lane A 7, lane B 34; lane B's 18 untrusted_destination rows were never needed). + +| Rejection reason | Count | +|---|---| +| repository over ~150 MB | 161 | +| one case per repository | 64 | +| repository already referenced in the project tree (used list) | 46 | +| advisory names no vulnerable file or function | 46 | +| library/framework API: no attacker source inside the repository | 42 | +| duplicate advisory | 26 | +| no usable fix diff (none, unmerged, reverted, release squash, or non-PHP) | 25 | +| no public development repository | 10 | +| not a web application (developer tool, CLI, game server) | 9 | +| excluded by name | 6 | +| old vulnerability republished (CVE-2022..2025) | 4 | +| sink is client-side JavaScript | 3 | +| other: corrupt advisory record: the description is about draytek vi | 1 | +| other: personal/student project (`harsh21patel/inventory-management | 1 | + +## Family mix of the 26 candidates + +| Family | Candidates | Of which WordPress | Subtypes | +|---|---|---|---| +| injection | 8 | 0 | OS command / argument injection; OS command injection; SQL injection; code injection | +| output_encoding | 4 | 0 | XSS; reflected JSON injection; stored HTML injection; stored XSS | +| path | 4 | 1 | local file inclusion; path traversal | +| untrusted_destination | 4 | 0 | SSRF | +| access_control | 4 | 2 | IDOR; IDOR in REST permission callback; missing object-level capability check; unvalidated URL-writable properties override provisioning parameters | +| deserialization | 2 | 2 | PHP object injection; PHP object injection → arbitrary file deletion | +| **total** | **26** | **5** (19%) | | + +Injection is 8 of 26 (31%): SQL 2 (Winter, QloApps), OS command 3 (Backpack, GitList, Roundcube), code/eval 3 (Grav, MantisBT, MacCMS). Untrusted_destination is all SSRF: no open-redirect advisory reached the top of its pass. WordPress is 5 of 26 (19%), under the cap. + +## Candidates + +Full records (sink, source, sites, site derivation, fix notes, caveats, benign proposal) are in `candidates-v3-php.json`. `R` marks the recommended selection below. + +| # | R | id | repo | family | advisory | published | vulnerable → fixed | fixed release | sites (advisory) | licence | MB | WP | +|---|---|----|------|--------|----------|-----------|--------------------|---------------|------------------|---------|----|----| +| 1 | | grav-blueprint-bare-function-rce | https://github.com/getgrav/grav | injection | CVE-2026-75827 / GHSA-f8wv-xp27-6gq7 | 2026-09-17 | `24e8717ae317` → `af31066e9b6a` | 2.0.15 | `system/src/Grav/Common/Data/Blueprint.php::isSafeDynamicCall`, `system/src/Grav/Common/Data/Blueprint.php::init` | MIT | 34 | | +| 2 | | backpack-stats-host-header-cmdi | https://github.com/Laravel-Backpack/CRUD | injection | CVE-2026-54182 / GHSA-mrc5-3mm3-45c5 | 2026-08-20 | `baae0420b6eb` → `282ba2a0b887` | 7.0.36 | `src/Stats.php::makeCurlRequest` | MIT | 76 | | +| 3 | R | winter-filter-numberrange-sqli | https://github.com/wintercms/winter | injection | CVE-2026-32593 / GHSA-m7jc-g4rc-jmvh | 2026-08-12 | `555e67c84b50` → `50713de95adf` | 1.2.13 | `modules/backend/widgets/Filter.php::numbersFromAjax` | MIT | 68 | | +| 4 | | mantisbt-tokenizer-eval-rce | https://github.com/mantisbt/mantisbt | injection | CVE-2026-49273 / GHSA-v84x-qvhg-f36r | 2026-07-15 | `e7041ecc80c8` → `78c0af63d1fe` | 2.28.4 | file only: `core/classes/Tokenizer.class.php`, `adm_config_set.php` | GitHub: none [verify] | 89 | | +| 5 | R | gitlist-commandline-cmdi | https://github.com/klaussilveira/gitlist | injection | CVE-2026-82668 / GHSA-v64j-pgc3-qgc9 | 2026-08-31 | `f67609d52c18` → `88cf2866083d` | 3.0.0-beta | `src/SCM/System/Git/CommandLine.php::getDefaultBranch` | BSD-3-Clause | 6 | | +| 6 | R | qloapps-customermessage-bo-query-sqli | https://github.com/Qloapps/QloApps | injection | CVE-2026-75497 / GHSA-5w6r-2mxc-fq3v | 2026-08-25 | `5b4d65cbb857` → `123c97c110b7` | commit 123c97c | file only: `classes/CustomerMessage.php` | OSL-3.0 | 129 | | +| 7 | R | roundcube-markasjunk-cmd-learn-rce | https://github.com/roundcube/roundcubemail | injection | CVE-2026-74997 / GHSA-q5rh-mmp4-ppgq | 2026-08-17 | `a1afb8fd1f00` → `b8f90e28a46d` | 1.6.18 / 1.7.3 | file only: `plugins/markasjunk/drivers/cmd_learn.php` | GPL-3.0 | 67 | | +| 8 | R | maccms10-template-blacklist-rce | https://github.com/magicblack/maccms10 | injection | CVE-2026-71232 / GHSA-cv48-22qx-mpmx | 2026-08-05 | `2cabecda2994` → `71ad3bb29570` | commit 71ad3bb | file only: `application/admin/controller/Template.php` | GitHub: NOASSERTION [verify] | 29 | | +| 9 | R | kirby-realpath-sibling-traversal | https://github.com/getkirby/kirby | path | CVE-2026-75592 / GHSA-6j4c-mgqr-qv76 | 2026-09-02 | `e90257fd7504` → `2b6fab950bc8` | 4.9.5 / 5.5.2 | `src/Filesystem/Dir.php::realpath`, `src/Filesystem/F.php::realpath` | GitHub: NOASSERTION [verify] | 66 | | +| 10 | R | mineadmin-appstore-identifier-traversal | https://github.com/mineadmin/MineAdmin | path | CVE-2026-55224 / GHSA-59xm-4m8c-g3xj | 2026-08-18 | `ac0dcad616c5` → `ca41902a2a54` | 3.2.0-alpha.2 | `plugin/mine-admin/app-store/src/Service/Service.php::download`, `plugin/mine-admin/app-store/src/Service/Service.php::install`, `plugin/mine-admin/app-store/src/Service/Service.php::unInstall` | Apache-2.0 | 53 | | +| 11 | | facturascripts-uploadedfile-move-traversal | https://github.com/NeoRazorX/facturascripts | path | GHSA-hgjx-r89m-m7v4 | 2026-07-14 | `6baefcdc00c2` → `d3770be64a3e` | not stated | `Core/UploadedFile.php::move` | LGPL-3.0 | 60 | | +| 12 | R | wp-geo-my-wp-info-window-lfi | https://github.com/Fitoussi/geo-my-wp | path | CVE-2026-85200 / GHSA-6hw9-7gx5-mw88 | 2026-09-12 | `1dbb7b1672a4` → `5a768bf1c6e4` | 4.5.5.4 | `plugins/posts-locator/includes/gmw-posts-locator-functions.php::gmw_posts_locator_ajax_info_window_loader` | GitHub: none [verify] | 9 | yes | +| 13 | R | elfinder-fsock-dns-rebinding-ssrf | https://github.com/Studio-42/elFinder | untrusted_destination | CVE-2026-81889 / GHSA-8x3q-jpjh-qh5c | 2026-08-31 | `dd73e702820c` → `6d997386cd0f` | 2.1.70 | `php/elFinder.class.php::fsock_get_contents` | GitHub: NOASSERTION [verify] | 43 | | +| 14 | R | easyappointments-caldav-ssrf | https://github.com/alextselegidis/easyappointments | untrusted_destination | CVE-2026-52840 / GHSA-pm5p-7w5h-jm5q | 2026-07-29 | `725eafa64730` → `4abb10545d83` | 1.6.0 | `application/controllers/Caldav.php::connect_to_server`, `application/libraries/Caldav_sync.php::test_connection` | GPL-3.0 | 49 | | +| 15 | | koel-podcast-enclosure-ipv6-ssrf | https://github.com/koel/koel | untrusted_destination | CVE-2026-54494 / GHSA-rjg7-r26h-cfp2 | 2026-07-15 | `8ee1de0f5589` → `5f6ce2cefd08` | 9.7.1 | `app/Helpers/Network.php::isPublicHost`, `app/Values/Podcast/EpisodePlayable.php::createForEpisode` | MIT | 29 | | +| 16 | | pagible-admin-proxy-dns-rebinding-ssrf | https://github.com/aimeos/pagible | untrusted_destination | CVE-2026-49262 / GHSA-mmj8-wcvw-6789 | 2026-06-26 | `03f03b2f81b2` → `09a8205d513e` | 0.10.4 | `admin/src/Controllers/AdminController.php::proxy`, `core/src/Utils.php::isValidUrl` | MIT | 73 | | +| 17 | R | wp-graphql-updatepost-publish-bypass | https://github.com/wp-graphql/wp-graphql | access_control | CVE-2026-88974 / GHSA-5mmc-8pc9-wggg | 2026-09-23 | `d53b0e566f20` → `55441663eaa3` | 2.22.2 | file only: `plugins/wp-graphql/src/Mutation/PostObjectUpdate.php` | GPL-3.0 | 120 | yes | +| 18 | R | sylius-mollie-thankyou-order-idor | https://github.com/Sylius/MolliePlugin | access_control | CVE-2026-68501 / GHSA-x83g-979r-f5fh | 2026-07-31 | `7400f1489a4b` → `01316b3ad3cf` | 2.2.8 / 3.2.4 / 3.3.1 | `src/Controller/Shop/PageRedirectController.php::thankYouAction`, `src/Controller/Shop/QrCodeAction.php::fetchQrCodeFromOrder` | MIT | 9 | | +| 19 | | paymenter-checkout-config-override | https://github.com/Paymenter/Paymenter | access_control | CVE-2026-47198 / GHSA-5q4q-834j-g8g4 | 2026-06-30 | `9d305ea444f7` → `75719ae46b40` | 1.5.1 | file only: `app/Livewire/Products/Checkout.php`, `app/Livewire/Cart.php` | MIT | 15 | | +| 20 | | wp-buddypress-messages-rest-idor | https://github.com/buddypress/buddypress | access_control | CVE-2026-53673 / GHSA-j3j5-5m8v-7gvc | 2026-06-10 | `56b1fd3b4054` → `27d41e9749a8` | 14.5.0 | `src/bp-messages/classes/class-bp-messages-rest-controller.php::get_item_permissions_check` | GitHub: none [verify] | 79 | yes | +| 21 | R | sharp-editor-iframe-srcdoc-xss | https://github.com/code16/sharp | output_encoding | CVE-2026-61823 / GHSA-qxg3-46rw-79j8 | 2026-09-25 | `677431493090` → `ec509a22c808` | 9.22.5 | file only: `src/Utils/Sanitization/FormatsSanitizedValue.php` | MIT | 109 | | +| 22 | R | privatebin-jsonld-request-uri-injection | https://github.com/PrivateBin/PrivateBin | output_encoding | CVE-2026-55891 / GHSA-xrjc-c68j-hp7w | 2026-08-28 | `e0dd4c025c19` → `75f056dcda95` | 2.0.5 | `lib/Request.php::getRequestUri`, `lib/Controller.php::_jsonld` | GitHub: NOASSERTION [verify] | 16 | | +| 23 | R | openstamanager-group-name-html-injection | https://github.com/devcode-it/openstamanager | output_encoding | CVE-2026-44701 / GHSA-crx4-7mmq-j74j | 2026-08-26 | `57a2734e2121` → `0b88ad196387` | 2.11-beta | `modules/utenti/edit.php::` | GPL-3.0 | 43 | | +| 24 | | symfony-ux-live-child-tag-xss | https://github.com/symfony/ux | output_encoding | CVE-2026-49210 / GHSA-38x5-rcv4-xf7x | 2026-06-19 | `a6e9bf808476` → `fbc5e9a1bda7` | 2.36.0 / 3.1.0 | `src/LiveComponent/src/Util/ChildComponentPartialRenderer.php::createHtml` | MIT | 59 | | +| 25 | R | wp-podlove-generation-guard-poi | https://github.com/podlove/podlove-publisher | deserialization | CVE-2026-16099 / GHSA-q83h-6954-x259 | 2026-08-16 | `4eedbd667969` → `ea878175f261` | 4.5.4 (not stated in the advisory; first release after the fix) | `lib/modules/shownotes/rest_api.php::create_link_item`, `lib/image_cache/generation_guard.php::__destruct` | MIT | 33 | yes | +| 26 | | wp-admin-columns-ids-to-collection-poi | https://github.com/codepress/admin-columns | deserialization | CVE-2026-7654 / GHSA-h6x4-229g-5f43 | 2026-06-06 | `ea6db9a02e01` → `c64e9aaecd20` | 7.0.19 (not stated; first release after the fix) | `classes/Formatter/IdsToCollection.php::get_ids_from_string` | GPL-3.0 | 37 | yes | + +Full SHAs are in the JSON. Fix commits the advisory does not name (inferred from a release compare or file history): grav, backpack, facturascripts, pagible, paymenter, podlove, admin-columns. + +### Per-candidate notes + +#### grav-blueprint-bare-function-rce (injection; code injection (callable allow-list bypass → arbitrary PHP function)) +- Repo https://github.com/getgrav/grav (MIT, 34 MB, languages PHP 100%). Lane A. Advisory CVE-2026-75827 / GHSA-f8wv-xp27-6gq7, published 2026-09-17; affected <= 2.0.14; fixed 2.0.15. +- Sink: system/src/Grav/Common/Data/Blueprint.php:455-458 `call_user_func_array($o, $params)` (bare-function dynamic-data provider), gated by `Blueprint::isSafeDynamicCall()` (Blueprint.php:514-536), whose bare-function branch uses only the denylist `Utils::isDangerousFunction()`; twin sink system/src/Grav/Framework/Flex/FlexDirectory.php:936-938 `call_user_func_array($function, $params)`. Source: a blueprint `data-*@` directive naming a bare PHP function (e.g. `error_log`) with attacker parameters, resolved by `Blueprint::init()`. Privilege: authenticated account that can edit pages/blueprint data (per the advisory's root-cause section; verify). +- Fix: The advisory links no commit. Found in the release compare 2.0.14...2.0.15 (14 commits, each security fix labelled): `af31066e` '[security] Gate the blueprint bare-function data directive on a positive allowlist', 1 file (Blueprint.php +11-1). A later commit in the same release, `c51987f5` 'Trust blueprint dynamic-data providers by provenance, not by allowlist', reworks the same gate. Ancestry: parent; ancestor of tag 2.0.15. +- Sites: file paths and function names quoted by the advisory. sink_evidence `call_user_func_array($o, $params)`. +- Benign: fixed pin as fixed-side control; proposed benign change `8661b3b56448` "Deduplicate repeated debugger deprecation traces" (172 lines, CHANGELOG.md, system/src/Grav/Common/Debugger.php, tests/unit/Grav/Common/DebuggerDeprecationsTest.php). +- Caveats: guard bypass: the vulnerable pin already has a denylist check; the enclosing function of the call_user_func_array line is not named by this advisory (sink_evidence is used instead). Confidence: high. + +#### backpack-stats-host-header-cmdi (injection; OS command injection) +- Repo https://github.com/Laravel-Backpack/CRUD (MIT, 76 MB, languages PHP 80%, Blade 17%). Lane A. Advisory CVE-2026-54182 / GHSA-mrc5-3mm3-45c5, published 2026-08-20; affected 7.x < 7.0.36 (also 4.1.x < 4.1.72, 5.x < 5.6.2, 6.x < 6.8.13); fixed 7.0.36. +- Sink: `Backpack\CRUD\Stats::makeCurlRequest` builds a shell command and passes it to `exec()`. Source: HTTP `Host` header, on every production request through `BackpackServiceProvider::boot()` (1-in-100 random gate). Privilege: unauthenticated. +- Fix: The advisory links only release tags. The compare 7.0.35...7.0.36 contains exactly one commit, `282ba2a0` 'refactor stats to use guzzle only' (src/Stats.php +6-31), matching the advisory's 'makeCurlRequest was replaced with the Guzzle-based path'. Ancestry: parent; the fixed commit is tag 7.0.36. +- Sites: class and method named by the advisory; the path src/Stats.php follows from the PSR-4 class name and is confirmed only by the fix commit's file list. +- Benign: fixed pin as fixed-side control; proposed benign change `608652b1020b` "fix color display (#5992)" (8 lines, src/resources/views/crud/columns/color.blade.php). +- Caveats: needs exec() and curl available, and a Host header that the web server passes through (the advisory rates AC:H). Confidence: high. + +#### winter-filter-numberrange-sqli (injection; SQL injection) +- Repo https://github.com/wintercms/winter (MIT, 68 MB, languages PHP 70%, JavaScript 19%, Less 8%). Lane A. Advisory CVE-2026-32593 / GHSA-m7jc-g4rc-jmvh, published 2026-08-12; affected <= 1.2.12; fixed 1.2.13. +- Sink: `Backend\Widgets\Filter` builds SQL for a `numberrange` scope configured with a `conditions` key. Source: the filter widget's AJAX handler (`numbersFromAjax`, per the advisory title). Privilege: authenticated backend user with access to an affected list view. +- Fix: Advisory workaround names commit `50713de9` 'Use parameter binding for filter scope values in conditions statements' (modules/backend/widgets/Filter.php +64-24, plus a test). Ancestry: parent; ancestor of tag v1.2.13, not of v1.2.12. +- Sites: class `Backend\Widgets\Filter` and `numbersFromAjax` named by the advisory; path confirmed by the fix commit. +- Benign: fixed pin as fixed-side control; proposed benign change `2a342f94ae7c` "Improved Ukrainian translation (#1467)" (46 lines, modules/backend/lang/uk/lang.php). +- Caveats: no built-in view uses the vulnerable scope/config combination: exploitable only with a plugin that registers a numberrange scope with `conditions` (the sink is in core, the configuration is not). Confidence: medium. + +#### mantisbt-tokenizer-eval-rce (injection; code injection (eval)) +- Repo https://github.com/mantisbt/mantisbt (GitHub: none [verify], 89 MB, languages PHP 82%, CSS 10%). Lane A. Advisory CVE-2026-49273 / GHSA-v84x-qvhg-f36r, published 2026-07-15; affected >= 1.3.0, <= 2.28.3; fixed 2.28.4. +- Sink: `Tokenizer` (reached through `ConfigParser`) calls `eval()` with a `return;` prefix; PHP hoists class declarations past the return. Source: non-string configuration value submitted to adm_config_set.php (Manage Configuration). Privilege: administrator. +- Fix: Advisory patch link `78c0af63` 'Remove use of eval() in Tokenizer class' (core/classes/Tokenizer.class.php +2-6). Ancestry: parent; ancestor of tag release-2.28.4. +- Sites: the advisory names adm_config_set.php, ConfigParser, Tokenizer and eval(); the Tokenizer file path and the enclosing function are not named (path from the fix commit). sink_evidence `eval(`. +- Benign: fixed pin as fixed-side control; proposed benign change `c867fcc0c119` "Web UI: use project category commands" (58 lines, manage_proj_cat_add.php, manage_proj_cat_copy.php, manage_proj_cat_delete.php…). +- Caveats: function-level site must be resolved at freeze by reading the file (the advisory names only the class). Confidence: high. + +#### gitlist-commandline-cmdi (injection; OS command / argument injection) +- Repo https://github.com/klaussilveira/gitlist (BSD-3-Clause, 6 MB, languages PHP 87%, Twig 9%). Lane B. Advisory CVE-2026-82668 / GHSA-v64j-pgc3-qgc9, published 2026-08-31; affected 2.0.0; fixed 3.0.0-beta. +- Sink: `getDefaultBranch` of src/SCM/System/Git/CommandLine.php (git command line). Source: repository content/arguments reaching the git command line (not stated precisely). Privilege: not stated ('remotely'). +- Fix: Advisory names patch `88cf2866` 'Prevent textconv. Fixes #947.' (src/SCM/System/Git/CommandLine.php +2-2, plus a test). Ancestry: parent; ancestor of tag 3.0.0-beta. +- Sites: file and function quoted by the advisory (VulDB-generated text). +- Benign: fixed pin as fixed-side control; no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file). +- Caveats: VulDB auto-generated description; the fix message ('Prevent textconv') suggests git config/attribute abuse rather than shell metacharacters, and the patched lines may not be in getDefaultBranch -- verify at freeze. Confidence: medium. + +#### qloapps-customermessage-bo-query-sqli (injection; SQL injection) +- Repo https://github.com/Qloapps/QloApps (OSL-3.0, 129 MB, languages PHP 80%, Smarty 9%, JavaScript 7%). Lane B. Advisory CVE-2026-75497 / GHSA-5w6r-2mxc-fq3v, published 2026-08-25; affected not stated ('Fixed in 123c97c'); fixed commit 123c97c. +- Sink: database query in CustomerMessage.php built from the `bo_query` parameter. Source: `bo_query` request parameter. Privilege: administrator. +- Fix: Advisory names `123c97c1` 'Fixed: validate request parameters before database query' (PR #1783): classes/CustomerMessage.php +1-1, classes/Address.php +8-8 (twin advisory GHSA-mj48-jjc7-6wqr) and three hotel-module classes. Ancestry: parent. +- Sites: the advisory names 'CustomerMessage.php' (basename) and the parameter; the classes/ path is from the fix commit; no function named. +- Benign: fixed pin as fixed-side control; proposed benign change `54c12b4efe41` "fixed issues" (106 lines, classes/order/Order.php, classes/order/OrderPayment.php, modules/hotelreservationsystem/classes/HotelBookingDetail.php…). +- Caveats: one fix covers two advisories (Address.php is GHSA-mj48); repo 129 MB, near the size cap; function-level site to be resolved at freeze. Confidence: medium. + +#### roundcube-markasjunk-cmd-learn-rce (injection; OS command injection) +- Repo https://github.com/roundcube/roundcubemail (GPL-3.0, 67 MB, languages PHP 90%, JavaScript 7%). Lane B. Advisory CVE-2026-74997 / GHSA-q5rh-mmp4-ppgq, published 2026-08-17; affected < 1.6.18; 1.7.x < 1.7.3; fixed 1.6.18 / 1.7.3. +- Sink: the markasjunk plugin's cmd_learn driver runs a shell command with placeholder replacement values. Source: crafted placeholder replacement values (message/user data) when a message is marked as junk. Privilege: authenticated webmail user. +- Fix: Advisory links `14044f84` (master) and `b8f90e28` (1.6 line), both 'Fix RCE via cmd_learn driver of markasjunk plugin' (plugins/markasjunk/drivers/cmd_learn.php +14-10), and a follow-up warning fix `495d2116`. The 1.6-line pin is used because it is an ancestor of tag 1.6.18. Ancestry: parent; ancestor of tag 1.6.18. +- Sites: the advisory names 'the cmd_learn driver of the markasjunk plugin'; the file path follows from that name and is confirmed by the fix commit; no function named. +- Benign: fixed pin as fixed-side control; proposed benign change `747f544708ed` "Simplify" (6 lines, tests/Framework/TnefDecoderTest.php); tests-only change, on master (the fixed pin is on the 1.6 line). +- Caveats: only instances that enable the markasjunk plugin with the cmd_learn driver. Confidence: medium. + +#### maccms10-template-blacklist-rce (injection; code injection (template → PHP, blacklist bypass)) +- Repo https://github.com/magicblack/maccms10 (GitHub: NOASSERTION [verify], 29 MB, languages PHP 66%, HTML 23%, JavaScript 9%). Lane B. Advisory CVE-2026-71232 / GHSA-cv48-22qx-mpmx, published 2026-08-05; affected before commit 71ad3bb (2026-06-22); fixed commit 71ad3bb. +- Sink: ThinkPHP `{if condition=...