Logo
Retour à la veille

CVE-2026-93955

Publié : 19 septembre 2026
Modifié : 19 septembre 2026
Lien officiel NVD
Score CVSS
4.3
MEDIUM

Description détaillée

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Références et Patchs

https://github.com/grimmory-tools/grimmory/https://github.com/grimmory-tools/grimmory/issues/2431https://github.com/grimmory-tools/grimmory/issues/2431#issuecomment-5384402858https://vuldb.com/cve/CVE-2026-93955https://vuldb.com/submit/943921https://vuldb.com/vuln/407914https://vuldb.com/vuln/407914/cti

Dernières Vulnérabilités

CVE-2026-94057

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.

VOIR DÉTAILS

CVE-2026-94056

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

VOIR DÉTAILS

CVE-2026-94055

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

VOIR DÉTAILS