Skip to content

Commit ad52ca9

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6qmh-j78v-ffp7 GHSA-822v-8w6h-5jxp GHSA-j4j5-9x6g-rgxc GHSA-m5qg-jc75-4jp6 GHSA-r5v8-c28h-f8r8 GHSA-w287-wwhf-95vv GHSA-wg36-wvj6-r67p GHSA-xr7v-m9px-q4qj
1 parent a8d3b4b commit ad52ca9

8 files changed

Lines changed: 456 additions & 29 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-6qmh-j78v-ffp7/GHSA-6qmh-j78v-ffp7.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6qmh-j78v-ffp7",
4+
"modified": "2026-04-14T20:02:31Z",
5+
"published": "2026-04-14T20:02:31Z",
6+
"aliases": [
7+
"CVE-2026-24906"
8+
],
9+
"summary": "October CMS has Stored XSS in Backend Editor Markup Classes",
10+
"details": "A stored cross-site scripting (XSS) vulnerability was identified in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dropdown menus, allowing JavaScript execution when any user opened a RichEditor.\n\n### Impact\n- Stored XSS via editor settings rendered in RichEditor dropdowns\n- Could allow privilege escalation if a superuser opens any RichEditor (e.g., editing a blog post)\n- Requires authenticated backend access with editor settings permissions\n- Triggers on routine content editing operations\n\n### Patches\nThe vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.\n\n### Workarounds\nIf upgrading immediately is not possible:\n- Restrict editor settings permissions to fully trusted administrators only\n\n### References\n- Reported by [Chris Alupului](https://github.com/neosprings)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "october/system"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "4.0.0"
29+
},
30+
{
31+
"fixed": "4.1.10"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 4.1.9"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Packagist",
43+
"name": "october/system"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "0"
51+
},
52+
{
53+
"fixed": "3.7.14"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 3.7.13"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/octobercms/october/security/advisories/GHSA-6qmh-j78v-ffp7"
67+
},
68+
{
69+
"type": "ADVISORY",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24906"
71+
},
72+
{
73+
"type": "PACKAGE",
74+
"url": "https://github.com/octobercms/october"
75+
}
76+
],
77+
"database_specific": {
78+
"cwe_ids": [
79+
"CWE-79"
80+
],
81+
"severity": "MODERATE",
82+
"github_reviewed": true,
83+
"github_reviewed_at": "2026-04-14T20:02:31Z",
84+
"nvd_published_at": "2026-04-14T18:16:45Z"
85+
}
86+
}

advisories/unreviewed/2026/04/GHSA-822v-8w6h-5jxp/GHSA-822v-8w6h-5jxp.json renamed to advisories/github-reviewed/2026/04/GHSA-822v-8w6h-5jxp/GHSA-822v-8w6h-5jxp.json

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-822v-8w6h-5jxp",
4-
"modified": "2026-04-12T12:30:26Z",
4+
"modified": "2026-04-14T20:04:38Z",
55
"published": "2026-04-12T12:30:26Z",
66
"aliases": [
77
"CVE-2026-6125"
88
],
9+
"summary": "Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression",
910
"details": "A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "Maven",
25+
"name": "org.dromara.warm:warm-flow-plugin-modes-sb"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"fixed": "1.8.5"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -31,6 +52,14 @@
3152
"type": "WEB",
3253
"url": "https://gitee.com/dromara/warm-flow/issues/IHURVQ"
3354
},
55+
{
56+
"type": "WEB",
57+
"url": "https://gitee.com/dromara/warm-flow/pulls/387"
58+
},
59+
{
60+
"type": "PACKAGE",
61+
"url": "https://github.com/dromara/warm-flow"
62+
},
3463
{
3564
"type": "WEB",
3665
"url": "https://vuldb.com/submit/793322"
@@ -48,9 +77,9 @@
4877
"cwe_ids": [
4978
"CWE-74"
5079
],
51-
"severity": "MODERATE",
52-
"github_reviewed": false,
53-
"github_reviewed_at": null,
80+
"severity": "LOW",
81+
"github_reviewed": true,
82+
"github_reviewed_at": "2026-04-14T20:04:38Z",
5483
"nvd_published_at": "2026-04-12T10:16:01Z"
5584
}
5685
}

‎advisories/github-reviewed/2026/04/GHSA-j4j5-9x6g-rgxc/GHSA-j4j5-9x6g-rgxc.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j4j5-9x6g-rgxc",
4+
"modified": "2026-04-14T20:02:50Z",
5+
"published": "2026-04-14T20:02:50Z",
6+
"aliases": [
7+
"CVE-2026-24907"
8+
],
9+
"summary": "October CMS has Stored XSS in Event Log Mail Preview",
10+
"details": "A stored cross-site scripting (XSS) vulnerability was identified in the Event Log mail preview feature. When viewing logged mail messages, HTML content was rendered in an iframe without proper sandboxing, allowing JavaScript execution in the viewer's browser context.\n\n### Impact\n- Stored XSS via mail template content rendered in Event Log\n- Could allow privilege escalation if a superuser views a malicious log entry\n- Requires authenticated backend access with mail template editing permissions\n- Requires a superuser to view the specific Event Log entry to trigger\n\n### Patches\nThe vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.\n\n### Workarounds\nIf upgrading immediately is not possible:\n- Restrict mail template editing permissions to fully trusted administrators only\n- Restrict Event Log viewing permissions to minimize exposure\n\n### References\n- Reported by [Chris Alupului](https://github.com/neosprings)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "october/system"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "4.0.0"
29+
},
30+
{
31+
"fixed": "4.1.10"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 4.1.9"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Packagist",
43+
"name": "october/system"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "0"
51+
},
52+
{
53+
"fixed": "3.7.14"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 3.7.13"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/octobercms/october/security/advisories/GHSA-j4j5-9x6g-rgxc"
67+
},
68+
{
69+
"type": "ADVISORY",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24907"
71+
},
72+
{
73+
"type": "PACKAGE",
74+
"url": "https://github.com/octobercms/october"
75+
}
76+
],
77+
"database_specific": {
78+
"cwe_ids": [
79+
"CWE-79"
80+
],
81+
"severity": "MODERATE",
82+
"github_reviewed": true,
83+
"github_reviewed_at": "2026-04-14T20:02:50Z",
84+
"nvd_published_at": "2026-04-14T18:16:45Z"
85+
}
86+
}

‎advisories/github-reviewed/2026/04/GHSA-m5qg-jc75-4jp6/GHSA-m5qg-jc75-4jp6.json‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m5qg-jc75-4jp6",
4+
"modified": "2026-04-14T20:02:05Z",
5+
"published": "2026-04-14T20:02:05Z",
6+
"aliases": [
7+
"CVE-2026-22692"
8+
],
9+
"summary": "October Rain has a Twig Sandbox Bypass via Collection Methods",
10+
"details": "A sandbox bypass vulnerability was identified in the optional Twig safe mode feature (`CMS_SAFE_MODE`). Certain methods on the `collect()` helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections.\n\n### Impact\n- Bypass of Twig sandbox restrictions\n- Only affects installations with `CMS_SAFE_MODE` enabled (disabled by default)\n- Requires authenticated backend access with CMS template editing permissions\n\n### Patches\nThe vulnerability has been patched in v4.1.5 and v3.7.13. All users who have enabled safe mode are encouraged to upgrade to the latest patched version.\n\n### Workarounds\nIf upgrading immediately is not possible:\n- Disable `CMS_SAFE_MODE` if untrusted template editing is not required\n- Restrict CMS template editing permissions to fully trusted administrators only\n\n### References\n- Reported by Łukasz Rybak",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "october/rain"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "4.0.0"
29+
},
30+
{
31+
"fixed": "4.1.5"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 4.1.4"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Packagist",
43+
"name": "october/rain"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "0"
51+
},
52+
{
53+
"fixed": "3.7.13"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 3.7.12"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6"
67+
},
68+
{
69+
"type": "ADVISORY",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22692"
71+
},
72+
{
73+
"type": "PACKAGE",
74+
"url": "https://github.com/octobercms/october"
75+
}
76+
],
77+
"database_specific": {
78+
"cwe_ids": [
79+
"CWE-284",
80+
"CWE-693"
81+
],
82+
"severity": "MODERATE",
83+
"github_reviewed": true,
84+
"github_reviewed_at": "2026-04-14T20:02:05Z",
85+
"nvd_published_at": "2026-04-14T17:16:28Z"
86+
}
87+
}

0 commit comments

Comments
 (0)