Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
23 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log. Root Cause The |raw filter is required on the outer trans() call to preserve <span tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter. Vulnerable code (resources/views/list/ale.twig lines 107, 110): No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser. Data Flow CSP Note The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=... payload bypasses the nonce…
Recommended action: Upgrade to 6.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The User management API endpoints (GET /api/v1/users and GET /api/v1/users/{id}) are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status. Affected Endpoints 1. GET /api/v1/users (UserController::index, line 94) — Lists ALL users with full details. No role check. 2. GET /api/v1/users/{id} (UserController::show, line 126) — Shows any user's details by ID. No role check. Root Cause (1-of-N Inconsistency) Other methods in the same controller properly check for the 'owner' role: - store() — UserStoreRequest::authorize() checks auth()-user()-hasRole('owner') ✓ - destroy() — Explicitly checks $this-repository-hasRole($admin, 'owner') ✓ But index() and show() have no role check at all. The route group at routes/api.php:734-747 has no admin middleware, only the global auth:api middleware. Exposed Data The UserTransformer (line 40-54) returns: - email — user's email address - role — user's role…
Recommended action: Upgrade to 6.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to your Firefly III data using passwords stolen from other sources. As OAuth applications are easily enumerable using an incrementing id, an attacker could try sign an OAuth application up to a users profile quite easily if they have created one. The attacker would also need to know the victims username and password. Patches Problem has been patched in Firefly III v6.1.17 and up. Workarounds - Use a unique password for your Firefly III instance, - Store your password securely, i.e. in a password manager or in your head. References - https://owasp.org/www-community/attacks/PasswordSprayingAttack - https://www.menlosecurity.com/what-is/highly-evasive-adaptive-threats-heat/mfa-bypass
Recommended action: Upgrade to 6.1.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CSV injection is a vulnerability where untrusted user input in CSV files can lead to unauthorized access or data manipulation. In my subsequent testing of the application. Details I discovered that there is an option to "Export Data" from the web app to your personal computer, which exports a "csv" file that can be opened with Excel software that supports macros. P.S I discovered that the web application's is offering a demo-site that anyone may access to play with the web application. So, there's a chance that someone will export the data (CVS) from the demo site and execute it on their PC, giving the malicious actor a complete control over their machine. (if a user enters a malicious payload to the website). PoC You can check out my vulnerability report if you need more details/PoC with screenshots: (removed by JC5) Impact An attacker can exploit this by entering a specially crafted payload to one of the fields, and when a user export the csv file using the "Export Data"…
Recommended action: Upgrade to 6.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.
Recommended action: Upgrade to 6.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Firefly III prior to 6.0.0 insufficiently expires sessions upon close.
Recommended action: Upgrade to 6.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Firefly III versions prior to 6.0.0 are vulnerable to improper input validation.
Recommended action: Upgrade to 6.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
Recommended action: Upgrade to 5.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
Recommended action: Upgrade to 5.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query.
Recommended action: Upgrade to 4.7.17.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$fileid$ attachment editing.
Recommended action: Upgrade to 4.7.17.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$fileid$ attachment viewing.
Recommended action: Upgrade to 4.7.17.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tagnumber$ tag summary page. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability
Recommended action: Upgrade to 4.7.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
firefly-iii is vulnerable to a Cross-Site Request Forgery (CSRF) attack which can disable two factor authentication for the target user.
Recommended action: Upgrade to 5.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Recommended action: Upgrade to 5.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Recommended action: Upgrade to 5.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
firefly-iii is vulnerable to URL Redirection to Untrusted Site
Recommended action: Upgrade to 5.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). This has been mitigated in version 5.6.1
Recommended action: Upgrade to 5.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fintsurl to import/job/configuration, and import/create/fints.
Recommended action: Upgrade to 4.7.17.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Recommended action: Upgrade to 5.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Recommended action: Upgrade to 5.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Recommended action: Upgrade to 5.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
firefly-iii is vulnerable to Improper Lack of Restriction of Excessive Authentication Attempts
Recommended action: Upgrade to 5.5.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.