https://bokkapig.pages.dev/tags/cve-2026-27626/Recent content in CVE-2026-27626 on bokkapigHugoen-gbWed, 05 Aug 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/enigma/Wed, 05 Aug 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/enigma/A world-readable NFS export (/srv/nfs/onboarding) hands out an onboarding PDF containing kevin’s webmail credentials for mail001.enigma.htb; the same default password Enigma2024! works for sarah, whose mailbox holds an IT provisioning email with admin credentials for the internal helpdesk at support_001.enigma.htb. That app is OpenSTAManager 2.9.8, vulnerable to CVE-2025-69212 — an unescaped filename reaching exec() in XML::decodeP7M() via the importFE_ZIP plugin — giving RCE as www-data. config.inc.php leaks the MySQL account brollin:Fri3nds@9099, and the zz_users table yields haris’s bcrypt hash, cracked with rockyou to ‘bestfriends’ for user.txt. Root is a loopback-only OliveTin 3000.10.0 on 127.0.0.1:1337 running as root with anonymous guest execution: its ‘Backup Database’ action takes a db_pass argument of type password, the one type TypeSafetyCheck never validates (CVE-2026-27626, CVSS 9.9), so shell metacharacters in that field execute as root.