The Echo v5 web framework has a rate limiter bypass vulnerability due to its default configuration trusting the client-supplied X-Forwarded-For or X-Real-IP headers without validation. When the IPExtractor is not explicitly set, the RealIP() method uses the first IP from these headers, which an attacker can spoof to rotate IP addresses and evade IP-based rate limiting. This allows attackers to bypass throttling and send unlimited requests. The issue affects Echo versions prior to 5.1.0 and has been fixed in version 5.1.0.
A vulnerability in the Echo v5 web framework's MethodOverride middleware allows bypassing CSRF protection by rewriting POST requests to safe HTTP methods (GET, HEAD, OPTIONS, TRACE). When MethodOverride is used before the CSRF middleware, it changes the request method to a safe method before CSRF validation, causing the CSRF middleware to skip token checks. This enables state-changing POST handlers to execute without CSRF validation. The root cause is the lack of a whitelist restricting the override target method, allowing unsafe POST→GET rewrites.
The Echo proxy middleware in github.com/labstack/echo/v5 forwards the X-Real-IP header from incoming requests to upstream services without validation by default. This allows an attacker to supply a spoofed X-Real-IP value, which the proxy relays unchanged. As a result, upstream IP-based access controls, rate limiting, audit logging, and geo-restriction mechanisms relying on X-Real-IP can be bypassed or corrupted. The vulnerability exists because the default configuration leaves IPExtractor unset, preserving legacy behavior that trusts the incoming header. A fix is available in version 5.4.0.
Caddy v2 prior to 2.11.5 has a vulnerability where hop-by-hop headers defined in RFC 7230 §6.1 are not stripped from upstream responses during WebSocket protocol upgrades (HTTP 101 Switching Protocols). This allows headers such as Alt-Svc, Keep-Alive, Proxy-Authenticate, and Set-Cookie to leak through to clients, potentially enabling connection hijacking, cookie injection, and proxy authentication phishing. The issue arises because the code path handling 101 responses returns early and bypasses the header stripping logic that is correctly applied to normal HTTP responses.
A logic error in the legacy WebRTC input handling of the Neko server allows authenticated room members to bypass authorization checks and send mouse and keyboard inputs even when controls are locked. This issue only affects the legacy WebRTC input path when legacy mode and implicit hosting are enabled. The modern control API remains unaffected. The vulnerability is fixed in version 0.0.0-20260805142851-395ca1a6f62b.
Atlantis contains an OS command injection vulnerability in its handling of the Terraform workspace name specified in a pull request's atlantis.yaml file. The workspace name is passed into a shell command without proper escaping, allowing an attacker controlling a pull request to execute arbitrary shell commands as the Atlantis service account during the plan phase. This does not require custom workflows or apply permissions. The vulnerability affects versions from 0.4.0 up to but not including 0.47.1 and has been fixed in version 0.47.1.
FileBrowser contains a vulnerability where symbolic links (symlinks) inside a user's accessible directory can point outside the intended scope, allowing arbitrary file reads outside the served directory. This occurs because the application resolves symlinks without verifying that the resolved target remains within the user's authorized directory. Both authenticated users with download access and unauthenticated users accessing public shares can exploit this to read arbitrary files accessible to the server process. The issue affects version prior to 0.0.0-20260814233832-4126edeb07a0 and is fixed in that version.
A denial of service vulnerability exists in go-jose when parsing JWKs containing RSA keys with crafted parameters. The vulnerability arises because go-jose does not validate bounds on RSA modulus and primes before calling crypto/rsa.PrivateKey.Validate(), which on Go 1.24+ has cubic time complexity relative to key size. This allows an attacker to supply a malicious JWK that causes excessive CPU consumption during parsing. The issue affects go-jose versions prior to 4.1.6 and 3.0.5 and has been fixed in version 4.1.6.
CTFer.io's CTFd Terraform Provider improperly stores team passwords as non-sensitive values in the Terraform state file. This allows local or remote attackers with access to the Terraform state to read team passwords without needing the state decryption password. The vulnerability is identified as CWE-522 and affects versions from 0.1.5 through 1.1.0 and all versions prior to 2.8.2. A patch is available in version 2.8.2. No workaround exists, but limiting access to the Terraform state file is recommended to reduce risk.
A vulnerability in github.com/klauspost/compress/zstd versions prior to 1.20.2 causes a panic due to an out-of-range slice index when decompressing crafted two-block zstd frames. The flaw arises from improper handling of Huffman-weight tables in the FSE decoder, leading to reuse of stale state and an invalid decode table. This can crash any program decompressing untrusted zstd input. The issue is fixed in version 1.20.2.
The MCP file tool in SiYuan note-taking software has an incomplete blocklist for sensitive paths compared to the HTTP file API it claims to align with. This discrepancy allows an authenticated Administrator-level MCP client to read sensitive files such as data/.siyuan/publishAccess.json, exposing plaintext passwords that protect publish-mode shared notebooks and documents. Other sensitive paths blocked by the HTTP API remain accessible via the MCP tool. This issue persists despite prior remediation for a related vulnerability and represents a scope restriction failure in the MCP tool's path resolution logic.
Wails v2 contains a vulnerability in its origin validation logic where wildcard patterns in BindingsAllowedOrigins are improperly converted to regular expressions. This allows origins with suffixes matching the allowed pattern to bypass restrictions and invoke Go backend methods. The issue affects versions before 2.13.0 and can lead to unauthorized access to file systems, databases, or command execution depending on the exposed API surface. A fix is available in version 2.13.0.
Echo v5 contains a vulnerability in the ExtractIPFromRealIPHeader function where it trusts the X-Real-IP header value without verifying the direct network peer's address. This allows an untrusted client to spoof IP addresses such as loopback or private addresses. Applications relying on this extractor for IP allowlists, rate limiting, audit logs, or forwarding headers may accept spoofed client identities. Versions from 5.0.0 through 5.4.0 are affected. The issue is fixed in version 5.4.1 by validating the direct peer before accepting the X-Real-IP header.
Echo's WebSocket proxy middleware in versions 4.15.0 through 4.16.0 and 5.0.0 through 5.4.0 can retain connections and handlers after a WebSocket client disconnects if the upstream server keeps its connection open. This resource retention can accumulate with repeated connections, potentially causing denial of service. The issue does not affect confidentiality or integrity. Fixed in versions 4.16.1 and 5.4.1.
Echo v4's optional Decompress middleware for gzip requests allowed unbounded decompression size, enabling a small compressed request to expand into a very large body. This could cause excessive memory or CPU consumption, leading to denial of service. The middleware is not enabled by default. Versions prior to 4.16.1 are affected. The issue is fixed in Echo v4.16.1 by adding a configurable maximum decompressed size limit.
Echo versions prior to v4.16.1 and v5.4.1 contain a vulnerability where rejected WebSocket upgrade requests can bypass route-level access controls. This occurs because Echo's proxy middleware forwards subsequent HTTP requests on a connection with a rejected upgrade directly to the upstream without passing through Echo's router or middleware, potentially bypassing authentication or authorization enforced at Echo routes. Exploitation requires an accessible proxy route, an upstream that rejects the upgrade without closing the connection, and a target resource on that upstream without its own authorization. Fixed in versions v4.16.1 and v5.4.1.
Echo v5's BodyDump middleware had a vulnerability where it could discard BodyLimit overflow errors for unknown-length requests, such as HTTP/1.1 chunked requests, when the BodyDump capture limit was below the BodyLimit threshold. This allowed a conditional size-policy bypass where a truncated request body could be processed successfully despite exceeding the configured limit. The issue affects all Echo v5 versions from 5.0.0 through 5.4.0. The vulnerability is fixed in version 5.4.1, which changes BodyDump to capture only the configured prefix and properly preserve read errors. Workarounds include disabling BodyDump on affected routes or setting the capture limit above the enforced body limit. No general authentication bypass, data modification, or denial of service is claimed.
Echo v4's BodyDump middleware captures entire request and response bodies without size limits by default, which can lead to excessive memory allocation. This can be exploited by clients submitting large requests or influencing large responses, potentially causing denial of service due to memory exhaustion. The vulnerability affects Echo v4 versions from 4.0.0 up to but not including 4.16.1. A patch is available in version 4.16.1 that introduces configurable limits on captured body sizes.
OpenChoreo contains an authorization bypass vulnerability in its API server's WorkflowRun update endpoint. The server authorizes updates based on ownership metadata from the request body rather than the stored object, allowing an authenticated user with update rights on one component to rewrite ownership labels of a WorkflowRun belonging to another component within the same namespace. This leads to unauthorized access to build logs, Kubernetes events, and the ability to delete runs. The issue affects OpenChoreo versions 1.0.0 through 1.0.5, 1.1.0 through 1.1.6, and 1.2.0 through 1.2.4. Patches are available in versions 1.0.6, 1.1.7, and 1.2.5.
CVE-2026-113729 is a high-severity vulnerability in the moov-io signedxml Go library prior to version 1.4.1. The issue involves uncontrolled resource consumption caused by the ExclusiveCanonicalization function copying the entire accumulated namespace map at every nested XML element. An attacker can craft a deeply nested XML document with many unused namespace declarations, causing excessive memory allocation and potentially terminating the process. This vulnerability can be triggered through the ValidateReferences function without requiring a valid signature or authentication. The flaw is fixed in version 1.4.1.