Overview

A path traversal vulnerability leading to arbitrary file write exist in PyMuPDF version 1.26.5, within the ‘embedded_get’ function in ‘main.py’. This vulnerability is caused by improper handling of untrusted embedded file metadata, which is used directly as an output path, enabling attackers to write files to arbitrary locations on the local system.

Description

PyMuPDF is a Python interface to the MuPDF document rendering engine, providing capabilities for parsing, rendering, searching, and modifying PDF documents. The ‘embedded_get’ function in PyMuPDF is responsible for opening the provided PDF along with fetching metadata, such as the file name, if using ‘args.output’ it specifies were the file will be written to on the local system. When ‘args.output’ is not provided, the ‘embedded_get’ function falls back to embedded-file metadata, and opens that value in write-binary mode. Since write-binary mode has no constrictions or safety checks it can write anywhere to the local system.
If the derived output path is not supplied by using ‘args.output’, a crafted PDF can be used to target a location on the local system by using the PDF’s name. When an extracted embedded file using ‘embedded_get’ without specified ‘args.output, the tool can write the extracted content outside the intended directory, potentially to paths on the local system.

Impact

Successful exploitation can result in arbitrary file writing to locations permitted by the executing user. If done under an account with elevated privileges, it may overwrite system files. This can lead to privilege escalation, service disruption, or security bypass. ### Overview A path traversal vulnerability leading to arbitrary file write exists in PyMuPDF version 1.26.5, within the embedded_get function in __main__.py. This vulnerability is caused by improper handling of untrusted embedded file metadata, which is used directly as an output path, enabling attackers to write files to arbitrary locations on the local system.

Description

PyMuPDF is a Python interface to the MuPDF document rendering engine, providing capabilities for parsing, rendering, searching, and modifying PDF documents. The embedded_get function in PyMuPDF is responsible for opening the provided PDF along with fetching metadata, such as the file name. If using args.output, it specifies where the file will be written on the local system. When args.output is not provided, the embedded_get function falls back to embedded file metadata and opens that value in write-binary mode. Since write-binary mode has no constrictions nor safety checks, it can write to anywhere on the local system.
If the derived output path is not supplied with args.output, a crafted PDF can be used to target a location on the local system using the name of the PDF. When an embedded file is extracted using embedded_get without specified args.output, the tool can write the extracted content outside the intended directory, potentially to paths on the local system.

Impact

Successful exploitation can result in arbitrary file writing to locations permitted by the executing user. If done under an account with elevated privileges, it may overwrite system files. This can lead to privilege escalation, service disruption, or security bypass.

Solution

PyMuPDF has released version 1.26.7 to address this vulnerability. Affected users are encouraged to update as soon as possible.

Acknowledgements

Thanks to the reporter UKO. This document was written by Michael Bragg.

Solution

PyMuPDF has released version 1.26.7 to address this vulnerability. Affected users are encouraged to update as soon as possible.

Acknowledgements

Thanks to the reporter UKO. This document was written by Michael Bragg.

Vendor Information

References

• http://github.com/pymupdf/PyMuPDF
• http://github.com/pymupdf/PyMuPDF/commit/603cafe38a183b8bab34f16d05043b4185d8d40a

Overview

A prototype pollution vulnerability present in CASL Ability versions 2.4.0 through 6.7.4 is triggered through the rulesToFields() function in the extra module. The program’s library contains a method called setByPath() that does not properly sanitize property names, allowing attackers to add or modify properties on an object’s prototype.

Description

The CASL library provides a robust suite for managing attribute-based access control across various components, services, and queries. Access control is defined with a set of rule conditions. The library provides a set of default values for these conditions.

In JavaScript libraries like CASL, prototypes are template objects that serve as blueprints and inform the properties of their child objects. By exploiting this prototype pollution vulnerability, an attacker can inject arbitrary properties into global object prototypes, thereby affecting all child objects that inherit from them. The issue arises from a flaw in the setByPath() function, a component of the rulesToFields() function in the extra module.

The setByPath() function is intended to safely update only permitted fields; however, it fails to properly sanitize path segments before using them as object property keys. Consequently, special property names such as prototype and constructor are accepted as valid keys, allowing an attacker to modify the properties of object prototypes and constructor classes. Furthermore, the _proto_ special property can be used to traverse the prototype chain and ultimately write to Object.prototype, the root prototype of all objects. By polluting Object.prototype, an attacker can add arbitrary properties to all objects and compromise the prototype chain throughout the Node.js process.

Impact

As Object.prototype is the root prototype that all JavaScript objects inherit from, changes to its properties can be significant, allowing an attacker to execute arbitrary code and potentially leading to a complete system compromise. Additionally, an attacker can bypass intended authorization logic, allowing unauthorized access to sensitive resources. Furthermore, changes to Object.prototype can cause unintended behavior in application code, leading to logic manipulation and potentially allowing an attacker to perform actions that would normally be restricted.

Manipulating properties in Object.prototype can also cause crashes or unexpected behavior if polluted properties do not match expected types in the application code, leading to a denial of service. Overall, the Object.prototype pollution vulnerability poses a significant risk to applications and systems. Because the vulnerability exists in the CASL library, which is used by multiple applications and services, a single exploit can have a ripple effect, compromising multiple systems and potentially leading to a widespread security breach.

Solution

Users of the library should upgrade to version 6.7.5 or later, found at https://github.com/stalniy/casl/tree/master/packages/casl-ability.

Acknowledgements

Thanks to Maor Caplan from the Alma Security for coordinating the disclosure of this vulnerability. This document was written by Ayushi Kriplani and Dr. E. Drennan, CISSP.

Vendor Information

References

• https://github.com/stalniy/casl/tree/master/packages/casl-ability
• https://cwe.mitre.org/data/definitions/1321.html
• https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution

Overview

An out-of-bounds memory access vulnerability exists in the uncompressed decoder component of libheif. A maliciously crafted HEIF image can trigger a denial-of-service condition by causing the libheif library to crash or exhibit other unexpected behavior due to an out-of-bounds memory access.

Description

libheif is an open-source library used for decoding and encoding modern image formats, including HEIF (High Efficiency Image File Format) and AVIF (AV1 Image File Format). These formats provide high compression efficiency and are widely used across mobile devices and online platforms.

libheif contains an out-of-bounds iterator access vulnerability in its uncompressed codec. The issue occurs when the decoder processes certain metadata structures within a HEIF file. Specifically, the decoder fails to adequately validate values read from an internal metadata box before performing iterator arithmetic on the underlying data buffer.

As a result, a malformed HEIF file can cause the decoder to read past the end of the input buffer and incorrectly interpret unrelated memory as valid metadata. This invalid memory access may lead to a segmentation fault during image decoding.

The CVE-2025-65586 captures this out-of-bounds checking flaw in libheif’s uncompressed codec that allows a maliciously crafted HEIF file to trigger an out-of-bounds read, resulting in a segmentation fault and denial of service when the file is parsed. The vulnerability was introduced in commit 6190b58f (October 3, 2024). Versions v1.19.0 through Versions 1.20.2 are affected by this vulnerbaility. The versions v1.17.6 and earlier are not affected. The issue was reported to the libheif project and has been fixed in commit f4d9157 (November 5, 2025) and then merged to the version release 1.21.0 at the end of 2025.

Impact

An attacker can exploit this vulnerability by supplying a maliciously crafted HEIF image, causing applications that use libheif to crash. Based on current analysis, exploitation is limited to denial-of-service conditions.

Potential impacts include

• Unexpected termination of applications that decode HEIF images
• Crashes in systems that automatically generate previews or thumbnails
• Disruption of services that process untrusted HEIF content (e.g., browsers, email clients, photo management tools)

There is no evidence at this time that this vulnerability can be used to achieve memory disclosure or arbitrary code execution.

Discovery

The vulnerability was discovered through coverage-guided fuzzing using AddressSanitizer-instrumented builds of libheif. The issue was reproducible across standard Linux development environments.

Solution

Software vendors and developers using the libheif library are strongly encouraged to update to version 1.21.0 or later, which includes the fix for this vulnerability. End users should apply available software updates to ensure they are running a version of libheif that addresses this issue.

Acknowledgements

Thanks to the reporter Maor Caplan for identifying the vulnerability and to Dirk Farin for implementing the fix. This document was written by Timur Snoke.

Vendor Information

References

• https://github.com/strukturag/libheif
• https://github.com/strukturag/libheif/commit/f4d91571dacaea213a614694f696b88048ac0431
• https://github.com/strukturag/libheif/releases/tag/v1.21.0

Overview

The binary-parser library for Node.js contains a code injection vulnerability that may allow arbitrary JavaScript code execution if untrusted input is used to construct parser definitions. Versions prior to 2.3.0 are affected. The issue has been resolved by the developer in a public update.

Description

binary-parser is a JavaScript library to facilitate writing "efficient binary parsers in a simple and declarative manner." binary-parser (versions < 2.3.0) dynamically generates JavaScript code at runtime using the Function constructor. Certain user-supplied values—specifically, parser field names and encoding parameters—are incorporated into this generated code without validation or sanitization.

If an application passes untrusted or externally supplied data into these parameters, the unsanitized values can alter the generated code, enabling execution of attacker-controlled JavaScript. Applications that use only static, hardcoded parser definitions are not affected.

The vendor has released a fix and clarified the library’s design limitations in version 2.3.0.

Impact

In affected applications that construct parser definitions using untrusted input, an attacker may be able to execute arbitrary JavaScript code with the privileges of the Node.js process. This could allow access to local data, manipulation of application logic, or execution of system commands depending on the deployment environment.

Solution

Users of the binary-parser library should upgrade to version 2.3.0 or later, where the vendor has implemented input validation and mitigations for unsafe code generation. Developers should avoid passing untrusted or user-controlled values into parser field names or encoding parameters.

Acknowledgements

Thanks to the reporter Maor Caplan for identifying the vulnerability and to Keichi Takahashi for implementing the fix. This document was written by Timur Snoke.

Vendor Information

References

• https://github.com/keichi/
• https://github.com/keichi/binary-parser/pull/283
• https://www.npmjs.com/package/binary-parser

Overview

The Open5GS WebUI component contains default hardcoded secrets used for security-sensitive operations, including JSON Web Token (JWT) signing. If these defaults are not changed, an attacker can forge valid authentication tokens and gain administrative access to the WebUI. This can result in unauthorized access to protected management endpoints.

Description

Open5GS is an open-source implementation of 5G core network functions. It includes an optional WebUI component implemented using Node.js and Next.js for managing configuration and subscriber data. The WebUI relies on multiple secret values provided via Node.js process.env environment variables. These include secrets used for cryptographic operations such as signing and validating JSON Web Tokens (JWTs). By default, these environment variables are initialized to the static value change-me, including the JWT signing secret. JWTs are commonly used to implement authentication and authorization, as well as to securely transmit claims such as user roles and permissions.

In the Open5GS WebUI, these tokens are issued and validated using the default hardcoded secret unless explicitly overridden by the executing environment by the operator. The WebUI, on startup, does not emit warnings or enforce changes to these default secrets. As a result, deployments that do not manually override the defaults will operate with predictable and publicly known cryptographic keys. An attacker with network access to the WebUI can exploit this condition to forge valid administrative JWTs.

While the WebUI includes Cross-Site Request Forgery (CSRF) protections, these controls are ineffective against requests authenticated with valid forged JWTs. The WebUI is commonly deployed in containerized environments and may be assumed to be locally exposed; however, misconfigurations or local access assumptions can still place the interface at risk.

Impact

An unauthenticated network attacker with access to the WebUI component can generate forged JWTs using the known default secret. With these tokens, the attacker can access or modify protected REST endpoints under /api/db/*. This vulnerability allows unauthorized read and write access to sensitive data, including subscriber information and system configuration. CSRF protections do not mitigate this attack, as the forged tokens satisfy authentication requirements. Successful exploitation may result in full access of the WebUI component and all of its permissions.

