Nixpkgs security tracker
8.7 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): High (H)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): High (H)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse dismissed (not in Nixpkgs)
Frappe LMS: Path Traversal in SCORM File Serving
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_renderers.py. The renderer constructs and opens a server-side path without first confirming that its real path remains within public/scorm, allowing files outside the SCORM directory to be read when they are accessible to the server process. This issue is fixed in version 2.52.1.
References
-
https://github.com/frappe/lms/security/advisories/GHSA-3mq2-3c8v-m92j x_refsource_CONFIRM
-
https://github.com/frappe/lms/pull/2299 x_refsource_MISC
-
https://github.com/frappe/lms/releases/tag/v2.52.1 x_refsource_MISC
Affected products
- ==< 2.52.1
Matching in nixpkgs
pkgs.lms
Lightweight Music Server - Access your self-hosted music using a web interface
pkgs.flmsg
Digital modem message program
pkgs.helmsman
Helm Charts (k8s applications) as Code tool
pkgs.llmserve
TUI for serving local LLM models
pkgs.lmstudio
LM Studio is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)
pkgs.pkgsRocm.lms
Lightweight Music Server - Access your self-hosted music using a web interface
-
nixos-unstable -
- nixos-unstable-small 3.80.0
pkgs.lmstudio-bionic
Bionic is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)
-
nixos-unstable -
- nixos-unstable-small 1.1.2-11
pkgs.python313Packages.calmsize
Take a number of bytes and return a human-readable string
pkgs.python313Packages.lmstudio
LM Studio Python SDK
pkgs.python314Packages.calmsize
Take a number of bytes and return a human-readable string
pkgs.python314Packages.lmstudio
LM Studio Python SDK
pkgs.python313Packages.dlms-cosem
Python module to parse DLMS/COSEM
pkgs.python314Packages.dlms-cosem
Python module to parse DLMS/COSEM
pkgs.python313Packages.llm-lmstudio
Plugin to use local models via LM Studio API with https://llm.datasette.io
pkgs.python314Packages.llm-lmstudio
Plugin to use local models via LM Studio API with https://llm.datasette.io
pkgs.python313Packages.sphinx-llms-txt
llms.txt generator for Sphinx
-
nixos-unstable -
- nixos-unstable-small 0.7.1
pkgs.python314Packages.sphinx-llms-txt
llms.txt generator for Sphinx
-
nixos-unstable -
- nixos-unstable-small 0.7.1
pkgs.python313Packages.llama-index-llms-ollama
LlamaIndex LLMS Integration for ollama
pkgs.python313Packages.llama-index-llms-openai
LlamaIndex LLMS Integration for OpenAI
pkgs.python314Packages.llama-index-llms-ollama
LlamaIndex LLMS Integration for ollama
-
nixos-unstable -
- nixos-unstable-small 0.11.0
pkgs.python314Packages.llama-index-llms-openai
LlamaIndex LLMS Integration for OpenAI
-
nixos-unstable -
- nixos-unstable-small 0.7.10
pkgs.python313Packages.llama-index-llms-openai-like
LlamaIndex LLMS Integration for OpenAI like
pkgs.python314Packages.llama-index-llms-openai-like
LlamaIndex LLMS Integration for OpenAI like
-
nixos-unstable -
- nixos-unstable-small 0.8.0
pkgs.pkgsRocm.python3Packages.llama-index-llms-ollama
LlamaIndex LLMS Integration for ollama
pkgs.pkgsRocm.python3Packages.llama-index-llms-openai
LlamaIndex LLMS Integration for OpenAI
Package maintainers
-
@dysinger Tim Dysinger <tim@dysinger.net>
-
@Lynty Lynn Dong <ltdong93+nix@gmail.com>
-
@sarcasticadmin Robert James Hernandez <rob@sarcasticadmin.com>
-
@afh Alexis Hildebrandt <surryhill+nix@gmail.com>
-
@mksafavi MK Safavi <mksafavi@gmail.com>
-
@crertel Chris Ertel <chris@kedagital.com>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@jherland Johan Herland <johan@herland.net>
-
@dwt Martin Häcker <spamfaenger@gmx.de>
-
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>
-
@deftdawg DeftDawg <deftdawg@gmail.com>
-
@felbinger Nico Felbinger <nico@felbinger.eu>