Threats tagged 'ghsa-m48p-vcj6-wq3j'

Arelle versions prior to 2.39.10 have an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint. This endpoint accepts a plugins query parameter that is forwarded to the plugin manager without any authentication or authorization checks. An attacker can supply a URL to a malicious Python file via this parameter, causing the Arelle webserver to download and execute attacker-controlled code with the privileges of the Arelle process.