Skip to content

Commit d7e21b9

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-95fv-5gfj-2r84 GHSA-whqg-ppgf-wp8c
1 parent fb80df4 commit d7e21b9

File tree

2 files changed

+129
-0
lines changed

2 files changed

+129
-0
lines changed

‎advisories/github-reviewed/2025/12/GHSA-95fv-5gfj-2r84/GHSA-95fv-5gfj-2r84.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-95fv-5gfj-2r84",
4+
"modified": "2025-12-08T16:25:53Z",
5+
"published": "2025-12-08T16:25:53Z",
6+
"aliases": [
7+
"CVE-2025-64113"
8+
],
9+
"summary": "Emby Server API Vulnerability allowing to gain administrative access without precondition",
10+
"details": "### Impact\n\nThis vulnerability affects all Emby Server versions - beta and stable up to the specified versions.\nIt allows an attacker to gain full administrative access to an Emby Server (for Emby Server administration, **not at the OS level**,).\nOther than network access, no specific preconditions need to be fulfilled for a server to be vulnerable.\n\n### Patches\n\n#### Quick Fix\n\nA quick fix will be rolled out via an update to one of the default-included Emby Server plugins.\nThis way is chosen because many users are updating their servers manually while plugin updates are typically configured to be applied automatically. This allows to get a patch deployed to a large amount of servers within a single day.\n\n#### Server Patches\n\nPatched versions for both, Emby Server stable and Emby Server beta are available now.\n\n**All Emby Server owners are strongly encouraged to apply those updates as soon as possible.**\n\n\n### Workarounds\n\n> [!NOTE]\n> These workarounds are OBSOLETE now. Please update Emby Server instead!\n\nAs and immediate remedy, it is possible to set restricted file system permissions on the `passwordreset.txt` file in the configuration folder of Emby Server. If it doesn't exist, users can create the file themselves or just call the ForgotPassword API once, which will create the file.\n\nOn Windows, users can set DENY permissions for \"Authenticated users\" and on Linux, permissions can be set via `sudo chmod 444 passwordreset.txt`.\nThis will make the API request fail, which completely eliminates the vulnerability.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "NuGet",
21+
"name": "MediaBrowser.Server.Core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "4.9.1.81"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 4.9.1.80"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-95fv-5gfj-2r84"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/EmbySupport/Emby.Security"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-640"
54+
],
55+
"severity": "CRITICAL",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2025-12-08T16:25:53Z",
58+
"nvd_published_at": null
59+
}
60+
}

‎advisories/github-reviewed/2025/12/GHSA-whqg-ppgf-wp8c/GHSA-whqg-ppgf-wp8c.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-whqg-ppgf-wp8c",
4+
"modified": "2025-12-08T16:26:43Z",
5+
"published": "2025-12-08T16:26:43Z",
6+
"aliases": [
7+
"CVE-2025-66202"
8+
],
9+
"summary": "Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765",
10+
"details": "# Authentication Bypass via Double URL Encoding in Astro\n## Bypass for CVE-2025-64765 / GHSA-ggxq-hp9w-j794\n\n---\n\n### Summary\n\nA **double URL encoding bypass** allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 (single URL encoding) was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs like `/%2561dmin` instead of `/%61dmin`, attackers can still bypass authentication and access protected resources such as `/admin`, `/api/internal`, or any route protected by middleware pathname checks.\n\n\n## Fix \n\nA more secure fix is just decoding once, then if the request has a %xx format, return a 400 error by using something like :\n\n```\nif (containsEncodedCharacters(pathname)) {\n // Multi-level encoding detected - reject request\n return new Response(\n 'Bad Request: Multi-level URL encoding is not allowed',\n {\n status: 400,\n headers: { 'Content-Type': 'text/plain' }\n }\n );\n }\n```",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "astro"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "5.15.8"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/withastro/astro/security/advisories/GHSA-whqg-ppgf-wp8c"
46+
},
47+
{
48+
"type": "ADVISORY",
49+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64765"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce"
54+
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/withastro/astro"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-647"
63+
],
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-12-08T16:26:43Z",
67+
"nvd_published_at": null
68+
}
69+
}

0 commit comments

Comments
 (0)