}` compiled into raw PHP; the admin template editor only blocks a function blacklist. Source: template content saved through the admin template editor. Privilege: administrator. +- Fix: Advisory names `71ad3bb2` (application/admin/controller/Template.php +1-1: adds the missing functions to the blacklist regex). Ancestry: parent. +- Sites: file path quoted by the advisory; no function named. +- Benign: fixed pin as fixed-side control; proposed benign change `668ba418e50e` "fix #1356 修正注册API校验器解析错误及缺参报错" (166 lines, application/api/controller/User.php, application/common/model/User.php, tests/regression/user_register_validate.php…); review: subject says it fixes a register-API validator. +- Caveats: guard bypass (incomplete blacklist); the fix is still a blacklist; licence not declared on GitHub. Confidence: medium. + +#### kirby-realpath-sibling-traversal (path; path traversal (prefix containment check)) +- Repo https://github.com/getkirby/kirby (GitHub: NOASSERTION [verify], 66 MB, languages PHP 77%, Vue 15%). Lane A. Advisory CVE-2026-75592 / GHSA-6j4c-mgqr-qv76, published 2026-09-02; affected < 4.9.5; 5.0.0 - 5.5.1; fixed 4.9.5 / 5.5.2. +- Sink: `Dir::realpath()` / `F::realpath()` containment check accepts a sibling directory sharing the prefix (site vs site2). Source: media handler request path for not-yet-generated thumbnails. Privilege: unauthenticated. +- Fix: Advisory links `2b6fab95` 'fix: Ensure containment in ::realpath()' (4.x line: src/Filesystem/Dir.php, src/Filesystem/F.php) and `e0dca5f7` (5.x line, which also carries the Media::thumb fix of GHSA-9vx2-j98c-p72w). The 4.x pin keeps the case to this advisory alone. Ancestry: parent; ancestor of tag 4.9.5 (not of 5.5.2). +- Sites: `Dir::realpath()` and `F::realpath()` named by the advisory; paths confirmed by the fix commit. +- Benign: fixed pin as fixed-side control; proposed benign change `3989964ac1cb` "fix: Stuck unsaved changes for untouched fields (#8355)" (80 lines, config/fields/object.php, config/fields/toggle.php, src/Form/Field.php…); on the default branch (5.x); the fixed pin is on the 4.x line. +- Caveats: only deployments whose index root has a sibling directory with the same name prefix; Kirby is under a proprietary licence (GitHub NOASSERTION); must be cleared before publishing. Confidence: medium. + +#### mineadmin-appstore-identifier-traversal (path; path traversal) +- Repo https://github.com/mineadmin/MineAdmin (Apache-2.0, 53 MB, languages PHP 99%). Lane A. Advisory CVE-2026-55224 / GHSA-59xm-4m8c-g3xj, published 2026-08-18; affected < 3.2.0-alpha.2; fixed 3.2.0-alpha.2. +- Sink: `BASE_PATH . '/plugin/' . $params['identifier']` in download()/install()/unInstall(), then `Plugin::install($params['identifier'])`. Source: `identifier` request parameter of the app-store plugin endpoints. Privilege: authenticated admin with app-store access (verify). +- Fix: Advisory links `ca41902a` 'fix(app-store): 修复app-store几处安全风险。 (#728)' (Service.php +81-9, IndexController.php +4-0). Ancestry: parent; the fixed commit is tag v3.2.0-alpha.2. +- Sites: file path and methods quoted by the advisory. +- Benign: fixed pin as fixed-side control; proposed benign change `c2f97b772c10` "feat(install): 添加前端项目下载与依赖安装功能 (#735)" (193 lines, app/Command/InstallCommand.php). +- Caveats: Hyperf framework (not Laravel/Symfony). Confidence: high. + +#### facturascripts-uploadedfile-move-traversal (path; path traversal (arbitrary file write)) +- Repo https://github.com/NeoRazorX/facturascripts (LGPL-3.0, 60 MB, languages PHP 90%, Twig 9%). Lane A. Advisory GHSA-hgjx-r89m-m7v4, published 2026-07-14; affected >= 2025, <= 2026.2; fixed not stated. +- Sink: `UploadedFile::move($destiny, $destinyName)` concatenates the client filename into `move_uploaded_file()`. Source: `getClientOriginalName()` of an uploaded file. Privilege: authenticated user. +- Fix: The advisory links no commit and states no patched version. File history of Core/UploadedFile.php has `d3770be6` 'Fix uploaded file path traversal' (2026-05-19; UploadedFile.php +38-4 plus tests). Inferred, not confirmed by the advisory. Ancestry: parent. +- Sites: file and method quoted by the advisory. +- Benign: fixed pin as fixed-side control; proposed benign change `add96d2bbee5` "test: add API smoke test" (192 lines, Test/Core/Controller/ApiSmokeTest.php); tests-only change. +- Caveats: fix commit inferred from file history; the advisory's affected range ends at 2026.2 while the inferred fix is dated 2026-05-19 -- confirm at freeze that the fixed pin is really unaffected. Confidence: medium. + +#### wp-geo-my-wp-info-window-lfi (path; local file inclusion) +- Repo https://github.com/Fitoussi/geo-my-wp (GitHub: none [verify], 9 MB, languages PHP 47%, JavaScript 44%, CSS 9%). Lane B. Advisory CVE-2026-85200 / GHSA-6hw9-7gx5-mw88, published 2026-09-12; affected <= 4.5.5.3; fixed 4.5.5.4. +- Sink: include of a file chosen through `gmw_posts_locator_ajax_info_window_loader`. Source: AJAX request parameters (unauthenticated). Privilege: unauthenticated. +- Fix: Advisory links `5a768bf1` 'Release 4.5.5.4' (5 files: includes/gmw-functions.php +93-6, the posts/members locator functions files, version bumps). A release commit, but small and on-topic. Ancestry: parent. +- Sites: function named by the advisory text; files from the advisory's own trac reference links (gmw-functions.php#L1945/L1987, gmw-posts-locator-functions.php#L964/L975); the function-to-file pairing is an assumption to confirm at freeze. +- Benign: fixed pin as fixed-side control; no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file). +- Caveats: WordPress plugin; GitHub shows no licence (plugin header GPL presumed, verify); release commit (small). Confidence: medium. + +#### elfinder-fsock-dns-rebinding-ssrf (untrusted_destination; SSRF (DNS rebinding guard bypass)) +- Repo https://github.com/Studio-42/elFinder (GitHub: NOASSERTION [verify], 43 MB, languages JavaScript 65%, PHP 29%). Lane A. Advisory CVE-2026-81889 / GHSA-8x3q-jpjh-qh5c, published 2026-08-31; affected <= 2.1.69; fixed 2.1.70. +- Sink: `fsock_get_contents()` fallback reconnects by hostname after the URL validation resolved it (TOCTOU). Source: URL submitted for server-side upload. Privilege: depends on the integrating connector. +- Fix: Advisory links `6d997386` 'Merge commit from fork' (php/elFinder.class.php +113-12, i18n) and the build commit `191372c1`. `6d997386` has a single parent `dd73e702` (the fix of the sibling ZIP-extraction advisory). Ancestry: parent; ancestor of tag 2.1.70-src (tag 2.1.70 is a build branch with no common history). +- Sites: function named by the advisory, file linked by the advisory. +- Benign: fixed pin as fixed-side control; no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file). +- Caveats: only when PHP lacks cURL; guard bypass (DNS rebinding); repository is 65% JavaScript; licence NOASSERTION on GitHub (verify). Confidence: medium. + +#### easyappointments-caldav-ssrf (untrusted_destination; SSRF) +- Repo https://github.com/alextselegidis/easyappointments (GPL-3.0, 49 MB, languages PHP 89%, JavaScript 9%). Lane A. Advisory CVE-2026-52840 / GHSA-pm5p-7w5h-jm5q, published 2026-07-29; affected <= 1.5.2; fixed 1.6.0. +- Sink: `$this->caldav_sync->test_connection($caldav_url, ...)` → Guzzle REPORT request. Source: `caldav_url` request parameter of Caldav::connect_to_server. Privilege: authenticated backend user (admin, provider or secretary). +- Fix: Advisory links four linear commits of 2026-05-26: `4abb1054` 'fix: harden caldav url validation against ssrf' (the validation), then `6b34b78c`, `2da2baed`, `6eb9336a` (opt-in private-host toggle and its relocation). The first carries the fix and is used as the fixed pin; `6eb9336a` is the end of the chain if the maintainer prefers it. Ancestry: parent of 4abb1054; ancestor of tag 1.6.0. +- Sites: controller path and method quoted by the advisory; the library path follows from `$this->caldav_sync` and the fix commit. +- Benign: fixed pin as fixed-side control; proposed benign change `1b51132026c7` "Minor translation change." (2 lines, application/language/german/translations_lang.php). +- Caveats: fix spread over four linear commits (v2 allowed up to three; the first commit alone is the fix). Confidence: high. + +#### koel-podcast-enclosure-ipv6-ssrf (untrusted_destination; SSRF (guard bypass via IPv6 transition addresses)) +- Repo https://github.com/koel/koel (MIT, 29 MB, languages PHP 55%, TypeScript 27%, Vue 18%). Lane A. Advisory CVE-2026-54494 / GHSA-rjg7-r26h-cfp2, published 2026-07-15; affected <= 9.7.0; fixed 9.7.1. +- Sink: `EpisodePlayable::createForEpisode()` → `Http::sink($file)->get($url)`, guarded only by `Network::isPublicHost()`. Source: `` of an attacker-hosted RSS feed subscribed by any user. Privilege: authenticated user. +- Fix: Advisory links `5f6ce2ce` 'fix: close remaining SSRF advisories (DNS rebinding, IPv6 transition, bail) (#2549)', 28 files; one commit that closes several SSRF advisories (same family). Ancestry: parent; ancestor of tag v9.7.1. +- Sites: app/Helpers/Network.php and isPublicHost quoted by the advisory; EpisodePlayable path from the class name `App\Values\Podcast\EpisodePlayable`. +- Benign: fixed pin as fixed-side control; proposed benign change `eafb61deaad0` "test: serve a real response to the radio stream connector (#2671)" (178 lines, tests/Integration/Services/Radio/RadioStreamConnectorTest.php, tests/Unit/Services/Radio/RadioStreamConnectorTest.php); tests-only change. +- Caveats: large multi-advisory fix commit (28 files), same family; exploitation needs NAT64/6to4 routing. Confidence: medium. + +#### pagible-admin-proxy-dns-rebinding-ssrf (untrusted_destination; SSRF (DNS rebinding guard bypass)) +- Repo https://github.com/aimeos/pagible (MIT, 73 MB, languages PHP 57%, JavaScript 16%, CSS 12%, Vue 11%). Lane A. Advisory CVE-2026-49262 / GHSA-mmj8-wcvw-6789, published 2026-06-26; affected < 0.10.4; fixed 0.10.4. +- Sink: `AdminController::proxy` → Guzzle request after `\Aimeos\Cms\Utils::isValidUrl($url)`. Source: `url` query parameter of `/cmsproxy`. Privilege: authenticated (proxy token). +- Fix: The advisory links no commit. The compare 0.10.3...0.10.4 has three commits; `09a8205d` 'Fixed SSRF via DNS rebinding in admin proxy' (admin/src/Controllers/AdminController.php +21-7, core/src/Utils.php +22-4). Ancestry: parent; ancestor of tag 0.10.4. +- Sites: class::method names quoted by the advisory; paths from the fix commit. +- Benign: fixed pin as fixed-side control; proposed benign change `bc5a10a515bd` "Fixed admin test" (2 lines, admin/tests/AdminControllerTest.php); tests-only change. +- Caveats: guard bypass (DNS rebinding). Confidence: medium. + +#### wp-graphql-updatepost-publish-bypass (access_control; missing object-level capability check) +- Repo https://github.com/wp-graphql/wp-graphql (GPL-3.0, 120 MB, languages PHP 68%, JavaScript 26%). Lane A. Advisory CVE-2026-88974 / GHSA-5mmc-8pc9-wggg, published 2026-09-23; affected < 2.22.2 (confirmed 2.19.0); fixed 2.22.2. +- Sink: `updatePost` mutation checks only `$post_type_object->cap->edit_posts`. Source: GraphQL `updatePost` mutation input (status PUBLISH, published post id). Privilege: Contributor. +- Fix: Advisory links `55441663` (PR #4270) whose subject is 'do not invoke bare callable-string field definitions in Model'; it also changes plugins/wp-graphql/src/Mutation/PostObjectUpdate.php (+27-0) -- two fixes in one commit. Ancestry: parent; ancestor of tag wp-graphql/v2.22.2. +- Sites: the advisory names src/Mutation/PostObjectUpdate.php; the repository is a monorepo (plugins/wp-graphql/ prefix from the fix commit); no function named. +- Benign: fixed pin as fixed-side control; no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file). +- Caveats: fix commit also carries an unrelated Model.php change; function-level site to resolve at freeze. Confidence: medium. + +#### sylius-mollie-thankyou-order-idor (access_control; IDOR (missing ownership check)) +- Repo https://github.com/Sylius/MolliePlugin (MIT, 9 MB, languages PHP 90%). Lane A. Advisory CVE-2026-68501 / GHSA-x83g-979r-f5fh, published 2026-07-31; affected < 2.2.8; 3.0.0-3.2.3; 3.3.0; fixed 2.2.8 / 3.2.4 / 3.3.1. +- Sink: `findOneBy(['id' => $orderId])` without ownership/session check, returning the order token (302 Location) and QR code. Source: `orderId` of GET /{_locale}/thank-you and /{_locale}/get-code. Privilege: unauthenticated. +- Fix: Advisory links three merge commits (one per branch). `01316b3a` (PR #354, 3.3 line) is used: PageRedirectController.php +17-6, QrCodeAction.php +9-11, PaymentWebhookController.php (the sibling webhook advisory GHSA-rc52-c4hv-w89p). Ancestry: first parent of a merge; ancestor of tag v3.3.1. +- Sites: Class::method names quoted by the advisory; paths from the fix commit. +- Benign: fixed pin as fixed-side control; proposed benign change `ad215c9c0fc3` "Refactor `PaymentMethodLogoUploader` to use `FilesystemAdapterInterface` instead of `Gaufrette\Filesystem`." (15 lines, config/services/uploader.xml, src/Uploader/PaymentMethodLogoUploader.php). +- Caveats: merge commit; one fix covers two advisories (webhook forgery GHSA-rc52 is the other). Confidence: high. + +#### paymenter-checkout-config-override (access_control; unvalidated URL-writable properties override provisioning parameters) +- Repo https://github.com/Paymenter/Paymenter (MIT, 15 MB, languages PHP 87%, Blade 12%). Lane A. Advisory CVE-2026-47198 / GHSA-5q4q-834j-g8g4, published 2026-06-30; affected < 1.5.1; fixed 1.5.1. +- Sink: `$checkoutConfig` (`#[Url]`, alias `config`) keys stored by Cart.php into service properties, later passed to createServer(). Source: `config[...]` query parameters of the checkout page. Privilege: authenticated customer. +- Fix: The advisory links no commit. The compare v1.5.0...v1.5.1 has 17 commits; `75719ae4` 'Merge commit from fork' changes only app/Livewire/Products/Checkout.php (+7-1). Ancestry: parent; ancestor of tag v1.5.1. +- Sites: file paths quoted by the advisory; no function named. +- Benign: fixed pin as fixed-side control; proposed benign change `e60567981acf` "fix: reCAPTCHA v3 not working after Livewire navigation" (24 lines, themes/default/views/components/captcha/recaptcha-v3.blade.php); review: subject mentions reCAPTCHA (anti-abuse). +- Caveats: mass-assignment shape (CWE-20/639); classed access_control by its CWE; fix commit inferred from the release compare. Confidence: medium. + +#### wp-buddypress-messages-rest-idor (access_control; IDOR in REST permission callback) +- Repo https://github.com/buddypress/buddypress (GitHub: none [verify], 79 MB, languages PHP 76%, CSS 14%, SCSS 6%). Lane A. Advisory CVE-2026-53673 / GHSA-j3j5-5m8v-7gvc, published 2026-06-10; affected < 14.5.0 (confirmed 14.4.0); fixed 14.5.0. +- Sink: `get_item_permissions_check` validates the supplied user_id instead of the logged-in user; reused by update/delete. Source: `user_id` parameter of the messages REST API. Privilege: authenticated (any user). +- Fix: Advisory links `27d41e97` 'Improve security of messages endpoint.' (class-bp-messages-rest-controller.php +113-42, tests). The commit is dated 2026-07-07, after the advisory; confirm at freeze that the release carrying it is 14.5.0. Ancestry: parent. +- Sites: method named by the advisory; file path from the fix commit. +- Benign: fixed pin as fixed-side control; proposed benign change `ea5cb85f4d8a` "PHPDoc: Improve parameter descriptions." (132 lines, src/bp-activity/bp-activity-embeds.php, src/bp-activity/bp-activity-filters.php, src/bp-activity/bp-activity-functions.php…). +- Caveats: the GitHub repository is the project's own mirror of its development SVN; no GitHub licence metadata (GPL-2.0+ per project, verify). Confidence: medium. + +#### sharp-editor-iframe-srcdoc-xss (output_encoding; stored XSS (sanitizer allow-list)) +- Repo https://github.com/code16/sharp (MIT, 109 MB, languages PHP 66%, Vue 23%, TypeScript 9%). Lane A. Advisory CVE-2026-61823 / GHSA-qxg3-46rw-79j8, published 2026-09-25; affected < 9.22.5; fixed 9.22.5. +- Sink: Symfony HtmlSanitizer config allows the iframe `srcdoc` attribute; the value is rendered as live HTML. Source: Editor field content saved by a user with edit permission. Privilege: authenticated editor. +- Fix: Advisory links `ec509a22` 'Improve sanitization' (src/Utils/Sanitization/FormatsSanitizedValue.php +4-2, test). The same commit fixes the sibling GHSA-vj3q-vp3g-j9c8. Ancestry: parent; ancestor of tag v9.22.5. +- Sites: file path quoted by the advisory; no function named. sink_evidence `srcdoc`. +- Benign: fixed pin as fixed-side control; proposed benign change `7c601fffe930` "Update version to v9.22.5" (2 lines, src/SharpInternalServiceProvider.php). +- Caveats: the flaw is a sanitizer allow-list entry, not a missing escape call. Confidence: medium. + +#### privatebin-jsonld-request-uri-injection (output_encoding; reflected JSON injection (CWE-116)) +- Repo https://github.com/PrivateBin/PrivateBin (GitHub: NOASSERTION [verify], 16 MB, languages PHP 46%, JavaScript 38%, CSS 16%). Lane A. Advisory CVE-2026-55891 / GHSA-xrjc-c68j-hp7w, published 2026-08-28; affected <= 2.0.4; fixed 2.0.5. +- Sink: `Controller::_jsonld()` splices `$_urlBase` into a .jsonld template with `str_replace()`. Source: `$_SERVER['REQUEST_URI']` via `Request::getRequestUri()` (FILTER_SANITIZE_URL keeps quotes and angle brackets). Privilege: unauthenticated. +- Fix: Advisory links `75f056dc` 'Merge commit from fork' (first-parent diff: lib/Request.php +2-2, lib/Configuration.php, CHANGELOG, test). Its first parent `e0dd4c02` is the fix of the sibling attachment-XSS advisory GHSA-f2xf-7x3g-4272. Ancestry: first parent of a merge; ancestor of tag 2.0.5. +- Sites: Class::method names quoted by the advisory; paths lib/*.php from the fix commit. +- Benign: fixed pin as fixed-side control; proposed benign change `48ae4ed5d3d4` "fix: quote administration storage path" (54 lines, bin/administration, tst/AdministrationEmptyDirsTest.php); review: 'quote administration storage path' may be a shell-quoting fix. +- Caveats: the fix changes Request.php only; Controller::_jsonld is a declared site outside the diff; response type is JSON-LD, not HTML; licence NOASSERTION on GitHub (zlib-style per project, verify). Confidence: high. + +#### openstamanager-group-name-html-injection (output_encoding; stored HTML injection) +- Repo https://github.com/devcode-it/openstamanager (GPL-3.0, 43 MB, languages PHP 80%, JavaScript 17%). Lane A. Advisory CVE-2026-44701 / GHSA-crx4-7mmq-j74j, published 2026-08-26; affected <= 2.10.1; fixed 2.11-beta. +- Sink: `''.