Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Combodo/iTop

              develop @ 9e4f2a3
            

157

Fixes

CVEs

CRITICAL

Peak severity

27.3%

Coverage

Highlights

Reflected XSS: 50 prior fixes. Scrutinize any change in this area.

application/cmdbabstract.class.inc.php: most-fixed (8 issues). Treat as high-risk during review.

103 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Extremely high frequency of reflected XSS across many page-rendering and form-output paths, with fixes repeatedly adding HTML entity encoding to user-controlled values in titles, error messages, hidden inputs, and search filters. The pattern of unescaped echo/format calls is pervasive and likely to recur in new UI code.

Auth Bypass: Multiple critical/high auth bypasses in page execution, object retrieval, and permission filtering. The exec.php path had multiple fixes (login enforcement, module whitelist, path validation) indicating a high-value target. Portal object controllers repeatedly mishandled allowAllData flags and permission checks, risking unauthorized data access.

Command Injection: Multiple command injection fixes in setup utilities (graphviz path handling, Windows escapeshellcmd) and mail transport dependencies. The repeated fixes in setuputils suggest the exec() path with external binaries is a persistent risk area, especially around path validation and OS-specific escaping.