Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-55441

  CVE-2026-55441: mise Tera exec() Injection via Untrusted Task-Include Files

  Cloning a repo that contains only a mise-tasks/ folder and running any task-listing command executes arbitrary OS commands silently, because mise renders Tera templates in task files before checking…

• highCVE-2026-54512

  CVE-2026-54512: jackson-databind PolymorphicTypeValidator Bypass via Generic Type Parameters

  jackson-databind's type allow-list can be completely bypassed by smuggling a dangerous class inside the generic parameter of a permitted container type, enabling arbitrary class instantiation and…

• highCVE-2026-54513

  CVE-2026-54513: jackson-databind BasicPolymorphicTypeValidator Array Subtype Allowlist Bypass

  A flaw in jackson-databind's polymorphic type validator lets attackers slip a disallowed class past the allowlist by wrapping it in an array, defeating the security control that was supposed to…

• highCVE-2026-54134

  CVE-2026-54134: OctoPrint File Exfiltration via Upload Parameter Injection

  A flaw in OctoPrint's upload pipeline lets an authenticated attacker smuggle internal-only file path fields into any upload request, tricking the server into moving arbitrary host files into the…

• highCVE-2026-55488

  CVE-2026-55488: motionEye Absolute Path Traversal in Media File Handlers

  motionEye's media playback and download endpoints accept a user-supplied filename that can be an absolute path, letting anyone with access read arbitrary files off the server.

• critical

  motionEye LFI to Unauthenticated RCE Chain (CVSS 9.8)

  Four chained bugs in motionEye let a network attacker read any file on the server, steal the admin password hash, upload a malicious script via a tar restore, and execute it without any credentials…

• critical

  motionEye Unauthenticated Admin Credential Theft via Path Traversal

  A path traversal bug in motionEye's media playback handler lets a zero-credential attacker read the server's config file, steal the admin password hash, and immediately replay it for full admin…

• highCVE-2026-48126

  CVE-2026-48126: Algernon Host Header Path Traversal to Arbitrary File Read and Lua RCE

  A missing validation on the HTTP Host header in Algernon's domain mode lets any unauthenticated attacker read files outside the web root and, in common configurations, execute shell commands on the…

• highCVE-2026-48507

  CVE-2026-48507: Snipe-IT Bulk User Edit Incorrect Authorization

  A low-privileged Snipe-IT user with only the 'users.edit' permission can bulk-disable the 'activated' and 'ldap_import' flags on every admin account, locking all administrators out of the instance…

• highCVE-2026-54329

  CVE-2026-54329: Snipe-IT Cross-Tenant Accessory Injection via Mass Assignment

  A low-privileged user in one company can silently create accessory records under a different company by passing a foreign company_id to the Accessories API, breaking multi-tenant inventory isolation.

• criticalCVE-2026-45051

  CVE-2026-45051: OpenAM WebAuthn Authenticator Java Deserialization RCE

  OpenAM's WebAuthn authentication module deserializes a Java object read directly from a user-controlled LDAP attribute with no class filtering, allowing an attacker who can write to that attribute…

• criticalCVE-2026-45052

  CVE-2026-45052: OpenAM Liberty Discovery SOAP Improper Authorization

  An unauthenticated attacker can send a raw SOAP request to OpenAM's Liberty Web Services endpoint and permanently write records into any user's LDAP identity profile, because the server performs…