$group->getTranslation('title').''` in modules/utenti/edit.php. Source: group name saved when creating a user group. Privilege: authenticated user able to create groups. +- Fix: Advisory links `0b88ad19` 'fix: HTML Injection in modules/utenti/edit.php' (edit.php +2-2, ajax/select.php, src/AJAX.php, src/Modules.php) and a broader input-filter refactor `7c9eafe9`. The first is used. Ancestry: parent; ancestor of tag v2.11-beta. +- Sites: file and code quoted by the advisory. sink_evidence `$group->getTranslation('title')`. +- Benign: fixed pin as fixed-side control; proposed benign change `570eff68c504` "fix: definizione variabile" (2 lines, modules/fatture/src/Gestori/Scadenze.php). +- Caveats: second advisory commit (7c9eafe9, global GET/POST filtering) is not in the pinned pair. Confidence: high. + +#### symfony-ux-live-child-tag-xss (output_encoding; XSS (unescaped tag name)) +- Repo https://github.com/symfony/ux (MIT, 59 MB, languages PHP 61%, TypeScript 22%, JavaScript 10%, Twig 7%). Lane A. Advisory CVE-2026-49210 / GHSA-38x5-rcv4-xf7x, published 2026-06-19; affected ux-live-component >= 2.8.0, < 2.36.0; >= 3.0.0, < 3.1.0; fixed 2.36.0 / 3.1.0. +- Sink: `ChildComponentPartialRenderer::createHtml()` interpolates `$childTag` into HTML. Source: client JSON `children[id].tag` parsed by `LiveComponentSubscriber` and passed through `InterceptChildComponentRenderSubscriber`. Privilege: unauthenticated (Accept header gate; CORS or same-origin needed). +- Fix: Advisory links `fbc5e9a1` '[LiveComponent] Reject malicious child component tags' (ChildComponentPartialRenderer.php +7-0, test). Ancestry: parent; ancestor of tag v2.36.0. +- Sites: FQCN::method quoted by the advisory; monorepo path from the fix commit. +- Benign: fixed pin as fixed-side control; no API proposal passed the freeze.py filter within 60 commits after the fix; let freeze.py propose one from the clone, or pick by hand (a small non-security PHP change on the default branch that does not touch the sink file). +- Caveats: the advisory calls it primarily defense in depth (custom Accept header cannot be sent cross-origin without preflight); component framework in a monorepo (UX packages). Confidence: medium. + +#### wp-podlove-generation-guard-poi (deserialization; PHP object injection → arbitrary file deletion (in-plugin POP chain)) +- Repo https://github.com/podlove/podlove-publisher (MIT, 33 MB, languages PHP 63%, JavaScript 18%, Vue 10%, TypeScript 6%). Lane C. Advisory CVE-2026-16099 / GHSA-q83h-6954-x259, published 2026-08-16; affected <= 4.5.3; fixed 4.5.4 (not stated in the advisory; first release after the fix). +- Sink: unserialize() of model data (lib/model/base.php#L552) instantiating `Podlove\ImageCache\GenerationGuard`, whose `__destruct()` calls `wp_delete_file()`. Source: shownotes REST input handled by `create_link_item` (contributor+). Privilege: Contributor. +- Fix: The advisory links wp.org trac only. The GitHub history of the referenced files has three consecutive commits of 2026-07-26: `d49c4d7f` 'fix: constrain image lock deletion' (generation_guard.php), `b59d7962` 'fix: harden shownotes REST input' (rest_api.php +173-20), `ea878175` 'fix: limit model unserialization' (lib/model/base.php). The pair spans all three (vulnerable = parent of d49c4d7f). Ancestry: linear chain of 3 commits (4eedbd66 → d49c4d7f → b59d7962 → ea878175); ancestor of tag 4.5.4. +- Sites: create_link_item and GenerationGuard::__destruct named by the advisory; files from the advisory's own trac reference links. +- Benign: fixed pin as fixed-side control; proposed benign change `50da8db0f5a8` "fix PHP warning" (2 lines, lib/modules/contributors/contributor_list_table.php). +- Caveats: fix inferred from file history (three commits); the advisory text describes the impact (file deletion) under CWE-502. Confidence: medium. + +#### wp-admin-columns-ids-to-collection-poi (deserialization; PHP object injection (bundled POP chain)) +- Repo https://github.com/codepress/admin-columns (GPL-3.0, 37 MB, languages PHP 69%, Svelte 10%, SCSS 7%, JavaScript 6%, TypeScript 6%). Lane C. Advisory CVE-2026-7654 / GHSA-h6x4-229g-5f43, published 2026-06-06; affected <= 7.0.18; fixed 7.0.19 (not stated; first release after the fix). +- Sink: `unserialize()` without `allowed_classes` in `IdsToCollection::get_ids_from_string()`. Source: post meta values set by a Contributor. Privilege: Contributor. +- Fix: The advisory links wp.org trac only. The compare 7.0.18...7.0.19 has one commit touching the named file: `c64e9aae` 'Update IdsToCollection.php' (+1-1). An identical change `25e276e0` sits on the 7.1 development line. Inferred; the commit message does not say what changed. Ancestry: parent; ancestor of tag 7.0.19. +- Sites: Class::method named by the advisory; files from its trac reference links. sink_evidence `unserialize(`. +- Benign: fixed pin as fixed-side control; proposed benign change `e998321863c4` "Todo ans PHP code fixer" (40 lines, classes/ColumnCollection.php, classes/DI/Container.php, classes/Exception/IteratorException.php…). +- Caveats: fix inferred (one-line change, uninformative message) -- confirm at freeze that it adds allowed_classes. Confidence: medium. + +## Recommended balanced selection (16) + +**Rule** (applied mechanically to the 26, never by how easy a case looks): per-family targets injection 5, output_encoding 3, path 3, untrusted_destination 2, access_control 2, deserialization 1. Within a family, candidates whose fix commit the advisory names come first, then newest first by publication; take the first *n*. The WordPress cap is checked afterwards, not used to choose. + +- **injection** (5): **gitlist-commandline-cmdi** (2026-08-31), **qloapps-customermessage-bo-query-sqli** (2026-08-25), **roundcube-markasjunk-cmd-learn-rce** (2026-08-17), **winter-filter-numberrange-sqli** (2026-08-12), **maccms10-template-blacklist-rce** (2026-08-05), mantisbt-tokenizer-eval-rce (2026-07-15), grav-blueprint-bare-function-rce (2026-09-17, fix inferred), backpack-stats-host-header-cmdi (2026-08-20, fix inferred) +- **output_encoding** (3): **sharp-editor-iframe-srcdoc-xss** (2026-09-25), **privatebin-jsonld-request-uri-injection** (2026-08-28), **openstamanager-group-name-html-injection** (2026-08-26), symfony-ux-live-child-tag-xss (2026-06-19) +- **path** (3): **wp-geo-my-wp-info-window-lfi** (2026-09-12), **kirby-realpath-sibling-traversal** (2026-09-02), **mineadmin-appstore-identifier-traversal** (2026-08-18), facturascripts-uploadedfile-move-traversal (2026-07-14, fix inferred) +- **untrusted_destination** (2): **elfinder-fsock-dns-rebinding-ssrf** (2026-08-31), **easyappointments-caldav-ssrf** (2026-07-29), koel-podcast-enclosure-ipv6-ssrf (2026-07-15), pagible-admin-proxy-dns-rebinding-ssrf (2026-06-26, fix inferred) +- **access_control** (2): **wp-graphql-updatepost-publish-bypass** (2026-09-23), **sylius-mollie-thankyou-order-idor** (2026-07-31), wp-buddypress-messages-rest-idor (2026-06-10), paymenter-checkout-config-override (2026-06-30, fix inferred) +- **deserialization** (1): **wp-podlove-generation-guard-poi** (2026-08-16, fix inferred), wp-admin-columns-ids-to-collection-poi (2026-06-06, fix inferred) + +Selected (bold above): winter-filter-numberrange-sqli, gitlist-commandline-cmdi, qloapps-customermessage-bo-query-sqli, roundcube-markasjunk-cmd-learn-rce, maccms10-template-blacklist-rce, kirby-realpath-sibling-traversal, mineadmin-appstore-identifier-traversal, wp-geo-my-wp-info-window-lfi, elfinder-fsock-dns-rebinding-ssrf, easyappointments-caldav-ssrf, wp-graphql-updatepost-publish-bypass, sylius-mollie-thankyou-order-idor, sharp-editor-iframe-srcdoc-xss, privatebin-jsonld-request-uri-injection, openstamanager-group-name-html-injection, wp-podlove-generation-guard-poi. +Mix: injection 5 (31%; SQL 2, OS command 2, code 1), output_encoding 3, path 3, untrusted_destination 2, access_control 2, deserialization 1; WordPress 3 of 16. Benign controls: the fixed pin for every case; a proposed benign change exists for 12 of 16 (gitlist, geo-my-wp, elfinder and wp-graphql need one chosen at freeze). + +The deserialization pick has an inferred fix (both deserialization candidates do); it is the only family where the named-fix rule could not be met. + +## Open decisions for the maintainer + +- **Protocol coverage.** Protocol v2 scores only `injection`, `untrusted_destination` and `config_secrets`. v3 as proposed also needs scoring rules for `path`, `output_encoding`, `access_control` and `deserialization` (including what counts as a match for an absence bug such as a missing check, and the output_encoding limits stated in families.toml). Decide the family set before the population is reserved; dropping families changes the selection rule's targets, not the candidates. +- **File-only sites.** Seven candidates have no advisory-named function (mantisbt, qloapps, roundcube, maccms10, wp-graphql, paymenter, sharp); several others name a second file without a function (`site_files`). Protocol v2 credits `path::function`; for these the function has to be resolved at freeze by reading the file, or the protocol must credit a file-level site. Where the advisory quotes code, `sink_evidence` carries it for freeze.py. +- **Sites derived from class names.** Several advisories name `Class::method` but not the file; the path follows from PSR-4 or the plugin layout and is confirmed only by the fix commit's file list (marked in `site_derivation`). +- **Licences to clear before publishing:** Kirby (proprietary Kirby licence, not OSI), MacCMS10 (no licence metadata), elFinder and PrivateBin (NOASSERTION; project files state BSD-3 and zlib-style respectively, verify), MantisBT, BuddyPress and GEO my WP (no GitHub licence metadata; GPL per project, verify). +- **Inferred fixes:** grav, backpack, pagible and paymenter come from release compares with a single on-topic commit; facturascripts, podlove and admin-columns from file history (admin-columns' commit message is only 'Update IdsToCollection.php'). Freeze must confirm each diff changes the sink as the advisory describes. +- **Multi-advisory fixes:** koel (28 files, several SSRF advisories), sylius mollie (merge also fixes the webhook advisory), sharp, privatebin, qloapps and wp-graphql (commit also changes Model.php). +- **Non-default configuration required:** winter (plugin-registered scope), roundcube (markasjunk cmd_learn), elfinder (no cURL), kirby (sibling directory), backpack (exec/curl and Host passthrough), symfony-ux (CORS or same-origin). +- **Branch pins:** kirby uses the 4.x-line fix (the 5.x fix also carries another advisory); roundcube uses the 1.6-line fix; sylius mollie uses the 3.3-line merge. Benign proposals come from the default branch, which may not contain these pins. +- **Prior mention.** `research-2026-09-26.md` lists some of these advisory ids by name in its 'passed over without examination' note (Grav, elFinder, Backpack CRUD, Winter, Easy!Appointments, Koel). They were never examined and their URLs are not in the tree, so they pass the exclusion rule; the maintainer may still prefer to drop them. +- **Alternates** if a candidate fails at freeze (first in line for its family, newest first): injection — Krayin CRM leads DataGrid SQLi (GHSA-8879-fh4f-q3qm), FrontAccounting SQLi ×3 (GHSA-w5j4-x499-pfwp …), LMS SQLi/command injection (GHSA-qrw9-xj5g-qxw8, GHSA-765c-7qf8-cw9w), Dockwatch command injection (GHSA-cgfv-42v7-7f53), MantisBT history_order SQLi (GHSA-mw6p-33vw-46cc, same repository as the MantisBT candidate); path — GEOFlow ImageLibraryController (GHSA-gf7h-mv4h-gg7c), rConfig download_export (GHSA-qrrp-6pvj-xfvf); untrusted_destination — CakePHP Authentication open redirect (GHSA-hhpq-7wg4-36jm), Koillection SSRF (GHSA-gmxh-hjfv-qc2w), Cotonti open redirects (GHSA-g8jm-3grw-8wh2 …); deserialization — Cypht logout back_query (GHSA-46j6-w3hw-4r9x; fix `e4aa2f34` known, but the advisory names no file or function). None of the alternates was fully verified. + +## What constrained the search + +- **Deserialization is nearly absent with a usable fix.** Lane A had one eligible record (October CMS, whose public repository only receives bulk 'Sync upstream' commits). Lanes B and C yielded two, both WordPress, both with fixes inferred from file history; most WordPress object-injection records name no function or have no development repository. +- **SQL injection with a fix diff is scarce outside excluded or oversized repositories.** Most 2026 PHP SQLi advisories are on repositories already used (phpMyFAQ, YesWiki, froxlor, pimcore studio), over the size cap (Pimcore, TYPO3, Mautic, LimeSurvey, CodeIgniter4, Dolibarr, LibreNMS), in framework query builders (CakePHP), or in WordPress plugins with no GitHub repository. Only two SQLi candidates qualified in quota order; more exist as alternates. +- **The size cap is the largest single filter** (161 rejections): Craft CMS, Snipe-IT (32 advisories), TYPO3, Pimcore, Shopware, Sylius core, Mautic, Filament, AVideo, LibreNMS, MISP, Dolibarr, OpenEMR, ILIAS, Joomla. +- **Naming the site.** 46 advisories name no file or function (Statamic, Silverstripe and most WordPress records). +- **Kimai** shipped the fixes for nine of this window's advisories inside one 'Release 2.58' squash, which removes a whole application from the pool. + +## Rejection log + +One line per examined advisory, newest first within each lane. `taken` rows name the candidate. Automatic exclusions by metadata are listed first within lane A. + +### Lane A: reviewed composer advisories + +- GHSA-r6hr-vr92-vv28 / CVE-2026-65954 (phpcsstandards/phpcsutils, injection, 2026-09-29): developer tool / CLI, not a web application. _PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualAr_ +- GHSA-jh5r-qr3c-85q8 / CVE-2026-102279 (laravel/framework, output_encoding, 2026-09-29): DOM XSS in the debug page's JavaScript tooltip (Tippy `allowHTML`); the sink is client-side JavaScript, and the advisory names no PHP file or function. _Laravel: XSS in Debug Page Information_ +- GHSA-v65j-hff3-753c / CVE-2026-57440 (starcitizenwiki/mediawiki-extensions-embedvideo, output_encoding, 2026-09-25): excluded by name. _Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequ_ +- GHSA-qxg3-46rw-79j8 / CVE-2026-61823 (code16/sharp, output_encoding, 2026-09-25): **taken** as sharp-editor-iframe-srcdoc-xss. _code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute_ +- GHSA-vj3q-vp3g-j9c8 / CVE-2026-61825 (code16/sharp, output_encoding, 2026-09-25): one case per repository (repository taken as sharp-editor-iframe-srcdoc-xss). _code16/sharp has a stored XSS via data-html-content Sanitizer Bypass_ +- GHSA-87mg-5grr-rhwh / CVE-2026-57232 (contao/contao, untrusted_destination, 2026-09-24): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Mod_ +- GHSA-rw77-vq4g-x3hp / CVE-2026-56738 (thorsten/phpmyfaq, injection, 2026-09-24): repo in used list (already referenced under benchmarks/src/tests/.kiro). _phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion_ +- GHSA-pgwp-vc7q-cvj3 / CVE-2026-56736 (thorsten/phpmyfaq, output_encoding, 2026-09-24): repo in used list (already referenced under benchmarks/src/tests/.kiro). _phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submiss_ +- GHSA-396x-xmvh-p563 / CVE-2026-63498 (grokability/snipe-it, output_encoding, 2026-09-24): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API_ +- GHSA-p9h3-gvpq-5539 / CVE-2026-62368 (grokability/snipe-it, output_encoding, 2026-09-24): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT: Stored XSS via Custom Field name in asset-list column headers_ +- GHSA-9rg8-2wvr-fgjh / CVE-2026-76089 (verbb/formie, access_control, 2026-09-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Formie: Missing authorization on sent notification resend modal exposes submission PII_ +- GHSA-584p-f93j-wpgc / CVE-2026-76087 (verbb/formie, access_control, 2026-09-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Formie: Unauthenticated users can overwrite incomplete submissions via submit action_ +- GHSA-v3f3-cmj4-cvj9 / CVE-2026-76086 (verbb/formie, access_control/untrusted_destination, 2026-09-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Formie: Integration form-settings action allows SSRF and exfiltration of stored integratio_ +- GHSA-jg26-q8hg-3pq4 / CVE-2026-92692 (sulu/sulu, injection, 2026-09-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)_ +- GHSA-gxrg-x694-283w / CVE-2026-73858 (solspace/craft-freeform, injection, 2026-09-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Solspace Freeform: Limited Twig template injection via submitted field values_ +- GHSA-w998-qmw9-mf4m / CVE-2026-63002 (redaxo/core, output_encoding, 2026-09-23): repo over ~150 MB (500 MB per GitHub API). _REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames_ +- GHSA-mf2p-wjp4-99pq / CVE-2026-63001 (redaxo/core, output_encoding, 2026-09-23): repo over ~150 MB (500 MB per GitHub API). _REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`_ +- GHSA-5mmc-8pc9-wggg / CVE-2026-88974 (wp-graphql/wp-graphql, access_control, 2026-09-23): **taken** as wp-graphql-updatepost-publish-bypass. _WPGraphQL: Contributor can publish and modify posts without the required capabilities via _ +- GHSA-jr78-w6w5-m8f8 (semanticmediawiki/semanticmediawiki, access_control, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticate_ +- GHSA-9rcc-pmj8-ffhr (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (resi_ +- GHSA-cx86-7xwp-w9wf / CVE-2026-77616 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor paginati_ +- GHSA-q5fm-9mx6-44f4 / CVE-2026-77610 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)_ +- GHSA-hw3m-8j5x-94ff / CVE-2026-77609 (semanticmediawiki/semanticmediawiki, untrusted_destination, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Semantic MediaWiki has an open redirect in Special:URIResolver_ +- GHSA-7xv3-gf2g-498h / CVE-2026-77607 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS_ +- GHSA-59xw-qv23-j3rc / CVE-2026-77608 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value`_ +- GHSA-3jp5-3h47-28qf / CVE-2026-77606 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Semantic MediaWiki has reflected XSS in Special:Ask plain table headers_ +- GHSA-hg8h-557g-q8pp / CVE-2025-61682 (semanticmediawiki/semanticmediawiki, output_encoding, 