Solution

For Developers

A patch addressing this issue is available in the following pull request: https://github.com/open5gs/open5gs/pull/4279 against the version v2.7.6 released in July 2025. The patch introduces the use of a self-contained .env file for the WebUI’s Next.js environment and removes reliance on hardcoded default secret values. This ensures that each WebUI deployment generates and uses independent, locally scoped cryptographic secrets, reducing the risk of token forgery and key reuse across instances.

Developers integrating or redistributing the WebUI component are encouraged evaluate, validate and adopt the changes within their own environments prior to deployment

For Users

Users who are unable to apply the patch should manually configure their Node.js environment to define strong, cryptographically secure random values for the following environment variables: - process.env.SECRET_KEY - process.env.JWT_SECRET_KEY These values preferable are unique per deployment and treated as sensitive secrets. Additionally, operators are advised to restrict access to the WebUI by placing it behind appropriate network controls, such as authentication gateways or secure content inspection proxies, to limit exposure from untrusted networks.

Acknowledgements

Thanks to the reporter Andrew Fasano from NIST's Center for AI Standards & Innovation. This document was written by Laurie Tyzenhaus. The software patch was written by Vijay Sarvepalli.

Vendor Information

References

• https://github.com/open5gs/open5gs/pull/4279
• https://github.com/open5gs/open5gs/issues/2264
• https://github.com/open5gs/open5gs/issues/856
• https://github.com/open5gs/open5gs/pull/857

Overview

A stack-based buffer overflow vulnerability exists in GNU libtasn1, a low-level ASN.1 parsing library. The issue is caused by unsafe string concatenation in the asn1_expand_octet_string function located in decoding.c. Under worst-case conditions, this results in a one-byte stack overflow that may corrupt adjacent memory. While the overflow is limited to a single byte, such conditions can still lead to unexpected behavior when processing untrusted ASN.1 input data.

Description

GNU libtasn1 is a low-level C library for manipulating Abstract Syntax Notation One (ASN.1) data structures and encoding rules, including Distinguished Encoding Rules (DER). It implements functionality defined by ITU-T Recommendations X.680 and X.690 and is widely used as a foundational component in cryptographic software stacks to parse and validate complex ASN.1-encoded data.

A stack-based buffer overflow has been identified in the function asn1_expand_octet_string in the file decoding.c. The vulnerability arises from the use of unbounded string manipulation functions (strcpy and strcat) to construct a local stack buffer (name) using the fields definitions->name and p2->name. In the worst-case scenario, both source strings may be at their maximum allowed length. When concatenated together with an additional separator character (".") and a terminating null byte, the destination buffer is undersized by one byte. As a result, the final null terminator written by strcat overflows the allocated stack buffer by a single byte.

Although the overflow is limited in size, it occurs during the parsing of potentially untrusted ASN.1 input. One-byte stack overflows have historically led to subtle memory corruption issues and may cause unexpected behavior, including crashes, during cryptographic operations such as signature verification or certificate parsing.

Impact

An attacker could trigger the buffer overflow using a malformed ASN.1 data to potential corrupt memory or cause unexpected behavior. This requires breaking libtasn1’s assumption that ASN.1 structures passed to it are already validated by the main application using this library. The impact of this vulnerability is limited due to the one-byte nature of the overflow. Exploitation is constrained and may be further mitigated by modern compiler protections such as stack canaries, _FORTIFY_SOURCE, and other hardening mechanisms. However, as the GNU libtasn1 is commonly used in cryptographic libraries and security-sensitive contexts, malformed ASN.1 input triggering this condition could result in parsing failures or abnormal behavior during critical cryptographic operations, including signature verification and cryptographic data validation.

Solution

A patch addressing this issue has been proposed to the GNU libtasn1 project and is available for review and testing at: https://gitlab.com/gnutls/libtasn1/-/merge_requests/121. Developers and integrators are encouraged to evaluate the patch and apply appropriate mitigations, such as using bounded string operations or safer formatting functions, to eliminate the overflow condition in affected versions. Read https://gitlab.com/gnutls/libtasn1/-/blob/master/NEWS.md for updates

Acknowledgements

Thanks to Benny Zelster from Microsoft Research for coordinating the disclosure of this vulnerability.This document was written by Vijay Sarvepalli.

Vendor Information

References

• https://gitlab.com/gnutls/libtasn1
• https://gitlab.com/gnutls/libtasn1/-/merge_requests/121
• https://gitlab.com/gnutls/libtasn1/-/blob/master/NEWS.md
• https://gitlab.com/gnutls/libtasn1/-/blob/master/doc/security/CVE-2025-13151.md

Overview

Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64, versions 10.5.75.0 and 11.11.4.0, allows for an unprivileged user to abuse an IOCTL path and terminate protected system processes.

Description

Safetica is a Data Loss Prevention (DLP) and Insider Risk Management (IRM) software solution that helps organizations protect their data via detecting, analyzing, and mitigating threats. Safetica's platform is AI-powered and is used by public and private organizations, globally.

A vulnerabilty has been discovered in Safetica’s ProcessMonitorDriver.sys kernel driver. A local, unprivileged user can abuse a vulnerable IOCTL (Input/Output Control) path in the kernel driver to cause privileged termination of arbitrary system processes. IOCTL interfaces allow user-mode software to send commands into the kernel space so that the driver can perform specific privileged actions such as terminating processes. Terminating Safetica's processes in endpoint detection and response and antivirus software can blind their clients' security monitoring on their machines. Improper input sanitization and user validation mechanisms can manipulate the kernel driver into privilege escalation and DOS (denial of service).

Impact

A threat actor can leverage this vulnerability and could use the IOCTL path to terminate processes repeatedly. This could lead to a DOS attack and render Safetica's systems unavailable.

Solution

At the time of publication, no vendor-supported fix is available for the vulnerability affecting Safetica DLP kernel driver ProcessMonitorDriver.sys, which allows unprivileged users to abuse exposed IOCTL handlers to terminate arbitrary processes. Until an official patch or guidance is provided by the vendor, the following mitigations are recommended:

1. Monitor and Detect Abuse of IOCTL Calls Targeting the Driver: Safetica's client organizations should actively monitor for suspicious or abnormal IOCTL handler requests. To detect this activity, clients should deploy kernel driver monitoring solutions like Endpoint Detection and Response or System Monitor-like telemetry (where supported). This will 1) identify unprivileged processes, 2) detect unusual IOCTL patterns, and 3) alert security teams when user-mode processes interact with the kernel driver.

