https://bokkapig.pages.dev/tags/cve-2025-58434/Recent content in CVE-2025-58434 on bokkapigHugoen-gbSat, 11 Apr 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/silentium/Sat, 11 Apr 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/silentium/A staging Flowise 3.0.5 instance leaks a live password-reset token straight back in the /api/v1/account/forgot-password response (CVE-2025-58434), giving instant takeover of the <a href="mailto:ben@silentium.htb">ben@silentium.htb</a> admin account. Authenticated, the Custom MCP node&rsquo;s mcpServerConfig (CVE-2025-59528) spawns arbitrary processes, yielding root inside the Flowise container — whose environment block hands over SMTP_PASSWORD, reused verbatim as ben&rsquo;s system password over SSH. Root comes from a second internal app: Gogs 0.13.3 running as root with open registration, where CVE-2025-8110 lets the contents API write through a committed symlink to overwrite the repository&rsquo;s pre-receive hook, executed as root on the next push.