Security Advisories
Real-world vulnerabilities discovered and responsibly disclosed by turingpoint in widely used open-source and enterprise software.
Security Research
Published Advisories
turingpoint conducts active security research on widely used open-source and enterprise software. Many of these vulnerabilities surface directly during penetration tests for our clients. The following findings were identified by us, disclosed to the vendors through coordinated disclosure, and published as CVEs once a patch became available. Security research made in Germany.
Sort by:
Product
CVE
Vulnerability
CVSS
Advisory
- Bulwark WebmailrequestedThe WOPI editor token and the `jmap_stalwart_ctx` cookie are the same AES-256-GCM envelope under the same key; `isValidContext` checks neither the purpose tag `t: 'wopi'` nor the file scope nor `exp`, so an editor token counts as a full session7.3 · High
- Bulwark Webmailrequested`POST /api/auth/session` writes the session cookie from an unauthenticated request body with no CSRF check; a form with `enctype=\"text/plain\"` produces valid JSON, and `SameSite=Lax` does not apply because the cookie is written rather than read6.3 · Medium
- Bulwark Webmailrequested`/plugin-sandbox` is a login-free top-level document carrying `unsafe-eval` whose handler binds to the first window that posts to it without checking its origin; the supplied string reaches `new Function` in the webmail origin8.8 · High
- Bulwark Webmailrequested`encodeHeaderWord()` encodes only values holding non-ASCII characters; a CRLF smuggled into the subject inside an encoded word is copied unchanged into the read receipt and becomes real headers sent by the victim's account5.7 · Medium
- Bulwark WebmailrequestedA `cid:` link becomes a blob URL with a sender-chosen MIME type and is passed to `window.open()`; on paths whose last segment contains a dot the proxy sends no CSP, so the blob runs in the webmail origin9.3 · Critical
- Bulwark Webmailrequested`POST /api/auth/stalwart-context` and `POST /api/auth/session` issue the encrypted identity cookies for a freely chosen username; `verifyIdentity()` checks only the name in the cookie, not the credential it carries. A bypass of the fix for CVE-2026-348348.2 · High
- SEP sesamrequestedUnauthenticated remote root code execution: the `executeSql` REST endpoint (TCP 11401, no authentication by default) compiles a `RYTHM` `template` expression to Java bytecode and runs it as root10.0 · Critical
- Collax Security GatewayrequestedOS command injection with no precondition: a delegated `mailadmin` injects via the hold action `refvalue` and reaches execution as `admin`, then root9.9 · Critical
- Collax Security GatewayrequestedOS command injection: a delegated `proxyadmin` injects via the Squid rule tester `plain` fields `url`/`username` and reaches execution as `admin`, then root9.9 · Critical
- Collax Security GatewayrequestedAnonymous reflected SVG XSS: the `c` parameter of `generate-logo.cgi` reaches an active `image/svg+xml` document raw9.3 · Critical
- Collax Security GatewayrequestedAnonymous reflected XSS: `ui` and `from` are reflected without `ESCAPE=HTML` into the login page of both origins, enabling credential harvesting9.3 · Critical
- Collax Security GatewayrequestedAnonymous reflected XSS: `webaccess.cgi` serialises `%ENV` into an inline `<script>` block and does not escape the wrapping single quote9.3 · Critical
- Collax Security GatewayrequestedOS command injection: a delegated `mailadmin` overwrites the client-side queue `id` in held-mail release and reaches execution as `admin`, then root8.5 · High
- Collax Security GatewayrequestedCSRF on `rrd2csv.cgi` (`eval "require $plugin"`, no CSRF token, no SameSite) reaches code execution as `admin` and root via setuid `suwrap`8.3 · High
- Collax Security GatewayrequestedStored XSS: an unauthenticated SMTP sender sets an envelope sender the held-mail queue `Html` cell renderer writes as innerHTML8.0 · High
- Collax Security GatewayrequestedStored XSS: a layer 2 neighbour sends an LLDP frame whose typeless `<display>` field renders as raw innerHTML in the qooxdoo rich label7.4 · High
- Collax Security GatewayrequestedAnonymous deletion of the 2FA token store via path traversal in the logout cookie (`->new(sprintf)` instead of `->child`), plus an existence oracle for arbitrary paths7.3 · High
- TeableCVE-2026-104100Path traversal in the `hash` parameter of the attachment presign API: a self-registered account writes and overwrites arbitrary files in the container as root8.8 · High
- Zammadnot requestedThe public GraphQL mutation `userSignup` accepts arbitrary user columns from `objectAttributeValues`; an anonymous attacker sets `verified`, `organization_id` and `organization_ids` and reads the tickets of foreign organizations9.3 · Critical
- Zammadnot requestedA customer sets `preferences.links` and `preferences.security` when creating an article, which the default ticket view renders raw; opening the ticket runs JavaScript in the agent's session8.5 · High
Coordinated Disclosure
turingpoint follows the principle of coordinated disclosure: vulnerabilities we find are first reported confidentially to the affected vendor and only documented publicly once a patch is available. This gives users the opportunity to secure their systems before technical details become known.
This Expertise for Your Software
Our team finds critical vulnerabilities in production software before attackers do. Have your applications tested by the same specialists, with a penetration test from turingpoint.