2026-09-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reser_ +- GHSA-g4c3-4g96-6g4m / CVE-2026-45140 (chamilo/chamilo-lms, injection/path, 2026-09-17): repo over ~150 MB (1625 MB per GitHub API). _Chamilo LMS CStudio upload flow allows unauthenticated remote code execution_ +- GHSA-r94f-hx44-8jqf / CVE-2026-72819 (getgrav/grav, injection, 2026-09-17): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text) (only the attacker's `shell.php`). _Grav CMS vulnerable to remote code execution via .zip file upload_ +- GHSA-xhfv-7758-r9hx / CVE-2026-75837 (getgrav/grav, access_control, 2026-09-17): the fix changes only a YAML blueprint (`system/blueprints/user/group.yaml`); no PHP line changes, so the fixed pin cannot be told apart in PHP. _Grav: Missing admin.super guard on core group blueprint access field allows admin.users op_ +- GHSA-q2j8-x8hf-63ch / CVE-2026-75834 (getgrav/grav, output_encoding, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing th_ +- GHSA-f8wv-xp27-6gq7 / CVE-2026-75827 (getgrav/grav, injection, 2026-09-17): **taken** as grav-blueprint-bare-function-rce. _Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, g_ +- GHSA-vfmf-q6x9-cw96 / CVE-2026-75828 (getgrav/grav, output_encoding, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted_ +- GHSA-4v9q-p283-qc2m / CVE-2026-74907 (getgrav/grav, path, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset_ +- GHSA-jq29-c7v8-rg55 / CVE-2026-72695 (getgrav/grav, path, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion_ +- GHSA-vjqc-q4mp-2rvf / CVE-2026-79752 (cakephp/cakephp, injection, 2026-09-17): framework query-builder API (`FunctionsBuilder`); vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository. _CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection_ +- GHSA-47ch-6w46-6xm7 / CVE-2026-72697 (getgrav/grav, path, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: media_directory() Twig function allows filesystem path traversal and file content di_ +- GHSA-6qw9-4vv5-jr97 / CVE-2026-75831 (getgrav/grav, output_encoding, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Stored XSS via Markdown audio/video media URL_ +- GHSA-269c-h76q-8cxw / CVE-2026-72832 (getgrav/grav, output_encoding, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Stored XSS via quoted-attribute bypass in detectXss_ +- GHSA-w3f4-8pj2-599w / CVE-2026-69089 (getgrav/grav, path, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-_ +- GHSA-7pgq-cr25-xvc8 / CVE-2026-69088 (getgrav/grav, injection, 2026-09-17): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static m_ +- GHSA-ffmg-hfvg-jhg9 / CVE-2026-58657 (getgrav/grav, output_encoding, 2026-09-16): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitize_ +- GHSA-2c4f-86xc-cr74 / CVE-2026-61453 (getgrav/grav, injection/output_encoding, 2026-09-16): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: XSS Blueprint Validation Bypass via Twig String Concatenation_ +- GHSA-2ff2-mx52-q8wp / CVE-2026-49400 (octobercms/october, deserialization, 2026-09-14): no fix diff in the public repository: `modules/backend/traits/SessionMaker.php` last changed in a bulk 'Sync upstream (4.2)' commit (2026-05-20), and there is no v4.2.23 tag. _October CMS: PHP Object Injection via Backend Widget Session Storage_ +- GHSA-xv9m-fm3w-8w5x / CVE-2026-46696 (octobercms/october, access_control, 2026-09-14): no fix diff in the public repository (same bulk 'Sync upstream' history, no v4.2.23 tag); advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text). _October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls_ +- GHSA-2cg9-97gq-9mqp / CVE-2026-56825 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). _Shopper: Missing authorization on product removal actions in CollectionProducts component_ +- GHSA-99h5-jhh7-v3r3 / CVE-2026-56830 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). _Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9_ +- GHSA-g3f9-g5vj-p62f / CVE-2026-56829 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). _Shopper: Unauthorized inventory stock manipulation via unlocked variant property in Varian_ +- GHSA-j328-xmgp-j4q3 / CVE-2026-56828 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). _Shopper: privilege escalation via improper Livewire admin component authorization_ +- GHSA-f7h9-qv4x-9x57 / CVE-2026-56826 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). _Shopping privilege escalation through missing authorization in Settings components_ +- GHSA-243p-f3cv-c5wh / CVE-2026-56827 (shopperlabs/shopper, access_control, 2026-09-11): repo over ~150 MB (151 MB per GitHub API). _Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-de_ +- GHSA-23rh-xw42-fq82 / CVE-2026-55416 (pimcore/pimcore, injection, 2026-09-10): repo over ~150 MB (534 MB per GitHub API). _Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration_ +- GHSA-65fr-j4p9-vc33 / CVE-2026-81525 (mongodb/mongo-php-library, injection, 2026-09-08): general-purpose library: the attacker source lies in the calling application, not in the repo. _mongodb: Reject "." and NUL bytes in database and collection names_ +- GHSA-rvx4-ffvw-m9q3 / CVE-2026-84361 (composer/composer, injection, 2026-09-08): developer tool / CLI, not a web application. _Composer arbitrary command execution via a malicious package's Perforce source URL_ +- GHSA-c7r6-vx3h-w5g2 / CVE-2026-84374 (spartnernl/laravel-excel, path, 2026-09-08): general-purpose library: the attacker source lies in the calling application, not in the repo. _Laravel Excel writes exports outside the configured filesystem disk when given a caller-co_ +- GHSA-fxf7-vhh8-7vpq / CVE-2026-77635 (cakephp/cakephp, injection, 2026-09-08): framework query-builder API (`FunctionsBuilder::jsonValue()`); vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository. _CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver_ +- GHSA-pp4x-ccxq-6r33 / CVE-2026-82396 (sulu/sulu, output_encoding, 2026-09-02): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Sulu: Stored XSS via media download inline-disposition override_ +- GHSA-65cv-w493-7vhq / CVE-2026-82394 (sulu/sulu, access_control, 2026-09-02): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Sulu: Fix authorization bypass when creating preview links_ +- GHSA-h6cx-gjxx-v25c / CVE-2026-82395 (sulu/sulu, access_control, 2026-09-02): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Sulu: Media move/update authorization bypass (IDOR)_ +- GHSA-6j4c-mgqr-qv76 / CVE-2026-75592 (getkirby/kirby, path, 2026-09-02): **taken** as kirby-realpath-sibling-traversal. _Kirby: Access to image files outside of the site root via path traversal in the media hand_ +- GHSA-fj2p-qj2f-74v5 / CVE-2026-64850 (getgrav/grav, injection, 2026-09-02): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()_ +- GHSA-g2fm-8hr4-j82h / CVE-2026-81892 (easycorp/easyadminbundle, access_control, 2026-09-02): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text) (only the public API `Action::linkToRoute()`; the dispatcher that swaps controllers is described, not named). _EasyAdmin custom-action dispatcher bypasses access_control on other routes_ +- GHSA-g3hc-697w-wm82 / CVE-2026-81887 (livewire/livewire, output_encoding, 2026-09-02): DOM-based XSS in Livewire's client-side JavaScript; not a PHP sink. _Livewire DOM-based cross-site scripting during client-side state handling_ +- GHSA-f8fg-pg57-v4j8 (thephpleague/commonmark, output_encoding, 2026-09-01): general-purpose library: the attacker source lies in the calling application, not in the repo. _league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a_ +- GHSA-cq55-c7wv-pxmq / CVE-2026-62993 (smarty-php/smarty, untrusted_destination, 2026-09-01): general-purpose library: the attacker source lies in the calling application, not in the repo. _Smarty: SSRF via redirect bypass of trusted_uri using {fetch}_ +- GHSA-67mx-6wf2-92xp / CVE-2026-71415 (getkirby/kirby, access_control, 2026-08-31): one case per repository (repository taken as kirby-realpath-sibling-traversal). _Kirby: File upload permissions are not checked during processing of chunk data_ +- GHSA-9vx2-j98c-p72w / CVE-2026-75594 (getkirby/kirby, path, 2026-08-31): one case per repository (repository taken as kirby-realpath-sibling-traversal). _Kirby: Access to image files and limited access to JSON files outside of the site root via_ +- GHSA-8x3q-jpjh-qh5c / CVE-2026-81889 (studio-42/elfinder, untrusted_destination, 2026-08-31): **taken** as elfinder-fsock-dns-rebinding-ssrf. _elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback_ +- GHSA-9x44-4gxf-8c25 / CVE-2026-55634 (pimcore/pimcore, injection, 2026-08-28): repo over ~150 MB (534 MB per GitHub API). _Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name_ +- GHSA-w23p-wrp7-ch38 / CVE-2026-55220 (pimcore/pimcore, deserialization, 2026-08-28): repo over ~150 MB (534 MB per GitHub API). _Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object_ +- GHSA-f97c-ph8j-8vff / CVE-2026-55212 (pimcore/pimcore, access_control, 2026-08-28): repo over ~150 MB (534 MB per GitHub API). _Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privil_ +- GHSA-79cw-hfcc-7mw9 / CVE-2026-55208 (pimcore/pimcore, injection, 2026-08-28): repo over ~150 MB (534 MB per GitHub API). _Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract _ +- GHSA-575r-357h-fhch / CVE-2026-55516 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update_ +- GHSA-35cr-9hqq-p2mg / CVE-2026-55515 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpo_ +- GHSA-w7qw-5wfv-gwx9 / CVE-2026-55481 (grokability/snipe-it, output_encoding, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT has CSS Injection via `header_color` Setting_ +- GHSA-8frh-vhgh-64cf / CVE-2026-55479 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT has incorrect permission for legacy license checkin API _ +- GHSA-crv3-j83j-f3r6 / CVE-2026-55478 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT has missing object-level authorization in Kits API_ +- GHSA-53jc-27pc-x8r8 / CVE-2026-55476 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_adm_ +- GHSA-5wx7-xq8j-v4qm / CVE-2026-55475 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT's import created_by can be overwritten_ +- GHSA-c6f4-wj38-m3g3 / CVE-2026-55474 (grokability/snipe-it, path, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT vulnerable to directory traversal in displaySig_ +- GHSA-8w8c-8mx9-52cw / CVE-2026-55472 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation_ +- GHSA-xr9m-gphc-9p63 / CVE-2026-55469 (grokability/snipe-it, path, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT has a path traversal vulnerability via CSV import `image` field_ +- GHSA-jhph-5q74-pmfx / CVE-2026-55466 (grokability/snipe-it, output_encoding, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT vulnerable to stored XSS via inline-served attachment_ +- GHSA-r52f-r9v5-66xr / CVE-2026-55464 (grokability/snipe-it, output_encoding, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT vulnerable to stored XSS via Markdown custom field _ +- GHSA-fc33-6w3q-538h / CVE-2026-55462 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT has an authorization bypass on print inventory page_ +- GHSA-wg2f-x2c2-c4rp / CVE-2026-55461 (grokability/snipe-it, untrusted_destination, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT has an Open Redirect After User Edit_ +- GHSA-vgx7-c78r-69w9 / CVE-2026-55460 (grokability/snipe-it, access_control, 2026-08-28): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT has an authorization bypass on bulk editing users_ +- GHSA-m4g4-86qc-v8w7 / CVE-2026-55779 (silverstripe/silverstripe-versioned, output_encoding, 2026-08-28): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text) (only the `ArchiveAdmin` screen; the fix is in `src/RestoreAction.php`). _silverstripe/versioned has XSS in archive admin restore_ +- GHSA-xrjc-c68j-hp7w / CVE-2026-55891 (privatebin/privatebin, output_encoding, 2026-08-28): **taken** as privatebin-jsonld-request-uri-injection. _PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI_ +- GHSA-f2xf-7x3g-4272 / CVE-2026-55696 (privatebin/privatebin, output_encoding, 2026-08-28): one case per repository (repository taken as privatebin-jsonld-request-uri-injection). _PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link_ +- GHSA-39mm-rwm3-29jp / CVE-2026-54718 (silverstripe/silverstripe-advancedworkflow, injection, 2026-08-27): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text); the fix only bumps a dependency in composer.json (the repair lives in another package). _silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow em_ +- GHSA-g8wr-r2v2-vqc6 / CVE-2026-54721 (silverstripe/silverstripe-userforms, injection, 2026-08-27): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text); the fix only bumps a dependency in composer.json (the repair lives in another package). _silverstripe/userforms vulnerable to remote code execution via userforms email subject_ +- GHSA-gvrw-qqp5-jgc5 / CVE-2026-54720 (silverstripe/silverstripe-framework, output_encoding, 2026-08-27): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text) ('Insert media from web'). _Silverstripe Framework: Possible XSS attack through media embed_ +- GHSA-7w8c-qgxg-m7jx (librenms/librenms, output_encoding, 2026-08-26): repo over ~150 MB (369 MB per GitHub API). _LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates_ +- GHSA-crx4-7mmq-j74j / CVE-2026-44701 (devcode-it/openstamanager, output_encoding, 2026-08-26): **taken** as openstamanager-group-name-html-injection. _OpenSTAManager has HTML Injection in modules/utenti/edit.php_ +- GHSA-mf8r-wm2w-f8c5 (thorsten/phpmyfaq, access_control, 2026-08-25): repo in used list (already referenced under benchmarks/src/tests/.kiro). _phpMyFAQ public FAQ APIs expose inactive FAQ content_ +- GHSA-88g4-74f3-63x9 (thorsten/phpmyfaq, path, 2026-08-25): repo in used list (already referenced under benchmarks/src/tests/.kiro). _phpMyFAQ has Potential Authenticated Path Traversal in PDF Export_ +- GHSA-896w-cw95-xq7w (, path, 2026-08-25): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrar_ +- GHSA-rj4c-4q9x-543x (, path, 2026-08-25): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: media_directory() Twig function allows filesystem path traversal_ +- GHSA-5h77-88j3-r659 / CVE-2026-63135 (yourls/yourls, output_encoding, 2026-08-21): repo over ~150 MB (489 MB per GitHub API). _YOURLS has stored XSS in referrer statistics chart via crafted Referer header_ +- GHSA-hrwp-4hh9-c8r8 / CVE-2026-59989 (phalcon/cphalcon, injection, 2026-08-21): repo over ~150 MB (273 MB per GitHub API). _Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)_ +- GHSA-8hgv-xc77-jmcr (getgrav/grav, output_encoding, 2026-08-21): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's _ +- GHSA-hq84-x37p-j6q5 (wintercms/winter, output_encoding, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). _Winter: Reflected XSS through the search query parameter in the backend Table widget_ +- GHSA-5cwr-5jxg-pcf6 (wintercms/winter, output_encoding, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). _Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles_ +- GHSA-fm29-4mq3-phg6 (wintercms/winter, access_control, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). _Winter: ImportExportController AJAX handlers bypass granular import/export permission gate_ +- GHSA-mpmw-f6h6-3g26 (wintercms/winter, access_control, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). _Winter: My Account preview exposes another backend user's profile by record ID_ +- GHSA-7mpf-4465-7fc2 (wintercms/winter, output_encoding, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). _Winter: Stored XSS through Backend List widget image columns_ +- GHSA-2223-f22x-24cq (wintercms/winter, path, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). _Winter: Local File Inclusion through =include directives in JavaScript asset compilation_ +- GHSA-58fp-mcx6-7qf9 / CVE-2026-63179 (wintercms/winter, path, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). _Winter: Local File Inclusion through @import directives in LESS compilation of backend cus_ +- GHSA-42vx-43vc-x6pr / CVE-2026-57570 (laravel-backpack/crud, access_control, 2026-08-20): one case per repository (repository taken as backpack-stats-host-header-cmdi). _Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-pare_ +- GHSA-3277-h8g9-qj5f / CVE-2026-54256 (wintercms/winter, access_control, 2026-08-20): one case per repository (repository taken as winter-filter-numberrange-sqli). _Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attach_ +- GHSA-mrc5-3mm3-45c5 / CVE-2026-54182 (laravel-backpack/crud, injection/output_encoding, 2026-08-20): **taken** as backpack-stats-host-header-cmdi. _Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-control_ +- GHSA-mmg4-322v-6jvc / CVE-2026-54181 (laravel-backpack/crud, output_encoding, 2026-08-20): one case per repository (repository taken as backpack-stats-host-header-cmdi). _Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` bran_ +- GHSA-vgmv-8xjc-6rch / CVE-2026-54180 (laravel-backpack/crud, access_control, 2026-08-20): one case per repository (repository taken as backpack-stats-host-header-cmdi). _Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reo_ +- GHSA-8hw4-7qjr-3wxg / CVE-2026-54179 (laravel-backpack/crud, output_encoding, 2026-08-20): one case per repository (repository taken as backpack-stats-host-header-cmdi). _Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` _ +- GHSA-8xjm-wqrp-2f25 / CVE-2026-54178 (laravel-backpack/crud, access_control/path, 2026-08-20): one case per repository (repository taken as backpack-stats-host-header-cmdi). _Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_[] in H_ +- GHSA-c8qc-wf67-342w / CVE-2026-61807 (grokability/snipe-it, output_encoding, 2026-08-19): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT: Stored DOM XSS via table selected-count IDs_ +- GHSA-r9r3-g9fp-3q4q / CVE-2026-55703 (grokability/snipe-it, access_control, 2026-08-19): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET_ +- GHSA-3hgv-jr5j-cg9x / CVE-2026-55694 (grokability/snipe-it, access_control, 2026-08-19): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover_ +- GHSA-c6w2-j4wq-mvwg / CVE-2026-55643 (grokability/snipe-it, access_control, 2026-08-19): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode_ +- GHSA-7gww-x7fh-jf9j (librenms/librenms, output_encoding/untrusted_destination, 2026-08-18): repo over ~150 MB (369 MB per GitHub API). _LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig pag_ +- GHSA-7cj5-v4pp-v632 (librenms/librenms, output_encoding, 2026-08-18): repo over ~150 MB (369 MB per GitHub API). _LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all _ +- GHSA-jf24-8g2h-2wg7 (librenms/librenms, injection, 2026-08-18): repo over ~150 MB (369 MB per GitHub API). _LibreNMS Vulnerable to Remote Code Execution via AboutController_ +- GHSA-w27m-rmmf-g5w4 / CVE-2026-54348 (froxlor/froxlor, injection, 2026-08-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Dat_ +- GHSA-43gm-9rr3-cx7g / CVE-2026-54347 (froxlor/froxlor, output_encoding, 2026-08-18): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover_ +- GHSA-pcw8-m77r-2528 / CVE-2026-54133 (jmespath/jmespath.php, injection/output_encoding, 2026-08-18): general-purpose library: the attacker source lies in the calling application, not in the repo. _jmespath.php has CompilerRuntime code injection via unescaped function names_ +- GHSA-c9fv-cgmm-2wg7 / CVE-2026-55182 (librenms/librenms, injection, 2026-08-18): repo over ~150 MB (369 MB per GitHub API). _LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module_ +- GHSA-q8cg-5m48-5c25 (, output_encoding, 2026-08-18): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: Stored XSS via Markdown audio/video media URL_ +- GHSA-9pr6-8r9w-wvmj (, output_encoding, 2026-08-18): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: detectXss() misses an event-handler attribute after an unpaired _ +- GHSA-993v-76jg-67xr (, output_encoding, 2026-08-18): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: Single invalid UTF-8 byte disables every rule in Security::detec_ +- GHSA-fwwx-3362-3947 (, injection, 2026-08-18): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated an_ +- GHSA-2rhw-8953-48q3 (, path, 2026-08-18): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Ch_ +- GHSA-59xm-4m8c-g3xj / CVE-2026-55224 (mineadmin/mineadmin, path, 2026-08-18): **taken** as mineadmin-appstore-identifier-traversal. _MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninst_ +- GHSA-cgvr-f65r-pjv3 (, output_encoding, 2026-08-14): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: Stored XSS via quoted-attribute bypass in detectXss_ +- GHSA-wvxr-6v52-gfmh (, injection, 2026-08-14): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Remote code execution via .zip file upload in Grav CMS_ +- GHSA-2mhj-fhvg-v428 / CVE-2026-55072 (pimcore/pimcore, injection, 2026-08-13): repo over ~150 MB (534 MB per GitHub API). _Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php u_ +- GHSA-6pvm-2vjj-rx4w / CVE-2026-47132 (thorsten/phpmyfaq, injection, 2026-08-12): repo in used list (already referenced under benchmarks/src/tests/.kiro). _phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumer_ +- GHSA-jmqm-f8q4-v7wx / CVE-2026-45694 (librenms/librenms, output_encoding, 2026-08-12): repo over ~150 MB (369 MB per GitHub API). _LibreNMS: Reflected XSS via Proxmox instance/vmid GET parameters injected into document.ti_ +- GHSA-j5jq-cr68-v2xx / CVE-2026-35445 (wintercms/winter, access_control, 2026-08-12): one case per repository (repository taken as winter-filter-numberrange-sqli). _Winter: Authenticated backend users can bypass Users controller permission checks_ +- GHSA-m7jc-g4rc-jmvh / CVE-2026-32593 (wintercms/winter, injection, 2026-08-12): **taken** as winter-filter-numberrange-sqli. _Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax_ +- GHSA-vgp4-2fc4-qff2 / CVE-2026-32258 (wintercms/winter, output_encoding, 2026-08-12): one case per repository (repository taken as winter-filter-numberrange-sqli). _Winter: Stored XSS through Editor Settings custom styles_ +- GHSA-v7cf-8gh9-gxmj / CVE-2026-32257 (wintercms/winter, output_encoding, 2026-08-12): one case per repository (repository taken as winter-filter-numberrange-sqli). _Winter: Stored XSS through Brand Settings custom styles_ +- GHSA-4hc4-qjfx-wjf3 (, access_control, 2026-08-11): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS: Authorization bypass: view-only Categories user can modify _ +- GHSA-9w6w-8x3c-hfqp (, path, 2026-08-11): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path tr_ +- GHSA-hhmc-q9hp-r662 / CVE-2026-63222 (codeigniter4/codeigniter4, path, 2026-08-07): repo over ~150 MB (387 MB per GitHub API). _CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames_ +- GHSA-c9w5-rwh3-7pm9 / CVE-2026-63221 (codeigniter4/codeigniter4, injection, 2026-08-07): repo over ~150 MB (387 MB per GitHub API). _CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() condition_ +- GHSA-rjhh-76wf-8xmw / CVE-2026-62996 (smarty-php/smarty, path, 2026-08-07): general-purpose library: the attacker source lies in the calling application, not in the repo. _Smarty Security stream restriction bypass through stream: resource_ +- GHSA-f6wf-28g6-769x / CVE-2026-62992 (smarty-php/smarty, path, 2026-08-07): general-purpose library: the attacker source lies in the calling application, not in the repo. _Smarty: Symlink path traversal out of trusted directories_ +- GHSA-xxpx-f366-4xpq / CVE-2026-72785 (craftcms/cms, access_control, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Authorization bypass: view-only Categories user can modify category structure v_ +- GHSA-rvmm-v933-jgxq / CVE-2026-14794 (craftcms/cms, access_control, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Missing authorization check allows non-admin control panel users access to user_ +- GHSA-7hxc-f267-h5q7 / CVE-2026-72783 (craftcms/cms, path, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Incorrect path validation could potentially lead to path traversal_ +- GHSA-2rp4-x2j7-qmcc (craftcms/cms, output_encoding, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Stored XSS in the control panel via unescaped draft name_ +- GHSA-hmqg-cxww-wqhq / CVE-2026-67434 (phpcsstandards/php_codesniffer, injection, 2026-08-06): repo over ~150 MB (210 MB per GitHub API). _PHP_CodeSniffer gitblame report command injection via crafted filename_ +- GHSA-p8x7-9vfw-p7vc (craftcms/cms, access_control, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Arbitrary user password reset leading to administrator account takeover_ +- GHSA-9p7c-v5x3-rfx8 / CVE-2026-14793 (craftcms/cms, access_control, 2026-08-06): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Missing authorization check allows non-admin control panel users to reorder Glo_ +- GHSA-29pj-957v-52mc / CVE-2026-71478 (thephpleague/commonmark, output_encoding, 2026-08-06): general-purpose library: the attacker source lies in the calling application, not in the repo. _league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded con_ +- GHSA-grm4-wm43-9jh5 / CVE-2026-55825 (contao/contao, path, 2026-08-06): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Contao: Possible path traversal in job download URIs_ +- GHSA-w3cp-g2pf-65wh / CVE-2026-54717 (silverstripe/silverstripe-cms, output_encoding, 2026-08-06): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text) (breadcrumbs in page list view). _Silverstripe: XSS in breadcrumbs in page list view_ +- GHSA-vx89-p3j7-8xqc / CVE-2026-71435 (statamic/cms, output_encoding, 2026-08-06): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text) ('automagic' form notification email). _Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template_ +- GHSA-qh8c-7588-qfrv / CVE-2026-64662 (statamic/cms, access_control, 2026-08-06): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text). _Statamic: Missing authorization on navigation endpoint allows disclosure of restricted ent_ +- GHSA-225x-3jhx-wh4q / CVE-2026-64664 (statamic/cms, access_control, 2026-08-06): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text). _Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existe_ +- GHSA-v5mv-p594-2x33 / CVE-2026-69246 (guzzle/guzzle, untrusted_destination, 2026-08-03): general-purpose library: the attacker source lies in the calling application, not in the repo. _Guzzle: Noncanonical host can bypass host-based checks_ +- GHSA-vj8j-973f-r65j (, injection, 2026-08-03): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: Incomplete callable validation in blueprint dynamic fields allow_ +- GHSA-mmwh-j75q-gxp8 (, path, 2026-08-03): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disc_ +- GHSA-x83g-979r-f5fh / CVE-2026-68501 (sylius/mollieplugin, access_control, 2026-07-31): **taken** as sylius-mollie-thankyou-order-idor. _Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII_ +- GHSA-rc52-c4hv-w89p / CVE-2026-68500 (sylius/mollieplugin, access_control, 2026-07-31): one case per repository (repository taken as sylius-mollie-thankyou-order-idor). _Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook_ +- GHSA-996f-334j-67g7 / CVE-2026-52838 (alextselegidis/easyappointments, output_encoding, 2026-07-29): one case per repository (repository taken as easyappointments-caldav-ssrf). _Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — St_ +- GHSA-8hm4-r66f-29wr / CVE-2026-52841 (alextselegidis/easyappointments, access_control, 2026-07-29): one case per repository (repository taken as easyappointments-caldav-ssrf). _Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend _ +- GHSA-xgr6-pqjv-3pf8 / CVE-2026-52837 (alextselegidis/easyappointments, access_control, 2026-07-29): one case per repository (repository taken as easyappointments-caldav-ssrf). _Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page_ +- GHSA-w8xc-8g92-v77h / CVE-2026-52839 (alextselegidis/easyappointments, access_control, 2026-07-29): one case per repository (repository taken as easyappointments-caldav-ssrf). _Easy!Appointments appointments/store and appointments/update allow cross-provider appointm_ +- GHSA-pm5p-7w5h-jm5q / CVE-2026-52840 (alextselegidis/easyappointments, untrusted_destination, 2026-07-29): **taken** as easyappointments-caldav-ssrf. _Easy!Appointments has server-side request forgery in CalDAV connection test that exposes t_ +- GHSA-3735-5339-xfwx / CVE-2026-54588 (poweradmin/poweradmin, untrusted_destination, 2026-07-28): repo over ~150 MB (508 MB per GitHub API). _Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Re_ +- GHSA-3pwp-g2mj-5p3v / CVE-2026-45293 (wordpress/wordpress-coding-standards, injection, 2026-07-28): developer tool / CLI, not a web application. _WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerabilit_ +- GHSA-rm67-g9ch-vxff (poweradmin/poweradmin, access_control, 2026-07-24): repo over ~150 MB (508 MB per GitHub API). _Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones t_ +- GHSA-h4hf-v6w5-897x (poweradmin/poweradmin, access_control, 2026-07-24): repo over ~150 MB (508 MB per GitHub API). _Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and ta_ +- GHSA-g3hq-hphg-8fhh (pheditor/pheditor, injection, 2026-07-24): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — survivin_ +- GHSA-6hq5-7373-42rg / CVE-2026-59931 (phpoffice/phpspreadsheet, untrusted_destination, 2026-07-23): general-purpose library: the attacker source lies in the calling application, not in the repo. _PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist_ +- GHSA-cx96-42px-69fm / CVE-2026-56722 (dompdf/dompdf, path, 2026-07-22): general-purpose library: the attacker source lies in the calling application, not in the repo. _Dompdf: Local file read due to improper file path validation in SVG images encoded as data_ +- GHSA-wvh6-f5jh-8gw4 / CVE-2026-55554 (dompdf/dompdf, path, 2026-07-22): general-purpose library: the attacker source lies in the calling application, not in the repo. _Dompdf: Chroot Validation Bypass_ +- GHSA-gjfg-22fp-rrxx / CVE-2026-59946 (composer/composer, path, 2026-07-20): developer tool / CLI, not a web application. _Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files_ +- GHSA-499r-g7pc-vmp9 / CVE-2026-59948 (composer/composer, path, 2026-07-20): developer tool / CLI, not a web application. _Composer: Arbitrary file write outside vendor via malicious transitive package name_ +- GHSA-cvpc-hccg-wmw4 (verbb/formie, access_control, 2026-07-17): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Formie: Missing authorization in administrative settings allows low-privileged CP users to_ +- GHSA-wg4w-wr5q-6vjc / CVE-2026-55578 (pheditor/pheditor, injection, 2026-07-16): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator_ +- GHSA-9643-6xjp-vx57 / CVE-2026-54540 (pheditor/pheditor, injection, 2026-07-16): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Pheditor has an authenticated terminal command whitelist bypass_ +- GHSA-373m-p57p-8665 (, output_encoding, 2026-07-15): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: XSS Blueprint Validation Bypass via Twig String Concatenation_ +- GHSA-h2wf-967x-gxvw / CVE-2026-62944 (mantisbt/mantisbt, output_encoding, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). _MantisBT: Stored XSS in print_all_bug_page_word.php_ +- GHSA-3v2j-6fw9-f57c / CVE-2026-52882 (mantisbt/mantisbt, access_control, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). _MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters_ +- GHSA-vcrw-4xvv-jh49 / CVE-2026-52881 (mantisbt/mantisbt, output_encoding, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). _MantisBT: Reflected XSS in admin/install.php via unescaped printf _ +- GHSA-77x8-3v3h-hrhv / CVE-2026-52847 (mantisbt/mantisbt, output_encoding, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). _MantisBT: Reflected XSS in admin/install.php_ +- GHSA-rjg7-r26h-cfp2 / CVE-2026-54494 (koel/koel, untrusted_destination, 2026-07-15): **taken** as koel-podcast-enclosure-ipv6-ssrf. _Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not r_ +- GHSA-jr4p-4xjh-fwvw / CVE-2026-50552 (koel/koel, untrusted_destination, 2026-07-15): one case per repository (repository taken as koel-podcast-enclosure-ipv6-ssrf). _Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validati_ +- GHSA-6qvr-wjmv-v8mm / CVE-2026-54491 (koel/koel, untrusted_destination, 2026-07-15): one case per repository (repository taken as koel-podcast-enclosure-ipv6-ssrf). _Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths_ +- GHSA-8q6q-m837-fv64 (koel/koel, untrusted_destination, 2026-07-15): one case per repository (repository taken as koel-podcast-enclosure-ipv6-ssrf). _ Koel has SSRF through Authenticated Subsonic podcast feed URLs_ +- GHSA-6p96-cfg5-4vhp / CVE-2026-54493 (koel/koel, untrusted_destination, 2026-07-15): one case per repository (repository taken as koel-podcast-enclosure-ipv6-ssrf). _Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations_ +- GHSA-w79m-f3jx-779v / CVE-2026-54492 (koel/koel, untrusted_destination, 2026-07-15): one case per repository (repository taken as koel-podcast-enclosure-ipv6-ssrf). _Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation_ +- GHSA-m7ph-9558-mrx3 / CVE-2026-49280 (mantisbt/mantisbt, access_control, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). _MantisBT: REST API unauthorized Issue status change_ +- GHSA-v84x-qvhg-f36r / CVE-2026-49273 (mantisbt/mantisbt, injection, 2026-07-15): **taken** as mantisbt-tokenizer-eval-rce. _MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php_ +- GHSA-c2xg-qjqw-2v98 / CVE-2026-47156 (mantisbt/mantisbt, access_control, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). _MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator_ +- GHSA-mw6p-33vw-46cc / CVE-2026-47142 (mantisbt/mantisbt, injection, 2026-07-15): one case per repository (repository taken as mantisbt-tokenizer-eval-rce). _MantisBT: SQL Injection via history_order Configuration Value_ +- GHSA-hgjx-r89m-m7v4 (neorazorx/facturascripts, path, 2026-07-14): **taken** as facturascripts-uploadedfile-move-traversal. _FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbit_ +- GHSA-8559-gwj3-q37r / CVE-2026-54087 (easycorp/easyadminbundle, output_encoding, 2026-07-14): vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository (uploads must be stored under the public web root); the flaw is a missing default upload restriction, with no rendering sink in the repository. _EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField_ +- GHSA-3x7p-v8hj-xh5m / CVE-2026-45710 (neorazorx/facturascripts, output_encoding, 2026-07-14): one case per repository (repository taken as facturascripts-uploadedfile-move-traversal). _FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attr_ +- GHSA-cv65-7cg8-r623 / CVE-2026-45693 (neorazorx/facturascripts, path, 2026-07-14): one case per repository (repository taken as facturascripts-uploadedfile-move-traversal). _FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private My_ +- GHSA-5qmh-x653-g8qj / CVE-2026-45262 (neorazorx/facturascripts, injection/untrusted_destination, 2026-07-14): no fixed version stated (`<= 2026.1`, patched: none) and no identifiable fix: the only candidate (`14ee211c`, 'centralizar parseFieldFilter con validación anti-SQLi') was reverted the same day (`7392b489`). _FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter paramete_ +- GHSA-rw46-qg69-vg6h / CVE-2026-52828 (kimai/kimai, access_control, 2026-07-14): no fix commit referenced; per the v2 research, Kimai's fixes for this release shipped in the single 'Release 2.58' commit (`31a8f887`, 120 files across 2.57.0...2.58.0), mixed with unrelated changes. _Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access_ +- GHSA-2xgg-2x8h-8xw4 / CVE-2026-52826 (kimai/kimai, access_control, 2026-07-14): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. _Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allow_ +- GHSA-xv4r-4885-gwpg / CVE-2026-52825 (kimai/kimai, access_control, 2026-07-14): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. _Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Al_ +- GHSA-c6w6-57jj-62vh / CVE-2026-52822 (kimai/kimai, access_control, 2026-07-14): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. _Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets Afte_ +- GHSA-3q6q-26vg-v97x / CVE-2026-52821 (kimai/kimai, access_control, 2026-07-14): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. _Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creatio_ +- GHSA-xv8g-76mx-2rxc / CVE-2026-49970 (plank/laravel-mediable, path, 2026-07-13): general-purpose library: the attacker source lies in the calling application, not in the repo. _Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()_ +- GHSA-4chg-4752-w88r / CVE-2026-55372 (nukeviet/nukeviet, untrusted_destination, 2026-07-13): repo over ~150 MB (190 MB per GitHub API). _NukeViet: Pre-authentication SSRF via X-Forwarded-Host_ +- GHSA-c9xg-64p9-f2jj / CVE-2026-54065 (nukeviet/nukeviet, path, 2026-07-13): repo over ~150 MB (190 MB per GitHub API). _NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function_ +- GHSA-465g-4q99-5x86 / CVE-2026-54064 (nukeviet/nukeviet, output_encoding, 2026-07-13): repo over ~150 MB (190 MB per GitHub API). _NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module_ +- GHSA-w2w5-w2pw-r929 / CVE-2026-49259 (nukeviet/nukeviet, output_encoding, 2026-07-13): repo over ~150 MB (190 MB per GitHub API). _NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti_ +- GHSA-mxpf-qgg6-v3ff / CVE-2026-48118 (nukeviet/nukeviet, output_encoding, 2026-07-13): repo over ~150 MB (190 MB per GitHub API). _NukeViet: Unauthenticated Reflected XSS in Comment Module_ +- GHSA-vrr2-g9gh-c3jc / CVE-2026-52820 (kimai/kimai, access_control, 2026-07-13): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. _Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_buil_ +- GHSA-4m8q-55qv-9pwp / CVE-2026-52819 (kimai/kimai, access_control, 2026-07-13): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. _Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' ti_ +- GHSA-qv4m-m73m-8hj7 (notrinos/notrinoserp, path, 2026-07-10): no fixed version stated and no identifiable fix commit (the history of `hrm/manage/employees.php` shows no matching change); the weakness is also mainly unrestricted upload (CWE-434). _NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM em_ +- GHSA-pj8j-p4g4-4vw8 / CVE-2026-49865 (kimai/kimai, untrusted_destination, 2026-07-10): no fix commit referenced; the fix is in Kimai's 'Release 2.58' squash (see above). _Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs_ +- GHSA-pjhx-3c3w-9v23 / CVE-2026-49858 (api-platform/core, access_control, 2026-07-10): a per-process cache-key bug in the serializer; exposure depends on application-declared `#[ApiProperty(security: ...)]