grep -l "Arbitrary File Write" ./machines [2] sorted: date ▼

namediffosdatetags

Silentium easy linux 2026-04-11 A staging Flowise 3.0.5 instance leaks a live password-reset token straight back in the /api/v1/account/forgot-password response (CVE-2025-58434), giving instant takeover of the ben@silentium.htb admin account. Authenticated, the Custom MCP node's mcpServerConfig (CVE-2025-59528) spawns arbitrary processes, yielding root inside the Flowise container — whose environment block hands over SMTP_PASSWORD, reused verbatim as ben's system password over SSH. Root comes from a second internal app: Gogs 0.13.3 running as root with open registration, where CVE-2025-8110 lets the contents API write through a committed symlink to overwrite the repository's pre-receive hook, executed as root on the next push. flowise·cve-2025-58434·password reset token disclosure·account takeover·cve-2025-59528·custom mcp·+10 VariaType medium linux 2026-03-14 Exploited fonttools CVE-2025-66034 designspace path traversal to write a PHP webshell, escalated to user via FontForge archive command injection, then root via setuptools PackageIndex arbitrary file write to cron.d. fonttools·cve-2025-66034·path-traversal·php-injection·lfi·git-exposure·+5

no machines match that filter