Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-82393

  CVE-2026-82393: pnpm Scoped-Name Path Traversal Arbitrary File Write

  Installing a tarball dependency whose package.json name is a crafted scoped path like @x/../../… tricks pnpm into writing files anywhere on the filesystem, even when lifecycle scripts are disabled.

• highCVE-2026-82392

  CVE-2026-82392: pnpm Virtual Store Linker Path Traversal via Crafted Lockfile

  A crafted pnpm-lock.yaml with path traversal sequences in package keys can cause pnpm to write arbitrary files anywhere on the filesystem when a developer runs pnpm install.

• highCVE-2026-62680

  CVE-2026-62680: Orval Generation-Time SSRF and Local File Inclusion via Unvalidated $ref

  Running the Orval OpenAPI code generator on a malicious spec lets an attacker make the build host fetch arbitrary internal URLs or read any file on disk, just by pointing a $ref field at a remote URL…

• highCVE-2026-64850

  CVE-2026-64850: Grav CMS Remote Code Execution via Unrestricted Callable in Blueprint::dynamicData()

  A page editor in Grav CMS can embed a malicious callable directive in page frontmatter that runs arbitrary shell commands as the web server user whenever anyone visits the page, including…

• criticalCVE-2026-72920

  CVE-2026-72920: SeaweedFS Unauthenticated IAM gRPC Service

  A missing authentication check on SeaweedFS's filer IAM gRPC service lets any network-reachable client create users, mint access keys, and assign admin S3 policies without credentials.

• highCVE-2026-81891

  CVE-2026-81891: elFinder ZIP Extraction MIME Filter Bypass Leading to RCE

  elFinder's ZIP extraction command skips a critical MIME normalization step, letting attackers smuggle PHP files inside a ZIP archive and execute them on the server even when direct PHP uploads are…

• highCVE-2026-82397

  CVE-2026-82397: tornado Urlencoded Body Parsing DoS via Unbounded Field Count

  Any unauthenticated attacker can send a single large form-encoded HTTP request to a Tornado server and freeze it completely, because Tornado parses the body synchronously on the event loop with no…

• highCVE-2026-81892

  CVE-2026-81892: EasyAdmin Custom-Action Dispatcher Authorization Bypass

  A low-privilege EasyAdmin user can reach any Symfony route by name simply by passing its route name in a query parameter, skipping path-based access_control rules that were supposed to protect it.

• highCVE-2026-59834

  CVE-2026-59834: SiYuan SQL Injection via Block Search paths Parameter

  SiYuan's block search API lets an unauthenticated publish visitor smuggle a UNION SELECT through the paths[] parameter to read private note content that the publish visibility system is supposed to…

• highCVE-2026-59832

  CVE-2026-59832: SiYuan Authenticated Path Traversal in /snippets/ Handler

  An authenticated SiYuan user can read any file inside the workspace, including the kernel API token and full document database, by sending a percent-encoded directory traversal path to the /snippets/…

• highCVE-2026-19418

  CVE-2026-19418: TYPO3 CMS Backend Broken Referrer Enforcement Allows CSRF via XSS

  A misconfigured referrer check in TYPO3 13.x lets any JavaScript running on the same domain silently call protected backend and Install Tool endpoints using a logged-in user's session.

• highCVE-2026-84304

  CVE-2026-84304: gRPC-Go Heap Memory Exhaustion via HTTP/2 DATA Frame Fragmentation

  Any unauthenticated attacker can crash a gRPC-Go server by sending a large number of tiny HTTP/2 DATA frames across multiple streams, consuming far more heap memory than the actual payload size would…