` predicates, and no attacker-controlled value reaches the flaw inside the repository. _API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normali_ +- GHSA-mr9r-h354-966r / CVE-2026-53639 (sylius/sylius, access_control, 2026-07-09): repo over ~150 MB (355 MB per GitHub API). _Sylius: IDOR on Shop Payment Request API endpoints_ +- GHSA-6955-hrm5-c4qp / CVE-2026-53638 (sylius/sylius, access_control, 2026-07-09): repo over ~150 MB (355 MB per GitHub API). _Sylius: Channel-based payment method restriction bypass on shop account orders API endpoin_ +- GHSA-px5m-h76g-p7p8 / CVE-2026-52778 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Den_ +- GHSA-9369-69wj-7m2f / CVE-2026-52777 (yeswiki/yeswiki, deserialization, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserial_ +- GHSA-4pf7-cc4r-g63h / CVE-2026-52775 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki has Authenticated SQL Injection via ReactionManager _ +- GHSA-r5xw-gcgw-hwp5 / CVE-2026-52774 (yeswiki/yeswiki, output_encoding, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attr_ +- GHSA-35f3-pg38-486f / CVE-2026-52773 (yeswiki/yeswiki, output_encoding, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `h_ +- GHSA-xc7j-3g8q-9vh4 / CVE-2026-52772 (yeswiki/yeswiki, output_encoding, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hin_ +- GHSA-8f2v-2qhj-gfwg / CVE-2026-52771 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiControl_ +- GHSA-qg78-vmvc-fhjw / CVE-2026-52770 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query_ +- GHSA-vw42-752g-5mrp / CVE-2026-52769 (yeswiki/yeswiki, untrusted_destination, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`_ +- GHSA-6x7x-gcmf-7r8x / CVE-2026-52766 (yeswiki/yeswiki, access_control, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}_ +- GHSA-89v6-j5x6-cmj3 / CVE-2026-52763 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary_ +- GHSA-65p8-9433-jpcp / CVE-2026-52762 (yeswiki/yeswiki, injection, 2026-07-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via_ +- GHSA-w9mx-xmg4-gc4r / CVE-2026-53932 (stefanzweifel/laravel-backup-restore, injection, 2026-07-09): developer tool / CLI, not a web application. _laravel-backup-restore has an OS Command Injection during database restore_ +- GHSA-86vw-x4ww-x467 / CVE-2026-56382 (craftcms/cms, injection, 2026-07-09): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview_ +- GHSA-c43v-4cr8-6mvp / CVE-2026-56394 (craftcms/cms, path, 2026-07-09): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file re_ +- GHSA-4wj4-79rr-pvff (, output_encoding, 2026-07-08): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav: Stored CSS injection via Markdown image resize() bypasses prior _ +- GHSA-vmwx-m75v-qvch / CVE-2026-53634 (code16/sharp, access_control, 2026-07-08): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text) ('create and store endpoints of the Quick Creation Command feature'). _Sharp Missing Authorization Check in Quick Creation Command Endpoints_ +- GHSA-c8m7-r2jv-rw63 / CVE-2026-45016 (egroupware/egroupware, path, 2026-07-07): repo over ~150 MB (188 MB per GitHub API). _EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose_ +- GHSA-8737-2x9g-xjj7 / CVE-2026-40187 (egroupware/egroupware, injection, 2026-07-07): repo over ~150 MB (188 MB per GitHub API). _EGroupware has Authenticated RCE via Malicious eTemplate Upload_ +- GHSA-h9qx-v5xp-ph8p / CVE-2026-27823 (egroupware/egroupware, access_control/injection/path, 2026-07-07): repo over ~150 MB (188 MB per GitHub API). _EGroupware has a Remote Code Execution Vulnerability_ +- GHSA-f74w-488g-8x5r / CVE-2026-55794 (craftcms/cms, injection, 2026-07-06): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Potential authenticated Remote Code Execution via referrer redirect_ +- GHSA-xrqc-p465-2xvg / CVE-2026-55793 (craftcms/cms, output_encoding, 2026-07-06): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Stored XSS via Structure entry title in table view_ +- GHSA-24x4-j6x9-rfw5 / CVE-2026-55790 (craftcms/cms, output_encoding, 2026-07-06): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget_ +- GHSA-x76w-8c62-48mg / CVE-2026-56384 (craftcms/cms, access_control, 2026-07-06): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform previe_ +- GHSA-565m-g33j-jq96 / CVE-2026-52889 (verbb/formie, injection, 2026-07-06): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Formie Hidden field defaults vulnerable to Server-Side Template Injection_ +- GHSA-rqjw-r5g4-x8qm (, access_control, 2026-07-06): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS: Missing authorization check allows non-admin control panel _ +- GHSA-3w32-23wj-rxg3 / CVE-2026-50282 (craftcms/cms, access_control, 2026-07-02): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves_ +- GHSA-5hvg-w58j-545m / CVE-2026-9811 (mautic/mautic, output_encoding, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). _Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector_ +- GHSA-7h65-whp7-rgqf / CVE-2026-9809 (mautic/mautic, output_encoding, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). _Mautic has Stored Cross-Site Scripting (XSS) in Projects Component_ +- GHSA-2jrw-c95w-h43g / CVE-2026-9808 (mautic/mautic, access_control, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). _Mautic has an Authorization Bypass in API v2 Endpoints_ +- GHSA-6r9h-4h75-7q4x / CVE-2026-9559 (mautic/mautic, path, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). _Mautic vulnerable to Path Traversal via Campaign Import_ +- GHSA-9fx4-7cmj-47vg / CVE-2026-9558 (mautic/mautic, injection, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). _Mautic has Server-Side Template Injection (SSTI) in Theme Templates_ +- GHSA-jmv8-8j9j-rcpc / CVE-2026-9557 (mautic/mautic, untrusted_destination, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). _Mautic Focus component Vulnerable to SSRF_ +- GHSA-fcmw-wx57-9p75 / CVE-2026-4776 (mautic/mautic, injection, 2026-07-02): repo over ~150 MB (308 MB per GitHub API). _Mautic has SQL Injection in API Contact Filtering_ +- GHSA-q4rm-m6xh-5pv7 (froxlor/froxlor, access_control, 2026-07-02): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API_ +- GHSA-7h62-6v23-v8fm / CVE-2026-50284 (craftcms/cms, access_control, 2026-07-02): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows _ +- GHSA-qh45-9g5p-m2v4 / CVE-2026-50283 (craftcms/cms, access_control, 2026-07-02): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Unauthorized Deletion of Source Assets During File Replacement_ +- GHSA-43cq-c2gq-pfpw / CVE-2026-50280 (craftcms/cms, access_control, 2026-07-02): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section sa_ +- GHSA-qq2c-2q8j-jh27 / CVE-2026-50279 (craftcms/cms, access_control, 2026-07-02): repo over ~150 MB (1048 MB per GitHub API). _Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authori_ +- GHSA-4h7g-5542-v3fc / CVE-2026-52854 (professionalwiki/maps, output_encoding, 2026-07-02): excluded by name. _mediawiki/maps has stored XSS through the overlays parameter in the display_map parser fun_ +- GHSA-j5mc-p8qg-39j7 (kimai/kimai, access_control, 2026-07-02): same as the other Kimai rows: fix only inside the 'Release 2.58' squash. _Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation_ +- GHSA-529h-vh3j-85hq / CVE-2026-49981 (twigphp/twig, access_control, 2026-07-01): general-purpose library: the attacker source lies in the calling application, not in the repo. _Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes betwee_ +- GHSA-hwmc-r6mf-jh83 (spatie/schema-org, output_encoding, 2026-07-01): general-purpose library: the attacker source lies in the calling application, not in the repo. _Schema.org has cross-site scripting (XSS) via script break-out in toScript() output_ +- GHSA-2wwr-9x6f-88gp (easycorp/easyadminbundle, output_encoding/path, 2026-07-01): vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository (the advisory says the bundle's own first-party usage is not affected). _EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components_ +- GHSA-h8vq-8gpg-mhcg / CVE-2026-48808 (twigphp/twig, access_control, 2026-06-30): general-purpose library: the attacker source lies in the calling application, not in the repo. _Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterfa_ +- GHSA-8x9c-rmqh-456c / CVE-2026-48807 (twigphp/twig, access_control, 2026-06-30): general-purpose library: the attacker source lies in the calling application, not in the repo. _Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filte_ +- GHSA-5v5v-ww74-355v / CVE-2026-48806 (twigphp/twig, access_control, 2026-06-30): general-purpose library: the attacker source lies in the calling application, not in the repo. _Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys_ +- GHSA-5q4q-834j-g8g4 / CVE-2026-47198 (paymenter/paymenter, access_control, 2026-06-30): **taken** as paymenter-checkout-config-override. _Paymenter has URL parameter injection that bypasses paid plan limits at checkout_ +- GHSA-7vfx-4246-jcfh (solidinvoice/solidinvoice, access_control, 2026-06-26): repo over ~150 MB (151 MB per GitHub API). _SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens an_ +- GHSA-x8g9-h984-pc36 / CVE-2026-49359 (pontedilana/php-weasyprint, untrusted_destination, 2026-06-26): general-purpose library: the attacker source lies in the calling application, not in the repo. _PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option_ +- GHSA-5g9f-cwwg-4p8g / CVE-2026-49358 (pontedilana/php-weasyprint, path, 2026-06-26): general-purpose library: the attacker source lies in the calling application, not in the repo. _PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles_ +- GHSA-2fmj-p74r-3wjm / CVE-2026-49286 (pontedilana/php-weasyprint, deserialization, 2026-06-26): general-purpose library: the attacker source lies in the calling application, not in the repo. _PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-_ +- GHSA-f5gc-qxf8-mh9g / CVE-2026-49260 (pontedilana/php-weasyprint, injection, 2026-06-26): general-purpose library: the attacker source lies in the calling application, not in the repo. _php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inv_ +- GHSA-7mqq-4v55-88gh / CVE-2026-54244 (statamic/cms, access_control, 2026-06-26): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text). _Statamic CMS's incorrect authorization lets view-only users submit Live Preview content re_ +- GHSA-v5c4-wcpj-x73m / CVE-2026-54242 (statamic/cms, untrusted_destination, 2026-06-26): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text) (Glide image proxy). _Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)_ +- GHSA-2497-6pwj-pwg7 / CVE-2026-49288 (statamic/cms, access_control, 2026-06-26): advisory names no vulnerable file or function (a `sites` entry cannot be declared from its text). _Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure_ +- GHSA-mmj8-wcvw-6789 / CVE-2026-49262 (aimeos/pagible, untrusted_destination, 2026-06-26): **taken** as pagible-admin-proxy-dns-rebinding-ssrf. _Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in a_ +- GHSA-wpvj-hjcr-h3p2 / CVE-2026-48820 (cakephp/cakephp, path, 2026-06-26): framework `View::element()`; vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository (the advisory: 'if developers are not using user-supplied data in element names, no action is required'). _CakePHP: View::element() is missing a path containment check_ +- GHSA-6mmj-jhqj-6c6q / CVE-2026-55542 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL _ +- GHSA-x667-r589-43m7 / CVE-2026-55519 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT has Improper Authorization in File Deletion (IDOR)_ +- GHSA-hf68-g98v-wp9g / CVE-2026-55483 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Cre_ +- GHSA-33g4-646g-qwmm / CVE-2026-55482 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update_ +- GHSA-6x4j-8954-5hxm / CVE-2026-50550 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT has a 2FA reset privilege bypass_ +- GHSA-p68w-rgmg-3c2v / CVE-2026-49976 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT Vulnerable to User Account Escalation via CSV Import_ +- GHSA-8c6h-7g6x-m5x4 / CVE-2026-49205 (thorsten/phpmyfaq, access_control, 2026-06-23): repo in used list (already referenced under benchmarks/src/tests/.kiro). _phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete _ +- GHSA-6f75-x745-xcpr / CVE-2026-48507 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users_ +- GHSA-44wp-g8f4-f4v5 / CVE-2026-48500 (filamentphp/filament, access_control, 2026-06-23): repo over ~150 MB (582 MB per GitHub API). _Filament: Unauthenticated temporary file upload on auth pages_ +- GHSA-52fw-7fw2-fmv5 / CVE-2026-48493 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment_ +- GHSA-f3c5-6cw8-fg57 / CVE-2026-48492 (grokability/snipe-it, access_control, 2026-06-23): repo over ~150 MB (324 MB per GitHub API). _Snipe-IT's selectlist visibility is too permissive_ +- GHSA-3fc8-8hp6-6jr4 / CVE-2026-48167 (filamentphp/filament, output_encoding, 2026-06-23): repo over ~150 MB (582 MB per GitHub API). _Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS_ +- GHSA-7cqp-7cfv-6c3q (wwbn/avideo, output_encoding, 2026-06-23): repo over ~150 MB (664 MB per GitHub API). _AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in _ +- GHSA-wc3f-xc32-435f / CVE-2026-55173 (wwbn/avideo, injection, 2026-06-23): repo over ~150 MB (664 MB per GitHub API). _AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a singl_ +- GHSA-32fw-h446-j4hh (, untrusted_destination, 2026-06-23): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Grav is Vulnerable to XXE via SVG Upload_ +- GHSA-53h4-8rc4-f539 / CVE-2026-48157 (slimphp/slim, output_encoding, 2026-06-23): vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository (only apps that pass request data to `HttpException::setTitle()`/`setDescription()`). _Slim has Reflected XSS in the HtmlErrorRenderer_ +- GHSA-8j8m-p79x-g4jm / CVE-2026-33684 (wwbn/avideo, access_control, 2026-06-22): repo over ~150 MB (664 MB per GitHub API). _AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Sel_ +- GHSA-x93q-x9pc-w5hw / CVE-2026-44585 (paymenter/paymenter, access_control, 2026-06-22): one case per repository (repository taken as paymenter-checkout-config-override). _Paymenter has broken object level authorization via service reference manipulation on tick_ +- GHSA-f95g-vm94-46c3 (, output_encoding, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options_ +- GHSA-jcmp-jxh2-4jc3 (, path, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS has authenticated path traversal in `assets/icon`, allowing _ +- GHSA-f4h3-qhg5-j6mq (, access_control, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS: Authorized asset "preview file" requests bypass allows user_ +- GHSA-9r7j-7jhg-4f4c (, output_encoding, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS Vulnerable to Stored XSS via User Group Name in User Permiss_ +- GHSA-5w9j-w5p8-r4p7 (, output_encoding, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Ty_ +- GHSA-xj2c-g5xp-4p47 (, access_control, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallb_ +- GHSA-pmm4-v8f6-4vpp (, injection, 2026-06-21): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRe_ +- GHSA-xj9w-cgqg-q897 (wwbn/avideo, access_control, 2026-06-20): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: AVideo has Unauthenticated PGP Message Decryption via Public Endpoint_ +- GHSA-rg7q-4223-phjw (, access_control, 2026-06-20): duplicate advisory (GitHub marks it "Duplicate Advisory"). _Duplicate Advisory: AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exp_ +- GHSA-5c7p-g73q-rpg5 / CVE-2026-55692 (starcitizenwiki/mediawiki-extensions-embedvideo, output_encoding, 2026-06-19): excluded by name. _StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideo_ +- GHSA-7h5p-637f-jfr7 / CVE-2026-55691 (starcitizenwiki/mediawiki-extensions-embedvideo, output_encoding, 2026-06-19): excluded by name. _StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template_ +- GHSA-c29q-5xm7-5p62 / CVE-2026-55690 (starcitizenwiki/mediawiki-extensions-embedvideo, output_encoding, 2026-06-19): excluded by name. _StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exceptio_ +- GHSA-vm85-hxw5-5432 / CVE-2026-55766 (guzzle/psr7, output_encoding, 2026-06-19): general-purpose library: the attacker source lies in the calling application, not in the repo. _guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization_ +- GHSA-9qfv-wgh2-m6p8 / CVE-2026-55374 (jleehr/canto-saas-api, untrusted_destination, 2026-06-19): general-purpose library: the attacker source lies in the calling application, not in the repo. _canto-saas-api: Authenticated API requests can be redirected via unencoded path variables_ +- GHSA-p9xj-fpr2-jf2q / CVE-2026-55878 (symfony/ux, path, 2026-06-19): developer tool: the `ux:install` console command, not a web request path. _symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe_ +- GHSA-6v8j-33hc-mv84 / CVE-2026-55877 (symfony/ux, output_encoding, 2026-06-19): the source is icon files or a configured Iconify endpoint, not a request; no fix commit referenced. _symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand res_ +- GHSA-mwqm-4fw3-cjvr / CVE-2026-49216 (symfony/ux, output_encoding, 2026-06-19): the sink is the Stimulus (JavaScript) controller's template literal, not PHP. _symfony/ux-autocomplete: XSS via unescaped AJAX response data_ +- GHSA-38x5-rcv4-xf7x / CVE-2026-49210 (symfony/ux, output_encoding, 2026-06-19): **taken** as symfony-ux-live-child-tag-xss. _symfony/ux-live-component: XSS via attacker-controlled child component tag_ +- GHSA-r3w8-2c5r-h9j9 / CVE-2026-54005 (getkirby/kirby, access_control, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). _Kirby: `pages.access` permission is not checked in the `site/find` REST API route_ +- GHSA-89cp-7p28-jffg / CVE-2026-54004 (getkirby/kirby, access_control, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). _Kirby: Access to files of top-level drafts is not protected by permissions_ +- GHSA-wr9h-4r83-f4v6 / CVE-2026-54002 (getkirby/kirby, output_encoding, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). _Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize(_ +- GHSA-4v4h-m2qq-ppgw / CVE-2026-50188 (getkirby/kirby, output_encoding, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). _Kirby: Request header