2. Restrict or Block Access to the Vulnerable Driver via Policy Controls: To restrict access to ProcessMonitorDriver.sys, Safetica's client organizations should use Windows Group Policy or Application Control policies (WDAC [https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-overview] /AppLocker [https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/what-is-applocker]). This will prevent untrusted or non-administrative processes from loading or interacting with the driver, through policy-based enforcement mechanisms. These enforcement mechanisms can block untrusted or unsigned binaries from communicating with the kernel driver.

Acknowledgements

Thanks to the reporter, KOSEC LLC. This document was written by Ayushi Kriplani.

Vendor Information

Overview

A Server-Side Template Injection (SSTI) vulnerability exists in the Genshi template engine due to unsafe evaluation of template expressions. Genshi processes template expressions using Python’s 'eval()’ and ‘exec()’ functions while allowing fallback access to Python built-in objects. If an attacker can influence template expressions, this behavior can result in arbitrary code execution on the server.

Description

Genshi is a Python library developed by Edgewall, it provides an integrated set of components for parsing, generating, and processing HTML, XML, or other textual content for output generation on the web. Genshi is most used to render dynamic web pages in Python web frameworks.

Genshi evaluates template expressions, such as ${…}, through an internal expression evaluation mechanism implemented in Genshi’s ‘eval.py’. During expression evaluation, variable resolution is performed by the ‘lookupname()’ method. If a variable is not found in the provided template data, Genshi falls back to resolving the name from Python’s built-in namespace. This namespace includes powerful built-in functions such as globals() ’ and ‘import’. As a result, when an attacker can control or inject template expressions, they may access Python built-in functions and chain them to achieve arbitrary code execution.

Impact

If an attacker can influence or inject template expressions, this vulnerability allows arbitrary code execution with the privileges of the running application. Potential impacts include executing operating commands, deploying reverse shells or web shells, unauthorized access to sensitive data, or full compromise of the affected server. This issue effectively turns SSTI into Remote Code Execution (RCE).

Solution

At the time of publication, Genshi has not released an update addressing this issue. Until an official patch or guidance is provided by the vendor, the following mitigations are recommended:

1. Do not allow untrusted users to control template expressions or template sources. Templates must be treated as executable code.

2. Restrict or eliminate access to Python built-ins during template evaluation.

3. Avoid using ‘eval()’ or ‘exec()’ on dynamically constructed expressions when untrusted input is involved.

4. If user-defined templates are required, render them in a hardened sandbox environment.

Acknowledgements

Thanks to the reporter Jangwoo Choe. This document was written by Michael Bragg.

Vendor Information

References

• https://github.com/edgewall/genshi/

Overview

dr_flac, an open-source FLAC audio decoder, part of the dr_libs audio decoder toolset, contains an integer overflow vulnerability allowing for denial of service (DoS) when provided a specific crafted file. An attacker can exploit this vulnerability through providing a tool that uses dr_flac a specially crafted file, and can cause the tool to crash. The vulnerability, tracked as CVE-2025-14369, has been patched in commit b2197b2 of dr_flac. In an enterprise situation, audio tools that use dr_flac may be susceptible to crashes or other abnormal behavior if they process attacker-controlled files.

Description

dr_libs is an open-source audio decoding tool. It is made of three separate tools, dr_flac, dr_mp3, and dr_wav, which can decode FLAC, MP3, and WAV files respectively.

An integer overflow vulnerability has been discovered, tracked as CVE-2025-14369 within dr_libs. An attacker who can supply crafted input FLAC files to the tool may trigger allocation of a large amount of memory, leading to a crash or unintended function of the tool.

During function, a single block of memory could be allocated to totalPCMFrameCount from the FLAC metadata without validation before the calculation of the bugger size. This could result in a specifically crafted file being allocated an arbitrary amount of memory space.

Impact

An attacker able to send input data in the form of FLAC files to the tool or other input stream that uses dr_flac could cause a crash or DoS attack.

Solution

Commit b2197b2, released on GitHub, fixes the issue. Users should update to the latest version ASAP. All versions prior to commit b2197b2 are affected.

Acknowledgements

Thanks to the reporter who wishes to remain Maor Caplan.This document was written by Christopher Cullen.

Vendor Information

References

• https://github.com/mackron/dr_libs/commit/b2197b2eb7bb609df76315bebf44db4ec2a1aed0

Overview

Multiple vulnerabilities were discovered in The Librarian, an AI-powered personal assistant tool provided by the company TheLibrarian.io. The Librarian can be used to manage personal email, calendar, documents, and other information through external services, such as Gmail and Google Drive, and also summarize meetings and schedule emails. The vulnerabilities are among internal tools that The Librarian uses during its normal functions. These tools, view_document, web_fetch, and image_generate, allow an authenticated user * access to the administrative console * internal web crawling and port scanning of the internal infrastructure for thelibrarian.io * disclosure of the internal system prompt for The Librarian

All vulnerabilities have since been fixed by thelibrarian.io, and the tools have now been deprecated.

Description

TheLibrarian.io is an AI company that offers the namesake AI-powered personal assistant tool, "The Librarian". This assistant can perform a variety of services and can integrate with other external applications. Some of these abilities include calendar management, sending email, and document management. Integratable services include Google products such as Gmail and Google Drive.

A series of vulnerabilities have been discovered within The Librarian that enable an attacker to access the internal infrastructure of TheLibrarian.io, including the administrator console and cloud environment. They also permit disclosure of the internal system prompt, web crawling, log access, and viewing of internal processes that infrastructure for TheLibrarian.io is running.

Below is a list of all the vulnerabilities and respective CVE IDs assigned to them.

VU#383552.1 The Librarian image_generation tool can be used to disclose the full system prompt through requesting an image to be generated with the embedded system prompt.

VU#383552.2 The Librarian view_document tool can be used to disclose the full system prompt through requesting the system prompt be appended to a document that is uploaded to the system.

CVE-2026-0612 The Librarian contains a information leakage vulnerability through the web_fetch tool, which can be used to retrieve arbitrary external content provided by an attacker, which can be used to proxy requests through The Librarian infrastructure.

CVE-2026-0613 The Librarian contains an internal port scanning vulnerability, facilitated by the web_fetch tool, which can be used with SSRF-style behavior to perform GET requests to internal IP addresses and services, enabling scanning and metadata retrieval of the Hertzner cloud environment that TheLibrarian uses.

CVE-2026-0615 The Librarian supervisord status page can be retrieved by the web_fetch tool, which can be used to retrieve running processes within The Librarian backend.

CVE-2026-0616 The Librarian's web_fetch tool can be used to retrieve the Adminer interface content, which can then be used to log in to the internal backend system of The Librarian.

Impact

An attacker who exploits these vulnerabilities could control a wide variety of aspects of the internal infrastructure for TheLibrarian.io. This could include process control, lateral movement, and credential theft. CVE-2026-0614, CVE-2026-0615, and CVE-2026-0616 are largely responsible for this potential impact. VU#383552.1 to VU#383552.4 allow for exploitation and potential misuse of the capabilities of The Librarian, and could result in jailbreaks or unintended actions by the AI.

Solution

The vendor has stopped the web-fetch tool from being able to retrieve dangerous content. Web-retrieval is now handled by a third-party service. The vendor also stated that: "prompt content is not a secrecy boundary in our threat model" in regard to system prompt disclosure.

Acknowledgements

Thanks to the reporter, Aaron Portnoy of Mindgard.ai. This document was written by Christopher Cullen.

Vendor Information

References

• https://mindgard.ai/blog/thelibrarian-ios-ai-security-disclosure
• https://thelibrarian.io/

Overview

A vulnerability, tracked as CVE-2025-14894, has been discovered within Livewire Filemanager, a tool designed for usage within Laravel applications. The Livewire Filemanager tool allows for users to upload various files, including PHP files, and host them within the Laravel application. When a user uploads a PHP file to the application, it can be accessed and executed by visiting the web-accessible file hosting directory. This enables an attacker to create a malicious PHP file, upload it to the application, then force the application to execute it, enabling unauthenticated arbitrary code execution on the host device.

Description

Livewire Filemanager is a tool designed to be embedded into Laravel applications, allowing for files to be uploaded, stored and managed. Laravel is a PHP framework, intended for web application development. A vulnerability has been discovered within the Livewire Filemanager that enables remote code execution (RCE) by uploading a malicious PHP file. This vulnerability is tracked as CVE-2025-14894, and its description is below:

Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup process within Laravel applications has been completed.

As a note, Livewire Filemanager defines validation of file types to be out of scope, and recommends users perform their own file type validation. However, the ability to remotely execute files uploaded through the web application is what actually enables executing the malware.

During default usage of Livewire Filemanager, files can be accessed via the publicly accessible "storage/app/public" URL. This occurs if the php artisan storage:link command has previously been executed, enabling web serving. If a malicious PHP file is uploaded to the file manager, it can then be accessed and executed from that URL when passed a user ID alongside the request, enabling remote code execution on the target device.

Impact

The vulnerability enables unauthenticated remote code execution as the web server user, enabling full read and write of files accessible to that user, as well as the capability to further pivot and compromise connecting devices, making CVE-2025-14894 a high impact vulnerability.

Solution

At the time of writing, the vendor has not acknowledged the vulnerability. CERT/CC recommends using increased caution with Laravel Filemanager, and to check if the php artisan storage:link command has previously been executed, and if so, consider removing the web serving capability of the tool.

Acknowledgements

Thanks to the reporter HackingByDoing. This document was written by Christopher Cullen.

Vendor Information

References

• https://github.com/livewire-filemanager/filemanager
• https://hackingbydoing.wixsite.com/hackingbydoing/post/unauthenticated-rce-in-livewire-filemanager

Overview

Redmi Buds, a series of Bluetooth earbuds produced and sold by Xiaomi, contain an Information Leak vulnerability and a Denial of Service (DoS) vulnerability in versions 3 Pro through 6 Pro. An attacker within Bluetooth radio range can send specially crafted RFCOMM protocol interactions to the device's internal channels without prior pairing or authentication, enabling the exposure of sensitive call-related data or triggering repeatable firmware crashes.

Description

The two vulnerabilities originate from the firmware's improper management of RFCOMM control and signaling mechanisms. The product specifications for Redmi Buds advertise support for the Bluetooth Classic profiles HFP, A2DP, and AVRCP, but direct experimentation has also confirmed the presence of additional, undocumented L2CAP/ RFCOMM channels active on the devices. These channels were likely implemented to facilitate auxiliary services or legacy audio support; vendor-specific internal interfaces are not required to be publicized in consumer product pages.

CVE-2025-13834 This vulnerability is the result of flawed bounds checking during the internal handling of abnormal RFCOMM TEST commands. When the device's control channel (DLCI 0) receives a TEST command with a large length field but an empty payload, its faulty response handler returns a buffer of uninitialized memory. An attacker can exploit this behavior to steal up to 127 bytes of potentially sensitive data, such as the phone number of a user's active call peer, with a single packet. Notably, the mechanism of this vulnerability is closely related to the infamous Heartbleed bug (CVE-2014-0160). Like Heartbleed, this flaw originates from blind trust in a packet's length field without adequate bounds checking, resulting in an out-of-bounds read and unintended memory disclosure.

CVE-2025-13328 This vulnerability is caused by the firmware's susceptibility to flooding attacks over RFCOMM channels. When an attacker floods the standard control channel (DLCI 0) with a high volume of legitimate TEST commands, the device's processing queue is overwhelmed, leading to resource exhaustion and a firmware crash that forcibly terminates paired user connections. Other active data channels across the device's RFCOMM implementation are also vulnerable to flooding via MSC (Modem Status Command) signaling frames, including both the standard HFP (Hands-Free Profile) channel and an undocumented Airoha auxiliary service channel.

Impact

Both vulnerabilities can be exploited by an unpaired, unauthenticated attacker within Bluetooth radio range without prior user interaction. The only prerequisite for exploitation is obtaining the MAC address of the target device, which can be discovered through basic Bluetooth sniffing tools. During testing with standard dongles and no additional signal amplification, exploitation was achieved at an approximate distance of twenty meters; however, physical barriers and Bluetooth version differences can be expected to influence the effective range.

The uninitialized memory dumped by CVE-2025-13834 threatens the confidentiality of Redmi Buds users during or after private calls, as demonstrated by a PoC used to obtain the phone number of a user's active call peer. Any other metadata that utilizes this memory pool is vulnerable to exposure, and the attack can be triggered repeatedly without alerting the user. This vulnerability demonstrates the susceptibility of IoT protocol stacks to the class of "missing bounds check" or "buffer over-read" flaws famously exemplified by Heartbleed in web servers. It represents a critical oversight in memory management within the Redmi Buds Bluetooth firmware.

The DoS vulnerability, CVE-2025-13328, can be exploited to the detriment of device availability for legitimate users, inducing repeatable firmware crashes that forcibly disconnect all paired devices. To restore functionality, the earbuds must be physically reset by returning them to the charging case.

Solution

Xiaomi could not be reached for statements regarding remediation plans or mitigation guidance. To reduce exposure, users are advised to disable Bluetooth when the earbuds are not in use, particularly in public or shared environments.

Acknowledgements

Thanks to Choongin Lee, Jiwoong Ryu, and Heejo Lee for discovering, researching, and reporting these vulnerabilities. This document was written by Molly Jaconski.

Vendor Information

References

• https://www.kb.cert.org/vuls/id/720951/

Overview

The BeeS Examination Tool (BET) portal from BeeS Software Solutions contains an SQL injection vulnerability in its website login functionality. More than 100 universities use the BET portal for test administration and other academic tasks. The vulnerability enables arbitrary SQL commands to be executed on the back-end database, making an attacker able to manipulate the database, extract sensitive student data, and further compromise the host infrastructure. BeeS Software Solutions has since remediated the vulnerability, and no actions are necessary for customers at this time.

Description

Numerous universities implement the BET portal to unify the various tasks associated with administering examinations to students. Each university maintains their own instance of the BET portal, receiving updates from BeeS Software Solutions.

A vulnerability, tracked as CVE-2025-14598, was discovered within the login functionality of the portal. This vulnerability, facilitated by insufficient user input validation, enables arbitrary SQL injection. When exploited, an attacker can manipulate the backend database, steal student data (including credentials), and perform lateral movement, further compromising the host infrastructure.

BeeS Software Solutions issued a patch to all instances using the BET portal, changing code, enabling input validation, and changing various security settings to prevent exploitation and unauthorized access. All BET clients automatically received these changes.

Impact

The vulnerability permits an unauthenticated, remote attacker to achieve various results, including unauthorized database access, credential theft, potential lateral movement into infrastructure, acquisition of sensitive student and institutional data, and system-level access to the affected server.

Solution

No actions are needed by clients, as configurations and updated dynamic link libraries (DLLs) have been automatically installed and updated through ePortal : Secure Build (October 2025). Testing indicates that the changes successfully mitigated the vulnerability.

Acknowledgements

Thanks to the reporter, Mohammed Afnaan Ahmed, for reporting these vulnerabilities. This document was written by Christopher Cullen.

Vendor Information

References

• https://afnaan.me/cve/cve-2025-14598
• https://cloudilyaerp.com/
• https://github.com/Afnaan-Ahmed/CVE-2025-14598

Overview

A flaw in the firmware-upload error-handling logic of the TOTOLINK EX200 extender can cause the device to unintentionally start an unauthenticated root-level telnet service. This condition may allow a remote authenticated attacker to gain full system access.

Description

In the End-of-Life (EoL) TOTOLINK EX200 firmware, the firmware-upload handler enters an abnormal error state when processing certain malformed firmware files. When this occurs, the device launches a telnet service running with root privileges and does not require authentication. Because the telnet interface is normally disabled and not intended to be exposed, this behavior creates an unintended remote administration interface.

To exploit this vulnerability, an attacker must already be authenticated to the web management interface to access the firmware-upload functionality. Once the error condition is triggered, the resulting unauthenticated telnet service provides full control of the device.

CVE-2025-65606 An authenticated attacker can trigger an error condition in the firmware-upload handler that causes the device to start an unauthenticated root telnet service, granting full system access.

Impact

A remote authenticated attacker may be able to activate a root telnet service and subsequently take complete control of the device. This may lead to configuration manipulation, arbitrary command execution, or establishing a persistent foothold on the network.

Solution

TOTOLINK has not released an update addressing this issue, and the product is no longer maintained. Users should restrict administrative access to trusted networks, prevent untrusted users from accessing the management interface, monitor for unexpected telnet activity, and plan to replace the vulnerable device.

Acknowledgements

Thanks to the reporter Leandro Kogan for bringing this to our attention. This document was written by Timur Snoke.

Vendor Information

Overview

A vulnerability in the Forcepoint One DLP Client allows bypass of the vendor-implemented Python restrictions designed to prevent arbitrary code execution. By reconstructing the ctypes FFI environment and applying a version-header patch to the ctypes.pyd module, an attacker can restore ctypes functionality within the bundled Python 2.5.4 runtime, enabling direct invocation of DLLs, memory manipulation, and execution of arbitrary code.

Description

The Forcepoint One DLP Client (version 23.04.5642 and potentially subsequent versions) shipped with a constrained Python 2.5.4 runtime that omitted the ctypes foreign function interface (FFI) library. Although this limitation appeared intended to mitigate malicious use, it was demonstrated that the restriction could be bypassed by transferring compiled ctypes dependencies from another system and applying a version-header patch to the ctypes.pyd module. Once patched and correctly positioned on the search path, the previously restrained Python environment would successfully load ctypes, permitting execution of arbitrary shellcode or DLL-based payloads.

Forcepoint acknowledged the issue and indicated that a fix would be included in an upcoming release. According to the Forcepoint’s published knowledge base article (KB 000042256), the vulnerable Python runtime has been removed from Forcepoint One Endpoint (F1E) builds after version 23.11 associated with Forcepoint DLP v10.2.

Impact

Arbitrary code execution within the DLP client may allow an attacker to interfere with or bypass data loss prevention enforcement, alter client behavior, or disable security monitoring functions. Because the client operates as a security control on enterprise endpoints, exploitation may reduce the effectiveness of DLP protections and weaken overall system security.

The complete scope of impact in enterprise environments has not been fully determined.

Solution

Forcepoint reports that the vulnerable Python runtime has been removed in Endpoint builds after version 23.11 (Forcepoint DLP v10.2). Users should upgrade to Endpoint versions which have been validated to no longer contain python.exe.

Acknowledgements

Thanks to the reporter, Keith Lee. This document was written by Timur Snoke.

Vendor Information

References

• https://support.forcepoint.com/s/article/000042256

Overview

A newly identified vulnerability in some UEFI-supported motherboard models leaves systems vulnerable to early-boot DMA attacks across architectures that implement UEFI and IOMMU. Although the firmware indicates that DMA protection is active, it fails to correctly initialize the IOMMU. Therefore, a malicious PCIe device with physical access can read or modify system memory before the operating system’s defenses load. This exposes sensitive data and enables pre-boot code injection on affected systems running unpatched firmware.

Description

Modern systems rely on UEFI firmware and the Input–Output Memory Management Unit (IOMMU) to establish a secure foundation before the operating system loads. UEFI initializes hardware and enforces early security policies while the IOMMU restricts peripheral devices from performing unauthorized memory accesses. Together, these components help ensure that direct memory access (DMA)-capable devices cannot tamper with or inspect system memory during the critical pre-boot phase.

A vulnerability discovered in certain UEFI implementations arises from a discrepancy between reported and actual DMA protection. Even though firmware asserts that DMA protections are active, it fails to properly configure and enable the IOMMU during the early hand-off phase in the boot sequence. This gap allows a malicious DMA-capable Peripheral Component Interconnect Express (PCIe) device with physical access to read or modify system memory before operating system-level safeguards are established. As a result, attackers could potentially access sensitive data in memory or influence the initial state of the system, thus undermining the integrity of the boot process.

Vendors whose products are affected have begun releasing firmware updates to correct the IOMMU initialization sequence and properly enforce DMA protections throughout boot. Users and administrators should apply these updates as soon as they become available to ensure their systems are not exposed to this class of pre-boot DMA attacks. In environments where physical access cannot be fully controlled or relied on, prompt patching and adherence to hardware security best practices are especially important. Because the IOMMU also plays a foundational role in isolation and trust delegation in virtualized and cloud environments, this flaw highlights the importance of ensuring correct firmware configuration even on systems not typically used in data centers.

Impact

Improper IOMMU initialization in UEFI firmware on some UEFI-based motherboards from multiple vendors allows a physically present attacker using a DMA-capable PCIe device to bypass early-boot memory protection. The attacker could access or alter system memory via DMA transactions processed before the operating system enables its security controls.

Solution

Users and administrators should apply the latest firmware updates as soon as they become available as these patches correct the IOMMU initialization issue and restore proper DMA protections during early boot. Because multiple vendors are affected and updates are being released on varying timelines, customers should regularly monitor the Vendor Information section for newly published advisories and updated firmware packages. Environments where physical access is difficult to control should prioritize patching promptly to reduce exposure to pre-boot DMA attacks.

Acknowledgements

Thanks to reporter Nick Peterson and Mohamed Al-Sharifi of Riot Games for identifying this issue and working with vendor teams and the Taiwanese CERT to coordinate the response and reach affected product vendors. This document was written by Vijay Sarvepalli.

Vendor Information

References

• https://en.wikipedia.org/wiki/DMA_attack
• https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-PCIe-Device-Attacks-Beyond-DMA-Exploiting-PCIe-Switches-Messages-And-Errors.pdf
• https://www.synacktiv.com/ressources/IOMMU_and_DMA_attacks_presentation_16_9.pdf
• https://learn.microsoft.com/en-us/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt
• https://tinyurl.com/twcert
• https://eclypsium.com/blog/direct-memory-access-attacks-a-walk-down-memory-lane/
• https://www.sei.cmu.edu/blog/uefi-terra-firma-for-attackers/

Overview

Vulnerabilities have been identified in Siemens Gridscale X Prepay that allows unauthenticated username enumeration and enables an attacker to bypass account lock functionality. These issues may permit unauthorized access or prolonged access to protected resources, even after an account has been administratively locked.

Description

Siemens Gridscale X Prepay is a scalable energy management solution for utilities, integrating smart meters and customer payment options. The related vulnerabilities increase the risk of unauthorized actions, data exposure, or misuse of sensitive organizational resources.

CVE-2025-40806 Unauthenticated username enumeration. An attacker may determine the validity of usernames by a response code, allowing the attacker to determine whether a username is valid before authentication occurs. This exposure can facilitate targeted attacks by allowing an adversary to identify valid accounts before attempting further compromise.

CVE-2025-40807 Account lock bypass. An attacker can bypass the intended account lock protection by replaying or modifying previously captured valid responses. The issue appears related to session tokens that remain valid after logout or after an administrative account lock. Because these tokens do not expire immediately, an attacker with access to previously captured network responses can continue access the system despite the account being locked. This scenario is particularly concerning when the attacker is a former employee, insider, or anyone with prior authenticated access who may have retained network captured data or sessions artifacts.

Impact

The complete impact of this vulnerability is not yet known.

Solution

Siemens has released a new version of the Gridscale X Prepay and for version 4.2.1 and below, it is recommended to install the provided security update using the appropriates tools and procedures supplied with the product. Before deployment, all updates should be validated, and installed under the supervision of personnel with approved access within the target environment. As a general security practice, Siemens also advises protecting network access with suitable controls such as firewalls, network segmentation, and VPNs. Systems should be configured in accordance with Siemens' operational guidelines to ensure that the devices operate within a secure IT environment.

Acknowledgements

Thank you to the reporter, Kira The Raven Security. This document was written by Michael Bragg.

Vendor Information

Overview

An unauthenticated HTTP request can enable telnet which may lead to remote code execution with root-level privileges.

