Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• criticalCVE-2026-48755

  CVE-2026-48755: Incus Argument Injection in Backup Compression Leading to Arbitrary File Write and RCE

  Incus allows a remote authenticated user to inject extra arguments into the backup compression command, letting them write arbitrary files on the host and potentially execute code as root.

• criticalCVE-2026-48749

  CVE-2026-48749: Incus Arbitrary File Read and Write via rootfs Symlink in Malicious Image

  A crafted container image can trick Incus into mapping its rootfs to any path on the host, letting an authenticated user read or overwrite arbitrary host files as root.

• criticalCVE-2026-48751

  CVE-2026-48751: Incus Restricted Project Bypass via Snapshot Restore

  A flaw in Incus lets an attacker smuggle dangerous low-level container configuration inside a snapshot, move that snapshot into a locked-down project, and restore it to run arbitrary commands as…

• criticalCVE-2026-48752

  CVE-2026-48752: Incus Arbitrary Host File Read and Write via templates/ Symlink

  A malicious container image or instance backup can trick Incus into treating a symlink as its templates directory, letting an attacker read or overwrite any file on the host, including cron jobs…

• highCVE-2026-46619

  CVE-2026-46619: OpenAM MSISDN Authentication Bypass via LDAP Injection

  A missing LDAP filter escape in OpenAM's MSISDN authentication module lets an unauthenticated attacker inject LDAP metacharacters and obtain a valid session as any directory user, no password…

• highCVE-2026-46623

  CVE-2026-46623: OpenAM OAuth2 Module Account Takeover via Unverified Password Change

  A logic flaw in OpenAM's OAuth2 authentication module silently resets any local user's password to their own username after an OAuth2 login, letting an unauthenticated attacker log in as that user…

• highCVE-2026-49229

  CVE-2026-49229: @actual-app/sync-server Insufficient Session Expiration on User Disable

  Disabling an OpenID user in Actual Budget's sync server does not invalidate that user's existing session tokens, letting the disabled account keep accessing budgets and admin functions indefinitely.

• highCVE-2026-54351

  CVE-2026-54351: Budibase Server Mass Assignment via Webhook Trigger

  Any builder on a Budibase instance can hijack another workspace's data by injecting a foreign appId into a public webhook POST body, causing automations to run in the victim's database context.

• criticalCVE-2026-54352

  CVE-2026-54352: @budibase/server Arbitrary File Read via PWA ZIP Symlink

  Any workspace builder on a self-hosted Budibase instance can upload a crafted ZIP file containing a symlink to read any file the server process can open, including the .env file that holds every…

• highCVE-2026-54353

  CVE-2026-54353: @budibase/backend-core SSRF DNS Rebinding Bypass

  Authenticated Budibase users can trick the SSRF blacklist into approving a request that actually connects to an internal host, by using a DNS rebinding hostname that returns a public IP during…

• highCVE-2026-52798

  CVE-2026-52798: Gogs Stored XSS in .ipynb Notebook Preview

  A stored XSS flaw in Gogs lets any user with repository write access embed a javascript: link inside a Jupyter notebook file, which executes arbitrary JavaScript in a viewer's browser when they…

• highCVE-2026-52799

  CVE-2026-52799: Gogs Missing Authorization in Attachment Download

  Gogs serves issue and release attachment files to anyone who knows the UUID, with no check that the requester can actually view the repository the attachment belongs to.