Skip to content

Commit 2aa06ef

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@0ecf8d7 
1 parent a4b2d62 commit 2aa06ef

File tree

3 files changed

+151
-0
lines changed

3 files changed

+151
-0
lines changed

‎advisories/_posts/2026-03-10-CVE-2026-1776.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-1776 (camaleon_cms): Camaleon CMS vulnerable to Path Traversal through
4+
AWS S3 uploader implementation'
5+
comments: false
6+
categories:
7+
- camaleon_cms
8+
advisory:
9+
gem: camaleon_cms
10+
cve: 2026-1776
11+
ghsa: jw5g-f64p-6x78
12+
url: https://nvd.nist.gov/vuln/detail/CVE-2026-1776
13+
title: Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation
14+
date: 2026-03-10
15+
description: |
16+
Camaleon CMS versions 2.4.5.0 through 2.9.1, prior to commit f54a77e,
17+
contain a path traversal vulnerability in the AWS S3 uploader
18+
implementation that allows authenticated users to read arbitrary
19+
files from the web server’s filesystem. The issue occurs in the
20+
download_private_file functionality when the application is
21+
configured to use the CamaleonCmsAwsUploader backend. Unlike the
22+
local uploader implementation, the AWS uploader does not validate
23+
file paths with valid_folder_path?, allowing directory traversal
24+
sequences to be supplied via the file parameter. As a result, any
25+
authenticated user, including low-privileged registered users, can
26+
access sensitive files such as /etc/passwd. This issue represents a
27+
bypass of the incomplete fix for CVE-2024-46987 and affects
28+
deployments using the AWS S3 storage backend.
29+
cvss_v4: 6.0
30+
unaffected_versions:
31+
- "< 2.4.5.0"
32+
notes: Never patched; last release was 2.9.1
33+
related:
34+
url:
35+
- https://nvd.nist.gov/vuln/detail/CVE-2026-1776
36+
- https://github.com/owen2345/camaleon-cms/pull/1127
37+
- https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af
38+
- https://camaleon.website
39+
- https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read
40+
- https://github.com/advisories/GHSA-jw5g-f64p-6x78
41+
---

‎advisories/_posts/2026-03-11-CVE-2026-31830.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-31830 (sigstore): sigstore-ruby verifier returns success for DSSE
4+
bundles with mismatched in-toto subject digest'
5+
comments: false
6+
categories:
7+
- sigstore
8+
advisory:
9+
gem: sigstore
10+
cve: 2026-31830
11+
ghsa: mhg6-2q2v-9h2c
12+
url: https://github.com/sigstore/sigstore-ruby/security/advisories/GHSA-mhg6-2q2v-9h2c
13+
title: sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto
14+
subject digest
15+
date: 2026-03-11
16+
description: |
17+
### Summary
18+
19+
`Sigstore::Verifier#verify` does not propagate the `VerificationFailure`
20+
returned by `verify_in_toto` when the artifact digest does not match
21+
the digest in the in-toto attestation subject. As a result, verification
22+
of DSSE bundles containing in-toto statements returns `VerificationSuccess`
23+
regardless of whether the artifact matches the attested subject.
24+
25+
### Details
26+
27+
In `lib/sigstore/verifier.rb`, the verify method calls `verify_in_toto`
28+
(line 176) without capturing or checking its return value:
29+
30+
`verify_in_toto(input, in_toto)`
31+
32+
When `verify_in_toto` detects a digest mismatch, it returns a
33+
`VerificationFailure` object. Because the caller discards this
34+
return value, execution unconditionally falls through to return
35+
`VerificationSuccess`. This is the only verification sub-check in
36+
the method (out of 12) whose failure is not propagated.
37+
38+
The message_signature code path is not affected.
39+
40+
### Impact
41+
42+
An attacker who possesses a valid signed DSSE bundle containing an
43+
in-toto attestation for artifact A can present it as a valid attestation
44+
for a different artifact B. All other verification checks (DSSE envelope
45+
signature, certificate chain, Rekor inclusion, SCTs, policy) pass because
46+
they are independent of the artifact content. Only the in-toto subject
47+
digest check detects the mismatch, and its result is discarded.
48+
49+
This allows an attacker to bypass artifact-to-attestation binding for
50+
any consumer that relies on `Sigstore::Verifier#verify` to validate
51+
DSSE/in-toto bundles.
52+
53+
### Workarounds
54+
55+
None. Consumers cannot work around this without patching the library.
56+
cvss_v3: 7.5
57+
patched_versions:
58+
- ">= 0.2.3"
59+
related:
60+
url:
61+
- https://nvd.nist.gov/vuln/detail/CVE-2026-31830
62+
- https://github.com/sigstore/sigstore-ruby/security/advisories/GHSA-mhg6-2q2v-9h2c
63+
- https://github.com/advisories/GHSA-mhg6-2q2v-9h2c
64+
---

‎advisories/_posts/2026-03-12-GHSA-qmpg-8xg6-ph5q.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-qmpg-8xg6-ph5q (action_text-trix): Trix has a Stored XSS vulnerability
4+
through serialized attributes'
5+
comments: false
6+
categories:
7+
- action_text-trix
8+
advisory:
9+
gem: action_text-trix
10+
ghsa: qmpg-8xg6-ph5q
11+
url: https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q
12+
title: Trix has a Stored XSS vulnerability through serialized attributes
13+
date: 2026-03-12
14+
description: |
15+
### Impact
16+
17+
The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS
18+
attacks when a `data-trix-serialized-attributes` attribute bypasses
19+
the DOMPurify sanitizer.
20+
21+
An attacker could craft HTML containing a `data-trix-serialized-attributes`
22+
attribute with a malicious payload that, when the content is rendered,
23+
could execute arbitrary JavaScript code within the context of the user's
24+
session, potentially leading to unauthorized actions being performed
25+
or sensitive information being disclosed.
26+
27+
### Patches
28+
29+
Update Recommendation: Users should upgrade to Trix editor
30+
version 2.1.17 or later.
31+
32+
### References
33+
34+
The XSS vulnerability was responsibly reported by Hackerone
35+
researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).
36+
cvss_v3: 4.6
37+
patched_versions:
38+
- ">= 2.1.17"
39+
related:
40+
url:
41+
- https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q
42+
- https://github.com/basecamp/trix/releases/tag/v2.1.17
43+
- https://github.com/basecamp/trix/pull/1282
44+
- https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc
45+
- https://github.com/advisories/GHSA-qmpg-8xg6-ph5q
46+
---

0 commit comments

Comments
 (0)