NusaSec

Security Advisories

NusaSec responsibly discloses every vulnerability we discover. The following table is our public record of coordinated disclosures, sorted newest first.

31 / 31 advisories

DateCVETitleResearchers
Jul 23 2026CVE-2026-55495Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Accountriodrwn
Jul 23 2026CVE-2026-55499Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblingsriodrwn
Jul 23 2026CVE-2026-55496Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emailsriodrwn
Jul 23 2026CVE-2026-55497Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the serverriodrwn
Jul 20 2026CVE-2026-59941Uncontrolled resource consumption based on declared BMP dimensionsriodrwn
Jul 20 2026CVE-2026-62326RegexCheck causes Uncontrolled Resource Consumptiontype5afe
Jul 17 2026CVE-2026-63506[Broken Access Control] letting any TinaCloud user authorize against any self-hosted siteriodrwn
Jul 08 2026CVE-2026-54562Non-admin remote download users can SSRF loopback/internal services and read imported responsesriodrwn
Jul 08 2026CVE-2026-54563Broken Access Control in Cloudreve WebDAV (`/dav`) riodrwn
Jun 27 2026CVE-2026-55668dangling symlink on write, letting a scoped user create files outside their scoperiodrwn