Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Unauthenticated nested page API leaks restricted & unpublished content - Location: app/controllers/alchemy/api/pagescontroller.rb:28 (Api::PagesController#nested) - Affected version: Alchemy CMS 8.3.0.dev (Rails 8.1.3) Description The unauthenticated GET /api/pages/nested endpoint returns the full page tree to any anonymous caller, including restricted (member-only) pages and unpublished/draft pages that should be hidden. Appending ?elements=true additionally dumps the element/ingredient content of restricted pages, fully bypassing the access control the sibling show and index actions enforce. Root cause Api::PagesController#nested calls no authorize! and applies no published/restricted scoping, unlike show (authorize! :show) and index (accessibleby(currentability, :index)). PageTreePreloader loads page.selfanddescendants unfiltered, and PageTreeSerializer emits every page's metadata (and, with elements, publicversion.elements) with no ability check. Evidence An unauthenticated GET…
Recommended action: Upgrade to 8.2.6, 8.1.14, 8.0.15 or 7.4.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability was discovered during a manual security audit of the AlchemyCMS source code. The application uses the Ruby eval() function to dynamically execute a string provided by the resourcehandler.enginename attribute in Alchemy::ResourcesHelper#resourceurlproxy. Details The vulnerability exists in app/helpers/alchemy/resourceshelper.rb at line 28. The code explicitly bypasses security linting with rubocop:disable Security/Eval, indicating that the use of a dangerous function was known but not properly mitigated. Since enginename is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. But, for this attack to be possible local file access to the alchemy project or the source on a remote server is necessary in order to manipulate the module config file, though. PoC (Proof of Concept) The following standalone Ruby script…
Recommended action: Upgrade to 8.0.3 or 7.4.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.