Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-78566
8.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 3 weeks, 6 days ago Activity log
  • Created suggestion 3 weeks, 6 days ago
Shuffle <= 1.8 - Unauthenticated Local File Inclusion

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Affected products

Shuffle
  • =<1.8

Matching in nixpkgs

pkgs.ashuffle

Automatic library-wide shuffle for mpd

  • nixos-unstable -
  • nixos-26.05 -

pkgs.shuffledns

massDNS wrapper to bruteforce and resolve the subdomains with wildcard handling support

  • nixos-unstable -
    • nixos-unstable-small 1.2.1
  • nixos-26.05 -
    • nixos-26.05-small 1.2.1

pkgs.gnomeExtensions.wallshuffle

GNOME applies a single background across every display. This extension changes that.

  • nixos-unstable -
    • nixos-unstable-small 7

Package maintainers