injection in `Http\Remote`_ +- GHSA-rhj6-r49h-5932 / CVE-2026-49276 (getkirby/kirby, output_encoding, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). _Kirby: Self cross-site scripting (self-XSS) in the writer field_ +- GHSA-23q2-54qv-rq5x / CVE-2026-49274 (getkirby/kirby, access_control, 2026-06-18): one case per repository (repository taken as kirby-realpath-sibling-traversal). _Kirby: `pages.access` permission is not checked in the pages picker for parent pages_ +- GHSA-pmf8-g7c8-7v54 / CVE-2026-55890 (getgrav/grav, output_encoding, 2026-06-18): one case per repository (repository taken as grav-blueprint-bare-function-rce). _Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() —_ +- GHSA-7p36-fq2r-4h7r / CVE-2026-11407 (pimcore/pimcore, injection, 2026-06-17): repo over ~150 MB (534 MB per GitHub API). _Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed_ +- GHSA-m9cv-24rx-8mv7 / CVE-2026-55409 (filamentphp/filament, output_encoding, 2026-06-17): repo over ~150 MB (582 MB per GitHub API). _Filament: Disabled RichEditor field state can be used for XSS_ +- GHSA-m557-wrgg-6rp4 / CVE-2026-55599 (phpseclib/phpseclib, untrusted_destination, 2026-06-16): general-purpose library: the attacker source lies in the calling application, not in the repo. _phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (serve_ +- GHSA-9mmg-q95p-gp67 / CVE-2026-50886 (firefly-iii/firefly-iii, access_control, 2026-06-15): repo over ~150 MB (313 MB per GitHub API). _Project Firefly III has incorrect access control in the webhook management component_ +- GHSA-h5x3-xfc9-m39h / CVE-2026-48784 (symfony/symfony, untrusted_destination, 2026-06-15): repo over ~150 MB (339 MB per GitHub API). _Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Gener_ +- GHSA-38cx-cq6f-5755 / CVE-2026-48736 (symfony/symfony, untrusted_destination, 2026-06-15): repo over ~150 MB (339 MB per GitHub API). _Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-c_ +- GHSA-6h46-9jf5-q59x / CVE-2026-48489 (symfony/symfony, access_control, 2026-06-15): repo over ~150 MB (339 MB per GitHub API). _Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access t_ +- GHSA-x5qj-865h-mgvm / CVE-2026-48761 (symfony/symfony, output_encoding, 2026-06-15): repo over ~150 MB (339 MB per GitHub API). _Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes_ +- GHSA-vv4x-qcpq-wgrg / CVE-2026-12198 (microweber/microweber, path, 2026-06-15): repo over ~150 MB (1185 MB per GitHub API). _Microweber vulnerable to Path Traversal_ +- GHSA-pjpj-v387-x4vq / CVE-2026-11607 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS has Broken Access Control in its Form Framework_ +- GHSA-f34x-rx2w-7pm3 / CVE-2026-47349 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS has Broken Access Control in the Recycler Module_ +- GHSA-3p42-w5ch-gg42 / CVE-2026-47347 (typo3/typo3, untrusted_destination, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities_ +- GHSA-3v8v-4wg6-r7qh / CVE-2026-47343 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS: Destructive Actions on File Mount Folders_ +- GHSA-p5j5-4j3q-8mq8 / CVE-2026-47345 (typo3/html-sanitizer, output_encoding, 2026-06-12): general-purpose library: the attacker source lies in the calling application, not in the repo. _TYPO3 HTML Sanitizer allows Cross-site Scripting_ +- GHSA-jh32-v29g-68pq / CVE-2026-49741 (typo3/typo3, access_control/injection, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework_ +- GHSA-qcmw-6rm2-5x78 / CVE-2026-47350 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS has Broken Access Control in its DataHandler_ +- GHSA-hwvq-2w67-rvxp / CVE-2026-47346 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS has Broken Access Control in its Form Framework_ +- GHSA-chm7-4vch-h8vr / CVE-2026-49742 (typo3/typo3, path, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS has Broken Access Control in its Media Module_ +- GHSA-c78m-c52x-jgwp / CVE-2026-49740 (typo3/typo3, deserialization, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS has Insecure Deserialization via Core API_ +- GHSA-jf56-v8jc-jcc5 / CVE-2026-49738 (typo3/typo3, path, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS has Broken Access Control in its File Abstraction Layer_ +- GHSA-2j54-93q2-3hjq / CVE-2026-47352 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS has Broken Access Control in Backend API_ +- GHSA-q93m-25xv-94hh / CVE-2026-47351 (typo3/typo3, access_control, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS: Broken Access Control in Media Module_ +- GHSA-cg75-qfg2-w9hj / CVE-2026-47348 (typo3/typo3, output_encoding, 2026-06-12): repo over ~150 MB (644 MB per GitHub API). _TYPO3 CMS has Cross-Site Scripting in Indexed Search_ +- GHSA-jvf5-rxvv-3mcg / CVE-2026-47344 (typo3/html-sanitizer, output_encoding, 2026-06-12): general-purpose library: the attacker source lies in the calling application, not in the repo. _TYPO3 HTML Sanitizer allows Cross-site Scripting_ +- GHSA-6jq6-x4cx-qvcm (firefly-iii/firefly-iii, output_encoding, 2026-06-12): repo over ~150 MB (313 MB per GitHub API). _Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)_ +- GHSA-7q3w-xqjw-g3cr / CVE-2026-48067 (filamentphp/filament, access_control, 2026-06-11): repo over ~150 MB (582 MB per GitHub API). _Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Selec_ +- GHSA-34xg-wgjx-8xph / CVE-2026-48998 (guzzle/psr7, untrusted_destination, 2026-06-11): general-purpose library: the attacker source lies in the calling application, not in the repo. _guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation_ +- GHSA-hq7v-mx3g-29hw / CVE-2026-49214 (guzzle/psr7, output_encoding, 2026-06-11): general-purpose library: the attacker source lies in the calling application, not in the repo. _guzzlehttp/psr7 has CRLF Injection via URI Host Component_ +- GHSA-q8r6-5hfw-5jff / CVE-2026-53723 (guzzle/guzzle-services, injection, 2026-06-11): general-purpose library (`guzzlehttp/guzzle-services` XML serialization); vulnerable only when the host application passes its own data or configuration to the API; no attacker source reaches the flaw inside the repository. _guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDAT_ +- GHSA-g82f-9pw7-773w / CVE-2026-10721 (concretecms/concretecms, deserialization, 2026-06-10): repo over ~150 MB (303 MB per GitHub API). _Concrete CMS: PHP Object Injection via unserialize() calls_ +- GHSA-wmjr-58rf-xgrc / CVE-2026-53675 (buddypress/buddypress, access_control, 2026-06-10): one case per repository (repository taken as wp-buddypress-messages-rest-idor). _BuddyPress: Any authenticated attacker can enumerate another user's complete friend list v_ +- GHSA-j3j5-5m8v-7gvc / CVE-2026-53673 (buddypress/buddypress, access_control, 2026-06-10): **taken** as wp-buddypress-messages-rest-idor. _BuddyPress: Authenticated attackers can access arbitrary private message threads via user__ +- GHSA-jvc5-6g7q-c843 / CVE-2026-48030 (pheditor/pheditor, injection, 2026-06-09): repo in used list (already referenced under benchmarks/src/tests/.kiro). _Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter_ +- GHSA-pr6f-87hf-hx24 / CVE-2026-50636 (limesurvey/limesurvey, injection, 2026-06-09): repo over ~150 MB (1457 MB per GitHub API). _LimeSurvey has a SQL Injection issue_ +- GHSA-87m4-826x-3crx / CVE-2026-45034 (phpoffice/phpspreadsheet, deserialization, 2026-06-08): general-purpose library: the attacker source lies in the calling application, not in the repo. _PHPSpreadsheet has a patch bypass for CVE-2026-34084 _ +- GHSA-2g2g-8p8h-fgwm / CVE-2026-47730 (twigphp/twig, output_encoding, 2026-06-05): general-purpose library: the attacker source lies in the calling application, not in the repo. _Twig: XSS in profiler HtmlDumper via unescaped template and profile names_ +- GHSA-c3qp-2ggw-xjg7 / CVE-2026-47744 (shopperlabs/shopper, access_control, 2026-06-05): repo over ~150 MB (151 MB per GitHub API). _Shopper: Authorization bypass and RBAC privilege escalation in team settings_ +- GHSA-hr9v-r8r2-hg7j / CVE-2026-47743 (shopperlabs/shopper, access_control/output_encoding, 2026-06-05): repo over ~150 MB (151 MB per GitHub API). _Shopper: Multiple data integrity and disclosure issues in admin Livewire components_ +- GHSA-fxqw-97cc-7g5c / CVE-2026-47745 (shopperlabs/shopper, access_control, 2026-06-05): repo over ~150 MB (151 MB per GitHub API). _Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin_ +- GHSA-h4mp-g9c6-xwph / CVE-2026-47742 (shopperlabs/shopper, access_control, 2026-06-05): repo over ~150 MB (151 MB per GitHub API). _Shopper: Missing authorization on Product admin Livewire sub-form components_ +- GHSA-vg35-5wq7-3x7w / CVE-2026-47761 (tinymce/tinymce, output_encoding, 2026-06-05): repo over ~150 MB (152 MB per GitHub API). _TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` inje_ +- GHSA-v98h-vmpc-fpqv / CVE-2026-47762 (tinymce/tinymce, output_encoding, 2026-06-05): repo over ~150 MB (152 MB per GitHub API). _TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments_ +- GHSA-q742-qvgc-gc2f / CVE-2026-47759 (tinymce/tinymce, output_encoding, 2026-06-05): repo over ~150 MB (152 MB per GitHub API). _TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, hre_ +- GHSA-mh5m-5hw4-5c69 / CVE-2026-47760 (tinymce/tinymce, output_encoding, 2026-06-05): repo over ~150 MB (152 MB per GitHub API). _TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested _ +- GHSA-gq96-5pfx-f4vc / CVE-2026-48013 (shopware/shopware, untrusted_destination, 2026-06-04): repo over ~150 MB (521 MB per GitHub API). _Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation_ +- GHSA-xvhc-gm7j-mhmc / CVE-2026-48015 (shopware/shopware, output_encoding, 2026-06-04): repo over ~150 MB (521 MB per GitHub API). _Shopware: Stored XSS via SVG file upload — no SVG sanitization_ +- GHSA-f8q6-3g5w-jjr6 / CVE-2026-48014 (shopware/shopware, access_control, 2026-06-04): repo over ~150 MB (521 MB per GitHub API). _Shopware: Admin API ACL Bypass in Order State Transition Endpoints_ +- GHSA-4x3x-869w-xx3m / CVE-2026-48012 (shopware/shopware, untrusted_destination, 2026-06-04): repo over ~150 MB (521 MB per GitHub API). _Shopware SSO referer trust leading to an arbitrary redirect target_ +- GHSA-gv8p-48fr-4fxg / CVE-2026-48008 (shopware/shopware, access_control, 2026-06-04): repo over ~150 MB (521 MB per GitHub API). _Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass_ +- GHSA-8whc-2wmv-ww35 / CVE-2026-54458 (wwbn/avideo, output_encoding, 2026-06-04): repo over ~150 MB (664 MB per GitHub API). _WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broad_ +- GHSA-66q5-cj5g-wrfx / CVE-2026-50183 (wwbn/avideo, output_encoding, 2026-06-04): repo over ~150 MB (664 MB per GitHub API). _WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Secti_ +- GHSA-hgjh-6wj8-gcgf / CVE-2026-50182 (wwbn/avideo, output_encoding, 2026-06-04): repo over ~150 MB (664 MB per GitHub API). _WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Galler_ +- GHSA-2fhx-q92v-5fhv / CVE-2026-49279 (wwbn/avideo, output_encoding, 2026-06-04): repo over ~150 MB (664 MB per GitHub API). _WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (_ +- GHSA-c8h8-vq34-9fw2 / CVE-2026-47694 (wwbn/avideo, output_encoding, 2026-06-04): repo over ~150 MB (664 MB per GitHub API). _WWBN AVideo: Stored XSS via unescaped Gallery category description_ +- GHSA-52pr-7vmf-2w7x / CVE-2026-7888 (concretecms/concretecms, deserialization, 2026-06-03): repo over ~150 MB (303 MB per GitHub API). _Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow_ +- GHSA-m8xx-3x29-84h8 / CVE-2022-31114 (laravel-backpack/crud, output_encoding, 2026-06-03): one case per repository (repository taken as backpack-stats-host-header-cmdi). _backpack/crud is vulnerable to Cross-Site Scripting (XSS)_ + +Passed over (not examined; family quota already met): GHSA-7wwh-xcc3-9fcg (paymenter/paymenter, untrusted_destination, 2026-06-22); GHSA-86hp-hf3j-3m8r (cotonti/cotonti, output_encoding, 2026-06-18); GHSA-hhpq-7wg4-36jm (cakephp/authentication, untrusted_destination, 2026-06-17); GHSA-crmm-hgp2-wgrp (laravel/framework, output_encoding, 2026-06-17); GHSA-gmxh-hjfv-qc2w (benjaminjonard/koillection, untrusted_destination, 2026-06-15); GHSA-p85r-x2wj-mxqj (shlinkio/shlink, untrusted_destination, 2026-06-15); GHSA-wrcg-234w-hfhq (intelliants/subrion, output_encoding, 2026-06-15). + +### Lane B: unreviewed advisories with a GitHub fix reference on a PHP repository + +- GHSA-84f7-xff5-hx38 / CVE-2022-51019 (akaunting/akaunting, injection, 2026-09-29): republished old vulnerability (CVE-2022-51019, fixed in Akaunting 2.1.31 in 2022), not a 2026 advisory; also advisory names no vulnerable file or function (only 'the alias parameter' of module installation). _Akaunting before 2.1.31 contains an OS command injection vulnerability in the module insta_ +- GHSA-rv7j-2hq3-r6fq / CVE-2024-58386 (zoneminder/zoneminder, path, 2026-09-29): repo over ~150 MB (161 MB per GitHub API). _ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the fil_ +- GHSA-gxmj-vr4j-8j5c / CVE-2026-100884 (krayin/laravel-crm, path, 2026-09-28): the named location is not declarable: the advisory (VulDB text) puts 'the function Storage::download' in `packages/Webkul/Admin/src/Config/acl.php`, a configuration file; the weakness described is an IDOR (CWE-99 'resource identifiers'), not a path. _A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is _ +- GHSA-7q7h-5g76-8cq4 / CVE-2026-100520 (crivion/laranode, path, 2026-09-26): advisory names no vulnerable file or function (only the `POST /filemanager/upload-file` endpoint and its `path` parameter). _Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /fileman_ +- GHSA-vm72-96wq-2ppv / CVE-2026-96744 (mongodb/laravel-mongodb, injection, 2026-09-24): general-purpose library (`mongodb/laravel-mongodb` cache lock); the attacker source lies in the calling application. _Improper neutralization of special elements in data query logic in the cache lock implemen_ +- GHSA-c7hm-qgxh-6vgg / CVE-2026-95701 (misp/misp, path, 2026-09-22): repo over ~150 MB (201 MB). _In MISP, the __statisticsOrgs method in UsersController.php used the organization name dir_ +- GHSA-24qr-3pqh-xghm / CVE-2026-95698 (misp/misp, path, 2026-09-22): repo over ~150 MB (201 MB). _The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenati_ +- GHSA-f496-75v4-rv5q / CVE-2026-95693 (misp/misp, path, 2026-09-22): repo over ~150 MB (201 MB). _In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name fie_ +- GHSA-qjpg-gmh7-3ch6 / CVE-2026-95667 (misp/misp, path, 2026-09-22): repo over ~150 MB (201 MB). _The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a_ +- GHSA-2jvm-986q-589g / CVE-2026-94401 (misp/misp, path, 2026-09-21): repo over ~150 MB (201 MB). _MISP has a file-handling vulnerability that could let certain authenticated users make the_ +- GHSA-7c6f-jc48-6hfq / CVE-2026-94106 (jamesheinrich/getid3, injection, 2026-09-20): general-purpose library (getID3 media parser); the attacker source lies in the calling application. _getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers _ +- GHSA-pjph-5h96-886c / CVE-2026-93988 (qloapps/qloapps, path, 2026-09-20): one case per repository (repository taken as qloapps-customermessage-bo-query-sqli). _QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action o_ +- GHSA-3v3g-3pf9-fgcf / CVE-2026-93872 (cotonti/cotonti, deserialization, 2026-09-18): no fix diff: the referenced PR #1897 is not merged, and `plugins/comments/controllers/actions/EditAction.php` has no later commit. _Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_clas_ +- GHSA-q246-734p-8872 / CVE-2026-93533 (spatie/scotty, injection, 2026-09-18): developer CLI (`scotty` SSH task runner, `DoctorCommand`), not a web application; the fix PR 'awaits acceptance'. _A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function..._ +- GHSA-qqx6-v32j-728q / CVE-2026-89036 (appwrite/appwrite, injection, 2026-09-17): repo over ~150 MB (532 MB). _Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticat_ +- GHSA-2vrr-cgr4-gfmm / CVE-2026-76834 (b2evolution/b2evolution, deserialization, 2026-09-17): repo over ~150 MB (182 MB). _b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 w_ +- GHSA-6wrp-rq46-2frr / CVE-2026-92970 (hubzero/hubzero-cms, path, 2026-09-17): repo over ~150 MB (359 MB). _HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload._ +- GHSA-xv9c-9hwm-jp8g / CVE-2026-91939 (cotonti/cotonti, deserialization, 2026-09-15): no fix diff: the referenced PR #1889 is not merged. _Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without..._ +- GHSA-63h9-9gmf-c466 / CVE-2020-15875 (librenms/librenms, injection, 2026-09-13): repo over ~150 MB (369 MB). _An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal priv_ +- GHSA-6hw9-7gx5-mw88 / CVE-2026-85200 (fitoussi/geo-my-wp, path, 2026-09-12): **taken** as wp-geo-my-wp-info-window-lfi. _The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions u_ +- GHSA-hh3c-hgv7-gg2r / CVE-2026-79362 (woltlab/wcf, injection, 2026-09-11): repo over ~150 MB (203 MB). _Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1_ +- GHSA-w3w8-r2xc-3rp3 / CVE-2024-58381 (pmmp/pocketmine-mp, deserialization, 2026-09-09): game server (Minecraft Bedrock), not a web application; old vulnerability (CVE-2024-58381); the impact is denial of service. _PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON_ +- GHSA-cw46-936q-fjcf / CVE-2026-57777 (woocommerce/woocommerce, injection, 2026-09-04): repo over ~150 MB (932 MB). _Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')..._ +- GHSA-xf4v-vq77-2rgv / CVE-2026-84694 (coollabsio/coolify, injection, 2026-09-02): advisory names no vulnerable file or function (only 'environment variable key names in Docker commands'). _Coolify before 4.2.0 fails to properly escape environment variable key names in Docker com_ +- GHSA-46j6-w3hw-4r9x / CVE-2026-71981 (cypht-org/cypht, deserialization, 2026-09-01): advisory names no vulnerable file or function (only 'the back_query GET parameter of the logout handler'); the fix is known (`e4aa2f34`, merge of PR #2073) — the nearest alternate for deserialization if the naming rule is relaxed. _Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticate_ +- GHSA-v64j-pgc3-qgc9 / CVE-2026-82668 (klaussilveira/gitlist, injection, 2026-08-31): **taken** as gitlist-commandline-cmdi. _A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by thi_ +- GHSA-j8xc-7c27-7wj4 / CVE-2026-81728 (dolibarr/dolibarr, injection, 2026-08-27): repo over ~150 MB (1705 MB). _Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wiz_ +- GHSA-xf89-whcw-pq6g / CVE-2020-15878 (librenms/librenms, injection, 2026-08-26): repo over ~150 MB (369 MB). _An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal priv_ +- GHSA-2658-wj4j-m387 / CVE-2020-15876 (librenms/librenms, injection, 2026-08-26): repo over ~150 MB (369 MB). _An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal priv_ +- GHSA-6h76-35rh-gxm9 / CVE-2026-80428 (ilias-elearning/ilias, deserialization, 2026-08-26): repo over ~150 MB (3341 MB). _ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-_ +- GHSA-4rvx-xf2v-6r64 / CVE-2020-15874 (librenms/librenms, injection, 2026-08-26): repo over ~150 MB (369 MB). _An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal priv_ +- GHSA-5w6r-2mxc-fq3v / CVE-2026-75497 (qloapps/qloapps, injection, 2026-08-25): **taken** as qloapps-customermessage-bo-query-sqli. _Webkul QloApps does not validate request parameters before a database query. A remote,..._ +- GHSA-mj48-jjc7-6wqr / CVE-2026-75498 (qloapps/qloapps, injection, 2026-08-25): one case per repository (repository taken as qloapps-customermessage-bo-query-sqli). _Webkul QloApps does not validate request parameters before a database query. A remote,..._ +- GHSA-8x6f-m45x-3rjp / CVE-2026-71905 (volmarg/personal-management-system, injection/path, 2026-08-24): corrupt advisory record: the description is about DrayTek VigorAP routers, not this repository. _Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSet_ +- GHSA-2c9p-fq48-6545 / CVE-2026-75007 (roundcube/roundcubemail, injection, 2026-08-17): advisory names no vulnerable file or function (only 'the LDAP search filter ... %u/%fu/%d substitution'). _In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subj_ +- GHSA-m462-3x7r-5r7f / CVE-2026-75002 (roundcube/roundcubemail, injection, 2026-08-17): advisory names no vulnerable file or function (only 'mail search and LITERAL+ byte-count desynchronization'). _In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-c_ +- GHSA-q5rh-mmp4-ppgq / CVE-2026-74997 (roundcube/roundcubemail, injection, 2026-08-17): **taken** as roundcube-markasjunk-cmd-learn-rce. _In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the mar_ +- GHSA-4x4q-mx3g-g3m2 / CVE-2026-73680 (cockpit-hq/cockpit, injection, 2026-08-14): advisory names no vulnerable file or function in the repository (only the library call `Process::fromShellCommandline()` and 'the FFmpeg integration'). _Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg inte_ +- GHSA-w54w-xf28-wf79 / CVE-2026-71248 (harsh21patel/inventory-management-system-php, injection, 2026-08-05): personal/student project (`harsh21patel/inventory-management-system-php`), not a maintained application. _Inventory-Management-System-PHP's login.php constructs its authentication query via direct_ +- GHSA-cv48-22qx-mpmx / CVE-2026-71232 (magicblack/maccms10, injection, 2026-08-05): **taken** as maccms10-template-blacklist-rce. _MacCMS10's admin template editor (application/admin/controller/Template.php) blocks danger_ + +Passed over (not examined; family quota already met): GHSA-5528-3vrx-6443 (octobercms/october, untrusted_destination, 2026-09-28); GHSA-g8jm-3grw-8wh2 (cotonti/cotonti, untrusted_destination, 2026-09-26); GHSA-gmhw-pxmg-j22w (jamesheinrich/getid3, untrusted_destination, 2026-09-20); GHSA-gp9j-h9gm-p3q2 (cotonti/cotonti, untrusted_destination, 2026-09-18); GHSA-5p43-vwpq-wm4q (cotonti/cotonti, untrusted_destination, 2026-09-18); GHSA-w83g-wg62-w3qm (laradashboard/laradashboard, untrusted_destination, 2026-09-09); GHSA-pmmj-hr44-h52v (ilias-elearning/ilias, path, 2026-08-31); GHSA-wvjm-58fp-5q8g (yaojingang/geoflow, untrusted_destination, 2026-08-31); GHSA-gf7h-mv4h-gg7c (yaojingang/geoflow, path, 2026-08-31); GHSA-jgch-2jr2-87vj (dolibarr/dolibarr, path, 2026-08-27); GHSA-g95v-m725-f6xc (volmarg/personal-management-system, path, 2026-08-27); GHSA-gqr6-9g7c-7g7r (wintercms/winter, path, 2026-08-25); GHSA-j9wc-mrp3-532h (hieventsdev/hi.events, untrusted_destination, 2026-08-24); GHSA-7994-gr8j-h7xp (openemr/openemr, path, 2026-08-19); GHSA-vf28-qp34-hhm8 (roundcube/roundcubemail, untrusted_destination, 2026-08-17); GHSA-qf4h-jxxc-wvr9 (getgrav/grav, path, 2026-08-14); GHSA-qrrp-6pvj-xfvf (rconfig/rconfig, path, 2026-08-12); GHSA-f3gp-9xr4-qmvc (joomla/joomla-cms, path, 2026-08-12); GHSA-7gmf-8rwv-m7jc (ayecode/geodirectory, path, 2026-08-11); GHSA-8879-fh4f-q3qm (krayin/laravel-crm, injection, 2026-08-03); GHSA-pw6j-6h33-fv96 (ayecode/invoicing, path, 2026-08-01); GHSA-rfxf-9pcf-q3rq (leantime/leantime, untrusted_destination, 2026-07-30); GHSA-pjx9-wh57-j26p (leantime/leantime, untrusted_destination, 2026-07-30); GHSA-frjf-677q-65jf (misp/misp, untrusted_destination, 2026-07-28); GHSA-hc3p-4h64-j8wr (getgrav/grav-plugin-api, path, 2026-07-23); GHSA-9wvj-rhhh-8292 (simplemachines/smf, untrusted_destination, 2026-07-14); GHSA-5q79-cfqm-5cxh (roundcube/roundcubemail, untrusted_destination, 2026-07-14); GHSA-cfx5-q5qm-x936 (cockpit-hq/cockpit, path, 2026-07-14); GHSA-9fmc-j924-ghh2 (plank/laravel-mediable, untrusted_destination, 2026-07-13); GHSA-j69f-3cmp-jrjj (ayecode/userswp, path, 2026-07-09); GHSA-7793-hmg3-gh57 (librebooking/librebooking, path, 2026-07-09); GHSA-4crx-2rrv-xxcf (horde/vfs, injection, 2026-07-08); GHSA-qfr5-75q5-g2c7 (kirilkirkov/ecommerce-codeigniter-bootstrap, path, 2026-07-04); GHSA-jf5m-wm8f-5pq9 (kirilkirkov/ecommerce-codeigniter-bootstrap, untrusted_destination, 2026-07-04); GHSA-r5xq-x4r6-7g6x (kirilkirkov/ecommerce-codeigniter-bootstrap, path, 2026-07-04); GHSA-233w-5rfj-8hmj (myvesta/vesta, injection, 2026-07-04); GHSA-cr5v-q482-32fc (phpipam/phpipam, path, 2026-07-04); GHSA-cgfv-42v7-7f53 (notifiarr/dockwatch, injection, 2026-07-02); GHSA-mv7w-qwqh-w2g9 (horde/imp, path, 2026-07-01); GHSA-2852-jv28-2mv8 (dolibarr/dolibarr, injection, 2026-06-30); GHSA-w5j4-x499-pfwp (frontaccountingerp/fa, injection, 2026-06-29); GHSA-8ccm-j5hq-9jhr (frontaccountingerp/fa, injection, 2026-06-29); GHSA-53v3-ffpm-f9hw (frontaccountingerp/fa, injection, 2026-06-29); GHSA-9fmm-h59x-wr53 (frontaccountingerp/fa, path, 2026-06-29); GHSA-7v9f-64q7-x2jg (misp/misp, injection, 2026-06-22); GHSA-qrw9-xj5g-qxw8 (chilek/lms, injection, 2026-06-18); GHSA-765c-7qf8-cw9w (chilek/lms, injection, 2026-06-18); GHSA-c4wp-7485-699w (misp/misp, path, 2026-06-12); GHSA-83v9-496w-54wx (wpusermanager/wp-user-manager, path, 2026-06-06); GHSA-9gjj-gmcx-6fhj (misp/misp, untrusted_destination, 2026-06-04); GHSA-rx96-8w86-5hhh (misp/misp, untrusted_destination, 2026-06-04); GHSA-93rv-mf2v-vv2r (php-censor/php-censor, injection, 2026-06-01). + +### Lane C: deserialization (WordPress and other PHP products without a GitHub fix reference) + +- GHSA-ggx5-r53p-pf97 / CVE-2026-86841 (WordPress plugin, deserialization, 2026-09-27): advisory names no vulnerable function or file. _The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does no_ +- GHSA-j2rf-55r9-c5ph / CVE-2026-80513 (WordPress plugin, deserialization, 2026-09-24): advisory names no vulnerable function or file (only 'a user-supplied profile field value'). _The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be inst_ +- GHSA-jvgp-rj42-qjww / CVE-2026-91827 (WordPress plugin, deserialization, 2026-09-22): advisory names no vulnerable function or file; Ninja Forms has no public development repository. _The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values _ +- GHSA-wq6q-gx9m-7669 / CVE-2026-19658 (WordPress plugin, deserialization, 2026-09-22): advisory names no vulnerable function or file. _The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versio_ +- GHSA-gjf4-862p-rg96 (Softaculous Virtualizor, deserialization, 2026-09-22): proprietary product, no public repository. +- GHSA-mwgw-rr28-m856 (CuteNews 2.1.2, deserialization, 2026-09-21): no fix diff (the advisory links only the master blob of core/core.php and a disclosure repository; cutenews/cutenews-2.0 has no commit since 2026-06). +- GHSA-3wpx-h7q2-mv8g / CVE-2026-85017 (WordPress plugin, deserialization, 2026-09-20): advisory names no vulnerable function or file (an unnamed AJAX action). _The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a cap_ +- GHSA-mqfm-qx5g-96vc / CVE-2026-17086 (WordPress plugin, deserialization, 2026-09-18): advisory names no vulnerable function or file. _The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress_ +- GHSA-cg5c-mg8j-jqc2 / CVE-2026-78175 (WordPress plugin, deserialization, 2026-09-12): no single identifiable fix diff: in themeum/tutor the withdraw-field fix was committed (`0f0b2b20`), reverted (`0f730b86`), re-applied as an empty commit (`1da79c03`) and followed by `642c8f5c`, all on a branch merged with several unrelated security fixes. _The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to_ +- GHSA-4q25-cq4p-f83q / CVE-2026-78006 (WordPress plugin, deserialization, 2026-09-12): repo over ~150 MB (the-events-calendar/the-events-calendar, 153 MB per GitHub API). _The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all_ +- GHSA-w3rx-h7m8-2ggf / CVE-2026-84099 (WordPress plugin, deserialization, 2026-09-12): advisory names no vulnerable function or file (an unnamed bundled add-on). _The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated ac_ +- GHSA-mv63-gmf8-5x76 / CVE-2026-82845 (WordPress plugin, deserialization, 2026-09-12): advisory names no vulnerable function or file. _The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values hel_ +- GHSA-3237-mv84-xmm9 / CVE-2026-82925 (WordPress plugin, deserialization, 2026-09-10): advisory names no vulnerable function or file. _The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being de_ +- GHSA-3xv5-w7r3-9wj8 (FileRun, deserialization, 2026-09-10): proprietary product, no public repository. +- GHSA-7jv8-f84m-pq5j / CVE-2026-11363 (WordPress plugin, deserialization, 2026-09-09): advisory names no vulnerable function or file; no public development repository. _The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vul_ +- GHSA-2phq-cm26-22pm (MaxSite CMS, deserialization, 2026-09-09): no fix diff (maxsite/cms has no fix commit after the 2026-09-08 disclosure). +- GHSA-mmpp-99gg-2rq8 / CVE-2026-16502 (WordPress plugin, deserialization, 2026-09-08): advisory names no vulnerable function or file. _The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to P_ +- GHSA-v38w-pf7m-c3pr / CVE-2026-10196 (WordPress plugin, deserialization, 2026-09-05): function named (`handle_form_submission`) but no public development repository (GitHub has only an SVN mirror, common-repository/mail-mint, last push 2024). _The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin _ +- GHSA-fq25-6gpx-5vxf / CVE-2026-19887 (WordPress plugin, deserialization, 2026-09-05): function named (`usces_action_acting_transaction`) but no development repository (only SVN mirrors of usc-e-shop). _The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all v_ +- GHSA-xw87-h6v2-j87m / CVE-2023-3360 (WordPress plugin, deserialization, 2026-09-02): republished old vulnerability (CVE-2023-3360). _The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an importe_ +- GHSA-f6hp-2qj5-48vv / CVE-2026-19116 (WordPress plugin, deserialization, 2026-09-02): advisory names no vulnerable function or file. _The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field val_ +- GHSA-w8mx-gm67-wrqq / CVE-2026-76547 (WordPress plugin, deserialization, 2026-08-29): advisory names no vulnerable function or file. _The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data_ +- GHSA-j5mw-m2j3-5747 / CVE-2026-14558 (WordPress plugin, deserialization, 2026-08-28): advisory names no vulnerable function or file. _The User Frontend WordPress plugin before 4.3.10 does not properly validate field type de_ +- GHSA-rm66-h7v3-77rx / CVE-2026-78572 (WordPress plugin, deserialization, 2026-08-25): advisory names no vulnerable function or file. _The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versio_ +- GHSA-89vc-p8p8-f8q8 / CVE-2026-32563 (WordPress plugin, deserialization, 2026-08-25): advisory names no vulnerable function or file (Patchstack one-line record). _Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= _ +- GHSA-mj2c-4qfw-rhhc (TYPO3 extension (unnamed), deserialization, 2026-08-25): advisory names neither the extension's repository nor a function. +- GHSA-r2vh-j53r-xpr5 (TYPO3 extension (Apache Solr for TYPO3), deserialization, 2026-08-25): no function or file named (only content object types), no fix link. +- GHSA-fgg6-3rw5-h3j8 / CVE-2026-0551 (WordPress plugin, deserialization, 2026-08-23): advisory names no vulnerable function or file (only the 'post_protection_roles' parameter). _The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injecti_ +- GHSA-hpc2-mqfw-fq4q / CVE-2026-4703 (WordPress plugin, deserialization, 2026-08-22): advisory names no vulnerable function or file. _The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to _ +- GHSA-p6x4-h8m9-9mr2 / CVE-2024-13784 (WordPress plugin, deserialization, 2026-08-16): republished old vulnerability (CVE-2024-13784); advisory names no vulnerable function or file. _The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vuln_ +- GHSA-v2rq-f773-w46v / CVE-2026-10035 (WordPress plugin, deserialization, 2026-08-16): function named (`wvrbbp_set_to_serialized_values()`) but no development repository (only the SVN mirror common-repository/weaver-for-bbpress). _The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Inject_ +- GHSA-q83h-6954-x259 / CVE-2026-16099 (WordPress plugin, deserialization, 2026-08-16): **taken** as wp-podlove-generation-guard-poi. _The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletio_ +- GHSA-jxc3-pfg8-hv86 / CVE-2026-16267 (WordPress plugin, deserialization, 2026-08-08): advisory names no vulnerable function or file. _The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when un_ +- GHSA-m7vw-4232-p79x / CVE-2026-16258 (WordPress plugin, deserialization, 2026-08-07): advisory names no vulnerable function or file. _The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization _ +- GHSA-rm37-v7mc-6795 (Cotonti, deserialization, 2026-08-05): third Cotonti comments deserialization record; no merged fix (see lane B). +- GHSA-jm66-348j-qvv2 (MaxSite CMS, deserialization, 2026-08-04): no fix diff. +- GHSA-5953-j744-chvm / CVE-2026-16297 (WordPress plugin, deserialization, 2026-08-03): advisory names no vulnerable function or file. _The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed whe_ +- GHSA-w2rh-rmh8-jmwq / CVE-2025-15672 (WordPress plugin, deserialization, 2026-08-03): republished old vulnerability (CVE-2025-15672); advisory names no vulnerable function or file. _The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before p_ +- GHSA-xh9j-gpmv-5c2v / CVE-2026-16062 (WordPress plugin, deserialization, 2026-08-02): advisory names no vulnerable function or file. _The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent _ +- GHSA-rpvq-6gf9-58vg / CVE-2026-12720 (WordPress plugin, deserialization, 2026-07-31): advisory names no vulnerable function or file; themeum/kirki has no 6.x code (v2 research). _The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantia_ +- GHSA-95g3-wxff-cpfp / CVE-2026-1360 (WordPress plugin, deserialization, 2026-07-30): function named (`bp_unserialize_profile_field()`), but no fix commit is identifiable in buddypress/buddypress (history of `src/bp-xprofile/bp-xprofile-functions.php` from 2026-06 shows only coding-standard and PHPDoc commits); the repo is taken anyway by wp-buddypress-messages-rest-idor. _The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in _ +- GHSA-4f62-78r3-84fq (Joomla extension Aimy Captcha-Less Form Guard, deserialization, 2026-07-29): commercial extension, no public repository. +- GHSA-2hhm-rw5g-m2vq / CVE-2026-15962 (WordPress plugin, deserialization, 2026-07-26): advisory names no vulnerable function or file. _The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injectio_ +- GHSA-m5q4-xwgp-qwg2 / CVE-2026-15008 (WordPress plugin, deserialization, 2026-07-16): fix only inside a whole-release commit (UncannyOwl/Uncanny-Automator `ec5fde67` 'v7.4.0'). _The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin p_ +- GHSA-cxqr-jhpf-63mm / CVE-2026-12583 (WordPress plugin, deserialization, 2026-07-14): advisory names no vulnerable function or file. _The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted_ +- GHSA-ww5c-p3qw-8xxf / CVE-2026-12240 (WordPress plugin, deserialization, 2026-06-30): no development repository on GitHub (only unrelated or stale repositories named export-user-data). _The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to _ +- GHSA-46p4-p677-cfjc / CVE-2025-69130 (WordPress plugin, deserialization, 2026-06-17): advisory names no vulnerable function or file (Patchstack one-line record, a commercial theme). _Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress T_ +- GHSA-v8h4-8wcw-7gjp / CVE-2026-12115 (WordPress plugin, deserialization, 2026-06-17): advisory names no vulnerable function or file. _The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPr_ +- GHSA-r622-c48h-h6qq / CVE-2026-8365 (WordPress plugin, deserialization, 2026-06-09): function named (`blocksy_sanitize_post_meta_options()`) but no public development repository for the Blocksy theme was found. _The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Co_ +- GHSA-4jj4-xwhh-x5m2 / CVE-2026-7566 (WordPress plugin, deserialization, 2026-06-06): excluded by name (LearnPress add-on); advisory names no vulnerable function or file. _The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object _ +- GHSA-h6x4-229g-5f43 / CVE-2026-7654 (WordPress plugin, deserialization, 2026-06-06): **taken** as wp-admin-columns-ids-to-collection-poi. _The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Re_ + diff --git a/tests/test_independent_population.py b/tests/test_independent_population.py index 3f8d66c..859ed16 100644 --- a/tests/test_independent_population.py +++ b/tests/test_independent_population.py @@ -17,7 +17,9 @@ import pytest ROOT = Path(__file__).resolve().parents[1] POPULATIONS = sorted((ROOT / "benchmarks" / "independent").glob("population-v*.toml")) POPULATION = POPULATIONS[0] -FAMILIES = {"injection", "untrusted_destination", "config_secrets"} +# v1 and v2 score injection, untrusted_destination and config_secrets; v3 (PHP) adds the other four families that +# protocol-v3.md pre-registers matching rules for. +FAMILIES = {"injection", "untrusted_destination", "config_secrets", "path", "output_encoding", "access_control", "deserialization"} SHA = re.compile(r"[0-9a-f]{40}") @@ -28,7 +30,7 @@ def _population(path: Path = POPULATION) -> dict: @pytest.mark.parametrize("path", POPULATIONS, ids=lambda p: p.stem) def test_the_reservation_is_well_formed(path: Path) -> None: data = _population(path) - assert data["status"] in {"reserved-unscanned", "frozen"} + assert data["status"] in {"reserved-unscanned", "reserved", "frozen"} cases = data["case"] ids = [case["id"] for case in cases] assert len(ids) == len(set(ids)) >= 10 @@ -46,7 +48,11 @@ def test_the_reservation_is_well_formed(path: Path) -> None: assert SHA.fullmatch(benign.get("base", "")) and SHA.fullmatch(benign.get("tip", "")), case["id"] assert (path.parent / data["freeze_record"]).is_file() languages = {case["language"] for case in cases} - assert {"php", "python"} <= languages and languages & {"javascript", "typescript"} + if "language" in data: + # A single-language population (v3: PHP) declares its language, and every case is in it. + assert languages == {data["language"]} + else: + assert {"php", "python"} <= languages and languages & {"javascript", "typescript"} @pytest.mark.parametrize("path", POPULATIONS, ids=lambda p: p.stem)