Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lucee/Lucee

              7.0 @ 3d41aa1
            

Fixes

CVEs

HIGH

Peak severity

25.0%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

FileUpload.java: most-fixed (2 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple high-severity auth bypasses across security manager access value mapping, session fixation, admin action logic, and null password fallback indicate systemic weaknesses in authentication and authorization boundaries.

Sandbox Escape: Classloader boot delegation and reflection fallback both allow sandbox escape, indicating the sandbox boundary is porous around class loading and dynamic invocation.

XML External Entity: Two separate XXE fixes in XML parsing and TransformerFactory show a recurring failure to default-secure XML processing, affecting both the core XML API and PDF extension.