pig-tail/security-researchPoCs & write-ups for CVEs I reported (coordinated disclosure; published + patched only)
Proof-of-concept code and technical write-ups for vulnerabilities I discovered and reported through coordinated disclosure. Every entry here is already public: the vendor advisory is published and a fixed release is available. Nothing under embargo or in draft is included.
The PoCs are verification harnesses, not weaponized exploits: each runs against a local, self-owned instance and proves the defect with a benign sentinel (a marker file, a seeded "secret" record, a policy-evaluation assertion). None of them target third-party systems, and none perform any destructive or persistent action.
— Pig-Tail · Offensive Security Engineer & Vulnerability Researcher · [email protected]
| CVE / Advisory | Project | Class (CWE) | Severity | PoC |
|---|---|---|---|---|
| CVE-2026-78676 | GitPython | Dormant multi-line git-config values are corrupted into live (CWE-88/CWE-94) | Critical | ✅ runnable |
| GHSA-f5m5-jfmq-ghpx | SteeltoeOSS/NetCoreToolService | Unauthenticated RCE via argument injection into 'dotnet new' (CWE-88) | Critical | ✅ runnable |
| CVE-2026-73854 | egroupware | Authorization bypass via api./about. menuaction prefix → pri (CWE-863/CWE-306) | Critical | ✅ runnable |
| CVE-2026-77312 | flyto-core | Arbitrary file write via unguarded data./file. modules (in (CWE-22) | Critical | ✅ runnable |
| CVE-2026-78675 | GitPython | Arbitrary local file content disclosure via [include] direct (CWE-73/CWE-200) | High | ✅ runnable |
| CVE-2026-78677 | GitPython | clone_from()/clone() omit --separate-git-dir from unsafe_git (CWE-22/CWE-73) | High | ✅ runnable |
| CVE-2026-62263 | OpenAM | OpenAM WebAuthn Java deserialization RCE via ObjectInputFilt (CWE-502) | High | 📄 write-up |
| CVE-2026-75606 | egroupware | Authenticated SQL injection via col_filter string-key in Base (CWE-89) | High | ✅ runnable |
| CVE-2026-71859 | egroupware | Incomplete fix for GHSA-8737: eTemplate Widget::expand_name( (CWE-95/CWE-94) | High | ✅ runnable |
| CVE-2026-93537 | fleet | Path traversal in Helm valuesFiles reads outside the bundle (CWE-22/CWE-200) | High | 📄 write-up |
| CVE-2026-93538 | fleet | Cross-tenant BundleDeployment/Secret disclosure via spoofed (CWE-290/CWE-639/CWE-863) | High | 📄 write-up |
| CVE-2026-104615 | fleet | Cluster identity takeover in Fleet cluster registration allo (CWE-290/CWE-639/CWE-863) | High | 📄 write-up |
| CVE-2026-76086 | formie | Integration form-settings action allows SSRF and exfiltratio (CWE-862/CWE-915/CWE-918) | High | 📄 write-up |
| CVE-2026-76087 | formie | Unauthenticated users can overwrite incomplete submissions v (CWE-639/CWE-862) | High | 📄 write-up |
| CVE-2026-76089 | formie | Missing authorization on sent notification resend modal expo (CWE-200/CWE-639/CWE-862) | High | 📄 write-up |
| CVE-2026-53626 | glpi | Arbitrary document read (CWE-639/CWE-862) | High | 📄 write-up |
| CVE-2026-49285 | glpi-agent | OS Command Injection in GLPI Agent ToolBox Results export vi (CWE-78) | High | 📄 write-up |
| CVE-2026-52764 | glpi-agent | MSSQL inventory module executes OS commands with unsanitized (CWE-78) | High | 📄 write-up |
| CVE-2026-45621 | glpi-agent | MongoDB inventory module allows JavaScript injection via une (CWE-94/CWE-116) | High | 📄 write-up |
| CVE-2026-46615 | glpi-agent | Database inventory modules execute OS commands with unsaniti (CWE-78) | High | 📄 write-up |
| CVE-2026-40936 | glpi-agent | ToolBox plugin can allow unauthenticated path traversal lead (CWE-22/CWE-73) | High | 📄 write-up |
| GHSA-q2j6-54g3-jhcj | glpi-agent | MySQL client option-file injection via unsanitized server-su (CWE-74/CWE-94) | High | 📄 write-up |
| CVE-2026-48730 | glpi-inventory-plugin | Reflected XSS (CWE-79) | High | 📄 write-up |
| CVE-2026-75594 | kirby | Access to image files and limited access to JSON files outsi (CWE-22) | High | 📄 write-up |
| CVE-2026-77437 | kiwitcms | ORM lookup-injection in RPC *.filter methods leaks bug-track (CWE-943/CWE-200) | High | ✅ runnable |
| CVE-2026-77435 | kiwitcms | Authenticated SSRF via Bug.details API method (CWE-918/CWE-697) | High | ✅ runnable |
| CVE-2026-58229 | mint | Unbounded HTTP/1 response-header and chunked-trailer accumul (CWE-770) | High | ✅ runnable |
| CVE-2026-61699 | nebula-mesh | Certificate revocation is never enforced at the mesh: nebula (CWE-299/CWE-672) | High | 📄 write-up |
| CVE-2026-63202 | netty-incubator-codec-ohttp | BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via inf (CWE-400/CWE-835) | High | ✅ runnable |
| GHSA-xjxh-mq5w-mpq6 | nocodb | Shared View Row Filter Bypass via Primary Key Lookup (CWE-639/CWE-863) | High | 📄 write-up |
| CVE-2026-82659 | nodemailer | Message-level raw option bypasses disableFileAccess/disableU (CWE-73/CWE-918) | High | ✅ runnable |
| CVE-2026-71315 | nuxt | Nuxt route rules silently dropped for mixed-case paths, bypa (CWE-178/CWE-863) | High | ✅ runnable |
| GHSA-6crf-vqpj-hvr4 | opencti | Unauthenticated resource exhaustion via pre-auth TAXII (CWE-400) | High | 📄 write-up |
