The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with subscriber level access and above, to import arbitrary calendars and manage them.

On 12/2/25 4:56 PM, Christian Brabandt wrote: Well, I have asked upstream https://github.com/fluent/fluent-bit/issues/11230 and they have confirmed and updated the blog post[1] to mention 4.0.13 as the proper backported fix.

I did not check or even verify the other versions. Thanks a lot for the reference, this was a missing link so far. https://github.com/fluent/fluent-bit/issues/11230#issuecomment-3606609133

Hello,

On 12/1/25 9:15 PM, Christian Brabandt wrote: On Mi, 26 Nov 2025, Alan Coopersmith wrote: https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/ provides their analysis and information about fixes in versions 4.2, 4.1.1, and 4.0.14, which are available from https://github.com/fluent/fluent-bit . For the record, there is a typo in the above blog post. The backported fixed version is v4.0.13

1. [1] lists 4.2, 4.1.1 and 4.0.14 as fixes 2. [2] lists 4.0.12, 4.1.1 and 4.2.0 as fixes 3. In this thread 4.0.13 (among 4.1.1 and 4.2.0) is now listed as a fix Regards, [2] https://kb.cert.org/vuls/id/761751 [3] https://github.com/fluent/fluent-bit/releases

CVE-2025-12969

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the setfeaturedimagefromexternalurl() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created.

An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cflsdslen, which in turn tries to cast a NULL pointer into struct cflsds. This is related to processpayloadtracesprotong() at opentelemetryprot.c.

Escape sequence injection vulnerability in the filterparser.rb:filterstream function of Fluentd versions 0.12.29 through 0.12.40 may allow for unescaped arbitrary command injection to log files and terminal output.

Processing a specially crafted log may allow for arbitrary command exectuion on the device collecting logs.

References: https://nvd.nist.gov/vuln/detail/CVE-2017-10906 https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes https://github.com/fluent/fluentd/pull/1733 https://jvn.jp/en/vu/JVNVU95124098/index.html