Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vitodeploy/vito

              4.x @ c72f3d0
            

Fixes

CVEs

CRITICAL

Peak severity

35.3%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

app/SSH/Services/Webserver/Nginx.php: most-fixed (2 issues). Treat as high-risk during review.

21 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Provider creation lacked project scope enforcement, allowing cross-project credential manipulation; similar issues in policies and controllers indicate a systemic gap in authorization checks.

Command Injection: Certbot command construction from user-controlled aliases was injectable; similar shell-execution sinks exist in OS.php and cron templates, showing a pattern of unsafe shell composition.

Privilege Escalation: Cross-creator privilege grants were not reconciled, allowing linked users to retain excessive access; similar issues in user scripts and deletion paths indicate privilege management gaps.