Description

TOTOLINK manufactures routers and other networking equipment designed for small businesses and home implementations. The AX1800 routers are popular with users connecting multiple internet-capable devices.

The TOTOLINK AX1800 routers are missing authentication in /cgi-bin/cstecgi.cgi?action=telnet endpoint may result in arbitrary command execution at the administrative level. This vulnerability is being tracked by CVE-2025-13184.

Impact

The impact options include full access to configuration and filesystems. This level of access would provide an attacker the capability to modify routing DNS routing, intercept traffic, and achieve lateral movement across the local area network. There is a potential for wide area (WAN) network access if router management or telnet becomes externally reachable.

Solution

The CERT/CC is currently unaware of a practical solution to this problem. For complete remediation, a firmware update is necessary.

Mitigation Suggestions

1. Ensure the web management interface is not exposed to the WAN or any untrusted network. Restrict access to the administrative interface to trusted management hosts only.

2. Treat the X5000R router as untrusted from a security boundary point of view. Where possible, place it behind a separate firewall or router and avoid using it as the primary edge device.

3. Block or monitor unexpected traffic to telnet (TCP port 23) on the device. The sudden appearance of an open telnet service on the router is a strong indicator of exploitation.

Acknowledgements

Thanks to the reporter, HackingByDoing. This document was written by Laurie Tyzenhaus.

Vendor Information

Overview

PCI Express Integrity and Data Encryption (PCIe IDE), introduced in the PCIe 6.0 standard, provides link-level encryption and integrity protection for data transferred across PCIe connections. Several issues were identified in the IDE specification that could allow an attacker with local access to influence data consumed on the link. The PCIe 6.0 IDE Erratum provides corrective guidance, and firmware and hardware updates are expected to address these concerns.

Description

IDE uses AES-GCM encryption to protect confidentiality, integrity, and replay resistance for traffic between PCIe components. It operates between the transaction layer and the data link layer, providing protection close to the hardware against unauthorized modification of link traffic.

Three specification-level vulnerabilities can, under certain conditions, result in consumption of stale or incorrect data if an attacker is able to craft specific traffic patterns at the PCIe interface:

1. CVE-2025-9612 – A missing integrity check on a receiving port may allow re-ordering of PCIe traffic, leading the receiver to process stale data.
2. CVE-2025-9613 – Incomplete flushing of a completion timeout may allow a receiver to accept incorrect data when an attacker injects a packet with a matching tag.
3. CVE-2025-9614 – Incomplete flushing or re-keying of an IDE stream may result in the receiver consuming stale incorrect data packets.

The PCI-SIG has issued a Draft Engineering Change Notice (D-ECN) titled “IDE TLP Reordering Enhancement” to the Base Specification Rev 7.0. The D-ECN feature will be included in upcoming PCI specifications (Base 6.5 and 7.1) and can also be used in current Base 5.x systems through standard compliance procedures. Hardware and firmware vendors that support PCIe 5.0 IDE should apply these corrections and incorporate the updated test procedures to ensure their implementations are compliant. Because IDE operates at the link layer, operating systems and applications may not detect these conditions directly. Timely firmware distribution through normal supply-chain channels is recommended.

Impact

An attacker with physical or low-level access to the PCIe IDE interface may be able to craft packets that cause the receiver to accept stale or corrupted data, affecting the integrity of the protected link.

Solution

Manufacturers should follow the updated PCIe 6.0 standard and apply the Erratum #1 guidance to their IDE implementations. End users should apply firmware updates provided by their system or component suppliers, especially in environments that rely on IDE to protect sensitive data.

Acknowledgements

These issues were reported by Arie Aharon, Makaram Raghunandan, Scott Constable, and Shalini Sharma to follow proper disclosure procedure. Coordination support was actively provided by Intel and PCI-SIG members. This document was prepared by Vijay Sarvepalli.

Vendor Information

References

• https://pcisig.com/PCIeIDEStandardVulnerabilities
• https://pcisig.com/PCI%20Express/ECN/Base/IntegrityandDataEncryption_A
• https://pcisig.com/specifications
• https://pcisig.com/sites/default/files/files/PCIe%20Security%20Webinar_Aug%202020_PDF.pdf
• https://pcisig.com/blog/integrity-and-data-encryption-ide-and-io-security-updates
• https://semiengineering.com/new-age-solution-for-data-integrity-and-authenticity/

Overview

Duc, an open-source disk management tool, contains a stack-based buffer overflow vulnerability allowing for out-of-bounds memory read. An attacker can exploit this vulnerability through malformed input data, and can cause the tool to either crash or cause it to disclose portions of memory that should remain inaccessible. The vulnerability, tracked as CVE-2025-13654, has been patched in version 1.4.6 of Duc. In an enterprise situation, disk indexing tools that use Duc may be susceptible to crashes, data exposure, or other abnormal behavior if they process attacker-controlled input.

Description

Duc is an open-source disk management tool. It can be used to index, inspect and visualize disk usage. Duc is intended for Linux operating systems. The tool maintains a database of files it indexes, and can be used to query said files, or create graphs to detail where the files are.

A stack-based buffer overflow vulnerability has been discovered, tracked as CVE-2025-13654, within Duc. An attacker who can supply crafted input to the tool may trigger an out-of-bounds read, leading to a crash or unintended disclosure of adjacent stack data.

In the Duc software library, the code in buffer.c contains a function called buffer_get. Its length check uses unsigned subtraction, which can wrap on crafted input and result in memcpy() performing an out-of-bounds read.

Impact

An attacker able to send input data to a database or other input stream that uses Duc could cause a crash or information leak.

Solution

Version 1.4.6 of Duc, released on GitHub. Users should update to the latest version ASAP. All versions prior to 1.4.6 are considered to be affected.

Acknowledgements

Thanks to the reporter, HackingByDoing (hackingbydoing@proton.me). This document was written by Christopher Cullen.

Vendor Information

References

• https://github.com/zevv/duc/releases/tag/1.4.6
• https://hackingbydoing.wixsite.com/hackingbydoing/post/stack-buffer-overflow-in-duc