CWE-177

Podatność typu URL path injection w Apache Gravitino pozwala nieuwierzytelnionemu atakującemu na wstrzyknięcie dowolnych segmentów ścieżki URL poprzez niekodowane identyfikatory dostarczane przez użytkownika. Wysoki wynik CVSS 9.1 oraz brak wymagań dotyczących uwierzytelnienia czynią tę podatność szczególnie niebezpieczną.

@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.

The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in @fastify/express prior to version 4.0.3 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. The vulnerability is caused by how @fastify/express matches requests against registered middleware paths. This vulnerability is similar to, but differs from, CVE-2026-22031 because this is a different npm module with its own code. Version 4.0.3 of @fastify/express contains a patch fort the issue.

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving to the intended filesystem path. This issue has been patched in version 4.12.4.

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.

A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.

Wersje @fastify/static od 8.0.0 do 9.1.0 dekodują zakodowane separatory ścieżek (%2F) przed resolucją systemu plików, podczas gdy router Fastify traktuje je jako znaki literalne. Ta niezgodność pozwala atakującym obejść middleware'ów bazujących na trasach lub zabezpieczenia chroniące pliki serwowane przez @fastify/static — na przykład ochronę drogi poprzez kodowanie separatora ścieżki w URL. Zaktualizuj @fastify/static do wersji 9.1.1, aby naprawić ten problem. Nie ma dostępnych obejść.

Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.

GitLab naprawił podatność w GitLab EE wpływającą na wszystkie wersje od 18.4 przed 18.4.4 oraz 18.5 przed 18.5.2, która mogła pozwolić uwierzytelnionemu użytkownikowi na uzyskanie tokenów CSRF poprzez exploitowanie nieprawidłowej walidacji danych wejściowych w odwołaniach do repozytoriów połączonej ze słabościami w obsłudze przekierowań.

Podatność w obsłudze kodowania URL (Hex Encoding) dotyczy kilku wersji systemu operacyjnego QNAP. Jej wykorzystanie mogłoby pozwolić zdalnym atakującym na doprowadzenie systemu do nieoczekiwanego stanu. Luka została naprawiona w wersjach QTS 5.1.9.2954 build 20241120 i nowszych, QTS 5.2.2.2950 build 20241114 i nowszych, QuTS hero h5.1.9.2954 build 20241120 i nowszych oraz QuTS hero h5.2.2.2952 build 20241116 i nowszych.