[0day-rubbish] SmartBear Collaborator Server 15.1.15101 authenticated DOORS/Simulink review-file upload zip-slip to anonymous webroot Groovy Server Page execution as uid 1001 (7.5)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-10-15 07:42 UTC
Importiert: 2026-10-20 19:12 UTC
Quelle-ID: full_disc
uid_hash: 6d491a37cf159ad6f733e00f8a98e9ad9766ead20f8a4708c43cc87ff19dec49

Full Disclosure

Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in SmartBear

Collaborator Server 15.1.15101, the closed-source peer and technical code-review

platform from SmartBear that runs as a Java web application on Apache Tomcat. One

low-privilege authenticated account plants a Groovy Server Page in the Tomcat

webroot through an archive-extraction path traversal, and any anonymous client -

a crawler, a scanner, anyone - then executes it...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss