p PatchFirst

PatchFirst · Latest vulnerabilities

@nocobase/server vulnerabilities

Vulnerabilities published for @nocobase/server in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. GHSA-ghvf-qf6h-g8x5

    Not ratedFix available

    NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

    ## Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an unsanitized `documentRoot` value to the `storages:update` API. The second vulnerability allows the same admin to trigger Node.js `require()` on any absolute filesystem path via the `pm:enable` plugin manager endpoint, which accepts user-supplied paths with no validation (Local File Inclusion). Chained together, these two flaws allow an attacke

    @nocobase/serverNode.js
    • Update to 2.1.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →