Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-71309

  CVE-2026-71309: rclone serve restic Path Traversal Backend Root Escape

  A flaw in rclone's restic REST server lets anyone with access to the endpoint read, write, or delete files outside the storage path the operator configured, by sending a URL starting with an encoded…

• highCVE-2026-54572

  CVE-2026-54572: rclone Symlink Target Escape via --links (Arbitrary File Write)

  When rclone copies from an untrusted remote with --links enabled, a malicious .rclonelink object can plant an escaping symlink inside the destination, causing a subsequent file write to land anywhere…

• highCVE-2026-70608

  CVE-2026-70608: Electron Sandboxed iframe allow-popups Restriction Bypass

  A sandboxed iframe in an Electron app can open a new browser window without the allow-popups permission, letting untrusted embedded content escape its sandbox boundary.

• highCVE-2026-70601

  CVE-2026-70601: Electron Context Isolation Bypass via Function.prototype.bind Hijack

  A flaw in Electron's contextBridge lets untrusted web content override Function.prototype.bind to intercept Promise callbacks from preload scripts, breaking context isolation and potentially gaining…

• highCVE-2026-53950

  CVE-2026-53950: @tryghost/activitypub Stored XSS via Federated Post Content

  Ghost's ActivityPub feed rendered HTML from remote Fediverse servers without sanitization, letting a malicious server inject and run arbitrary JavaScript in a Ghost admin's browser.

• highCVE-2026-70492

  CVE-2026-70492: open-webui Stored XSS via KaTeX Render-Error Fallback

  A chat message crafted to crash the KaTeX math renderer causes Open WebUI to paste raw HTML from the message directly into the page, letting any authenticated user run JavaScript in a viewer's…

• highCVE-2026-70485

  CVE-2026-70485: Open WebUI NAT64-Encoded SSRF Filter Bypass

  Any authenticated Open WebUI user on a NAT64-capable network can wrap a private or cloud-metadata IPv4 address inside a NAT64 IPv6 prefix to bypass the server's SSRF filter and read internal service…

• criticalCVE-2026-70477

  CVE-2026-70477: Flowise CSV Agent Prompt Injection Remote Code Execution

  An unauthenticated attacker can send a crafted prompt to any Flowise chatflow using the CSV Agent node and cause it to execute arbitrary OS commands on the server, because LLM-generated Python code…

• highCVE-2026-70479

  CVE-2026-70479: open-webui SSRF via Unvalidated Sub-Resource Requests in Playwright Web Loader

  When Open WebUI's Playwright web loader is enabled, any authenticated user can make the browser fetch internal addresses like cloud metadata endpoints by embedding sub-resource requests in a page…

• highCVE-2026-70475

  CVE-2026-70475: Flowise Missing Authorization on Execution Update Endpoint

  Any authenticated Flowise user, regardless of their role, could overwrite the state and data of any workflow execution because the PUT endpoint had no permission check.

• highCVE-2026-70476

  CVE-2026-70476: Flowise Broken Access Control in Stripe Billing Endpoints

  Any authenticated Flowise user can change or cancel another organization's paid Stripe subscription by simply swapping the subscription ID in a billing API request.

• highCVE-2026-70473

  CVE-2026-70473: Flowise Server-Wide Upsert History Information Disclosure

  Any authenticated Flowise user can call a single API endpoint and receive the entire server's vector-store upsert history, including infrastructure URLs, API keys, and configuration details belonging…