Threats affecting pkg:github/ellanetworks/core

TypiCMS Core versions prior to 16.1.7 contain a stored Cross-Site Scripting (XSS) vulnerability in the file upload module. This flaw allows users with file upload permissions to upload SVG files containing malicious JavaScript, which executes when viewed by other users. The vulnerability arises because the SVG content is not sanitized despite MIME type validation. A bug in SVG parsing can cause errors but does not prevent exploitation. Version 16.1.7 addresses this issue.

CVE-2025-13698 is a medium-severity path traversal vulnerability in Deciso OPNsense version 25.7, specifically in the diag_backup.php component. It allows an authenticated network-adjacent attacker to create arbitrary files with root privileges by exploiting improper validation of user-supplied file paths. The vulnerability does not impact confidentiality or availability but can severely affect system integrity. Exploitation requires high privileges (authentication) but no user interaction. There are no known exploits in the wild currently. European organizations using OPNsense 25.7, especially those in critical infrastructure or government sectors, should prioritize patching or mitigating this issue. Mitigations include strict input validation, restricting file write permissions, and monitoring for unusual file creation activities.

Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.

Gibbon before 29.0.00 allows CSRF.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing. This issue affects Liman MYS: before 2.1.1 - 1010.

Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in /Gibbon/modules/User Admin/user_manage_editProcess.php.