Security Findings

CyStack researcher Duong Tran discovered an information disclosure flaw in Wireshark's BLF (Binary Logging Format) file parser. The parser reads memory it never initialized while processing a malformed BLF capture, so leftover bytes from the process can surface in the decoded output. An attacker who convinces an analyst to open a crafted BLF file could thus disclose small amounts of potentially sensitive memory contents. It affects Wireshark 4.6.0–4.6.6 and 4.4.0–4.4.16; upgrading to 4.6.7 or 4.4.17 fixes it.

CyStack researcher Trung Nguyen discovered a denial-of-service flaw in Wireshark's DBS Etherwatch file parser. The parser mishandles a malformed packet trace file and overflows a stack buffer, so simply opening a crafted capture makes Wireshark crash. An attacker only needs to convince an analyst to open such a file — a realistic scenario since capture files are routinely shared for troubleshooting — to disrupt the analyst's work. It affects Wireshark 4.6.0–4.6.6 and 4.4.0–4.4.16; upgrading to 4.6.7 or 4.4.17 fixes it.

CyStack researcher Thanh Nguyen discovered an arbitrary file write flaw in rclone's local backend. With the --links flag, rclone stores symlinks as .rclonelink text files holding the target path, and when syncing from a remote it calls os.Symlink() on that target without validating it. A malicious remote can therefore supply a .rclonelink whose target is an absolute path or a ../ traversal, so rclone creates a symlink that escapes the destination directory and later writes land on files like ~/.ssh/authorized_keys, shell startup files, or cron jobs — giving the attacker code execution as the victim user. It affects rclone through v1.74.3; upgrading to v1.74.4 fixes it.

CyStack researcher Thanh Nguyen discovered a privilege-escalation flaw in rclone's local backend. When copying with the -M/--metadata flag, rclone applies the source-supplied mode, uid, and gid to the created file without masking the setuid/setgid bits, so a malicious remote can mark a binary with a setuid mode. A victim who runs rclone copy -M from that source then plants a setuid executable — owned by root if rclone runs as root — turning into a local privilege-escalation backdoor. It affects rclone through v1.74.3; upgrading to v1.74.4 fixes it.

CyStack researcher Trung Nguyen discovered an XML External Entity (XXE) flaw in Foxit PDF Reader and Editor. When the application opens a crafted XDP document disguised as a PDF, its XML parser resolves external entities without adequate restrictions, so a malicious file can force the reader to fetch attacker-named resources and leak their contents. This lets an attacker who gets a victim to open such a file disclose local files or internal network data. It affects Foxit PDF Reader/Editor 2026.1.1.36485 and earlier (and the corresponding 13.x/14.x builds); upgrading to 2026.1.2, 14.0.5, or 13.2.5 fixes it.

CyStack researcher Phuc Nguyen discovered a tar path-traversal (TarSlip) flaw in Frappe Framework's package import. When Frappe extracts an imported package archive, it writes each entry using the path stored in the archive without confining it to the target directory, so an archive containing ../ entries can drop files anywhere the Frappe process can write. An attacker who gets a crafted package imported can thus overwrite application code or configuration and achieve remote code execution on the server. It affects Frappe before 15.112.0 and before 16.23.0; upgrading to 15.112.0 or 16.23.0 fixes it.

A critical vulnerability has been identified that allows authenticated users to execute remote code on the host system due to a regression in the SHELL_SAFE_COMMAND_PATTERN. This flaw can potentially lead to full system compromise, allowing attackers to gain root access.

CyStack researcher Trung Nguyen discovered a path traversal flaw in libzypp, the ZYpp package management library used by SUSE and openSUSE. When libzypp parses the keyhint entries in a repository's repomd.xml, it extracts the GPG key filename without validating it, so an entry such as gpg-pubkey/../../../etc/ld.so.preload escapes the cache directory and is copied to an attacker-chosen path. Because this happens during a zypper refresh before signature verification completes, a malicious or man-in-the-middled repository can write files as root and achieve remote code execution. It affects libzypp through 17.38.11; upgrading to 17.38.12 fixes it.

A flaw in Notepad++ lets an attacker run a malicious program on the victim's computer without their consent. An earlier fix was meant to block this by only trusting programs in safe system folders, but CyStack researcher Trung Nguyen found a way to slip past that check and reach a malicious file anyway. The bug affects Notepad++ v8.9.6.1 and is fixed in v8.9.6.2.

CyStack researcher Trung Nguyen discovered a server-side request forgery (SSRF) flaw in Fluentd's out_http plugin. The plugin expands placeholders such as ${tag} inside its endpoint configuration without validating the values, which can derive from untrusted record data, so an attacker can control the destination host of outbound HTTP requests. This lets requests be redirected to internal services or cloud metadata endpoints like the AWS IMDS at 169.254.169.254, enabling unauthorized access and credential exfiltration. It affects Fluentd through 1.19.2; upgrading to 1.19.3 fixes it.

CyStack researcher Trung Nguyen discovered a denial-of-service flaw in Fluentd's in_http and in_forward input plugins. The plugins cap the size of incoming compressed payloads but never limit the size after decompression, so an unauthenticated attacker can send a small gzip bomb that expands to a massive volume in memory. The resulting out-of-memory condition crashes the Fluentd process and halts all logging on the host. It affects Fluentd through 1.19.2; upgrading to 1.19.3 fixes it.

CyStack researchers Trung Nguyen and Thanh Nguyen discovered a sensitive information exposure in Fluentd's Monitor Agent. Its REST API (for example /api/plugins.json) serializes loaded plugins' internal instance variables without filtering, and because plugins often hold passwords, API keys, and cloud credentials in those variables, the data is returned in plain text. Anyone able to reach the Monitor Agent port (default 24220) can therefore harvest the secrets Fluentd uses to authenticate to downstream systems. It affects Fluentd through 1.19.2; upgrading to 1.19.3 fixes it.

CyStack researcher Trung Nguyen discovered an arbitrary file write flaw in Fluentd's out_file plugin. When a path is built dynamically from the ${tag} placeholder, Fluentd does not sanitize the tag, so a record routed from an untrusted source can inject path-traversal sequences (../) and escape the intended output directory. An attacker can thus write attacker-controlled content to arbitrary locations — overwriting configs, dropping plugins, or clobbering system files — and escalate to remote code execution under Fluentd's privileges. It affects Fluentd through 1.19.2; upgrading to 1.19.3 fixes it.

CyStack researcher Trung Nguyen discovered a missing authorization flaw in the OpenShift Cluster Logging Operator. When a ClusterLogForwarder output authenticates with a ServiceAccount token, the operator mints and forwards that token without checking whether the user who configured the forwarder is allowed to use it. As a result, a delegated editor with write access to ClusterLogForwarder objects can point an output at a server they control, capture the ServiceAccount token, then assume that identity and escalate privileges within the cluster. It affects the Logging Subsystem for Red Hat OpenShift (cluster-logging-operator); with no fix released yet, administrators should restrict ClusterLogForwarder write access and block collector egress to untrusted endpoints.

CyStack researcher Thanh Nguyen discovered a server-side request forgery (SSRF) flaw in Hugo's HTTP URL security policy. The default security.http.urls deny rules matched only dotted-decimal addresses, so alternate IPv4 encodings slip past them — http://2130706433/, http://0x7f000001/, and http://017700000001/ all resolve to 127.0.0.1 yet evade the block. An attacker who can influence a URL passed to resources.GetRemote can thus reach loopback services, internal resources, and cloud metadata endpoints during a build — especially dangerous in CI or hosted build environments. It affects Hugo v0.162.0 through v0.163.0; upgrading to v0.163.1 fixes it.

CyStack researcher Thanh Nguyen discovered a symlink confinement bypass in Hugo's virtual filesystem. A regression in v0.123.0 made RootMappingFs.statRoot call Stat instead of Lstat, so it now follows symlinks: a symlink placed inside a mounted directory (for example a locally-vendored theme under themes/) is followed out of bounds, letting a direct resources.Get lookup read any file the Hugo process can access. The risk is real for sites that build untrusted or third-party theme content, which can smuggle in such a symlink to exfiltrate secrets during the build. It affects Hugo v0.123.0 through v0.163.0; upgrading to v0.163.1 fixes it.

CyStack researcher Trung Nguyen discovered a heap-based buffer overflow in NGINX's HTTP/2 upstream modules (ngx_http_proxy_v2_module and ngx_http_grpc_module). When NGINX proxies traffic to an HTTP/2 backend (proxy_http_version 2 or grpc_pass), a remote, unauthenticated attacker can send oversized request headers that overrun a heap buffer while NGINX builds the upstream request, crashing the worker process (denial of service) and potentially enabling remote code execution where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration: the upstream must use HTTP/2, ignore_invalid_headers must be set to off, and large_client_header_buffers must permit buffers larger than 2 MB — default deployments are not affected. The flaw affects NGINX Open Source 1.30.0–1.30.2 and 1.31.1 (fixed in 1.30.3 and 1.31.2) and NGINX Plus R33–R36 and 37.0.0–37.0.1 (fixed in R36 P6 and 37.0.2.1); operators who cannot upgrade can mitigate by removing ignore_invalid_headers off or reducing large_client_header_buffers below 2 MB.

CyStack researcher Trung Nguyen discovered a use-after-free in NGINX's HTTP/3 module (ngx_http_v3_module) and proved it by crafting an HTTP/3 session that reopens a QPACK encoder stream. Because NGINX keeps using a buffer it has already freed, a remote, unauthenticated attacker who can reach an HTTP/3 (QUIC) listener can crash the worker process and cause a denial of service; on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, the same flaw may be leveraged for remote code execution. No authentication or special privileges are needed — any client allowed to open an HTTP/3 connection can trigger it. The bug affects NGINX Open Source 1.31.0–1.31.1 and is fixed in 1.31.2; operators who cannot upgrade can mitigate by disabling HTTP/3 (removing quic from all listen directives).

CyStack researcher Phuc Nguyen discovered an unsafe URL path construction flaw in the LangGraph SDK. The SDK drops caller-supplied identifiers into request URLs without encoding them, so an identifier carrying path separators or traversal sequences can redirect a request to a different resource and bypass authorization controls that rely on URL-prefix matching — allowing unauthorized access to, or modification and deletion of, resources outside the caller's scope. The risk is greatest when an application forwards untrusted identifiers to the SDK without validating their format. It affects langgraph-sdk 0.3.14 and earlier; upgrading to 0.3.15 fixes it.

CyStack researcher Phuc Nguyen discovered an unsafe deserialization flaw in LangGraph's checkpoint loading. The JsonPlusSerializer rebuilds Python objects from stored JSON checkpoints without restricting which types it reconstructs, so an attacker who can tamper with the checkpoint store — for example a shared or compromised database — can plant a payload that runs arbitrary code when the checkpoint is loaded, turning write access to the storage layer into code execution in the LangGraph worker. It affects LangGraph 4.1.0 and earlier; upgrading to 4.1.1 fixes it.