tag: Path-Traversal · 5 items
- Engineer — Act: An unauthenticated path traversal in Grav CMS was exploited in the wild — if you run Grav CMS on any public-facing server, audit your version and apply the latest patch immediately to close this pre-auth attack surface.
- SOC/IR — Learn: Confirms ShinyHunters actively weaponizes web CMS vulnerabilities, but the item provides no IOCs or ATT&CK-mappable TTPs applicable to enterprise defenses — useful actor context, no hunt action required.
- Leader — Skip
- Engineer — Act: CVE-2026-85706 is CISA KEV-listed with a public GitHub PoC and confirmed in-the-wild probes — patch GitLab to the fixed release immediately and audit server-side files (secrets, keys, configs) for unauthorized reads since public disclosure.
- SOC/IR — Act: Active exploitation probes are underway; hunt for unauthenticated requests containing path traversal sequences against the GitLab commits API in web/proxy logs going back to the disclosure date, and tune SIEM rules to alert on anomalous API access patterns.
- Leader — Act: Confirm with engineering this week that all self-hosted GitLab instances are patched; if using GitLab.com, request a written statement from GitLab on remediation status — unauthenticated source-code and secret exposure at CVSS 10 with active probes is a material risk worth verifying before it surfaces as a customer or board question.
- Signals: CVE-2026-85706 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Max-severity path traversal in GitLab with a public PoC significantly raises exploitation risk even absent a KEV listing — patch all self-hosted GitLab instances to the fixed version immediately and verify no unauthorized file access occurred before the patch window.
- SOC/IR — Act: A public PoC for a max-severity GitLab flaw means opportunistic exploitation attempts are likely imminent; hunt for anomalous file-read patterns and path traversal sequences (e.g., ../ chains) in GitLab access logs since the disclosure date.
- Leader — Plan: Confirm whether self-hosted GitLab instances exist in the environment and verify engineering teams have prioritized patching within days given the public PoC; no board-level brief warranted yet unless active breach evidence emerges.
- Signals: CVE-2026-85706 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Unauthenticated CVSS 9.8 file read affecting any Gitea 1.22.1–1.27.0 instance; a public repo and crafted Org-mode markup are the only prerequisites, exposing any file the service account can read (secrets, keys, configs). Patch to Gitea 1.27.1 immediately and audit service-account file permissions as a follow-up.
- SOC/IR — Learn: No public PoC, no KEV listing, and no reported active exploitation means there is no immediate detection or hunt workload; awareness is useful context for triaging future anomalous Gitea traffic if exploitation begins.
- Leader — Skip
- Signals: CVE-2026-59774 — CISA KEV: not listed, EPSS n/a, no public PoC found
- Engineer — Act: Active in-the-wild exploitation confirmed by VulnCheck and a public PoC is available; if you self-host Windmill, patch immediately and audit web server logs for unauthenticated requests to the
/api/w/{workspace}/jobs_u/get_log_file/endpoint containing traversal sequences. - SOC/IR — Act: Active exploitation with public PoC means opportunistic scanning is already underway; hunt web proxy and WAF logs for path traversal patterns (e.g.,
../) in requests to Windmill’sget_log_fileendpoint, and sweep for unusual file reads on any Windmill hosts since the PoC dropped. - Leader — Skip
- Signals: CVE-2026-29059 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub