Threat Intelligence Database

Stonewuu ai-fusion-video versions up to 1.2.0 have an insecure direct object reference vulnerability that allows authenticated users to access other users' generated images, videos, and metadata by manipulating task IDs. This vulnerability enables enumeration of auto-increment task IDs on certain endpoints to retrieve unauthorized data.

Stonewuu ai-fusion-video versions up to 1.2.0 contain a path traversal vulnerability that allows authenticated users to write files outside the intended media directory. This occurs via the subDir parameter in the POST /api/storage/upload endpoint, where parent-directory sequences are not properly normalized. This flaw enables attackers to create directories and write files with arbitrary extensions anywhere the service account has write permissions.

Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform.