Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

OpenSID/OpenSID

              umum @ 71238d2
            

Fixes

CVEs

CRITICAL

Peak severity

32.3%

Coverage

Highlights

Stored XSS: 17 prior fixes. Scrutinize any change in this area.

donjo-app/controllers/First.php: most-fixed (8 issues). Treat as high-risk during review.

24 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Attackers can upload and execute arbitrary PHP payloads inside upload directories. Historical fixes had to recursively deploy .htaccess blocklists to deny PHP script execution and expand the blocked extensions list.

Local File Inclusion: Path traversal and LFI in report modules let attackers include or execute local files on the server. Mitigations required enforcing strict path canonicalization and prefix validation on user-controlled file parameters.

Stored XSS: Various administrative forms allow attackers to store raw HTML tags in database tables (such as document records, family models, and incoming mail registers), which are then executed within user browsers due to missing sanitizers.