Vulnerabilidades de Dataelement
CVEs publicadas que afetam produtos de Dataelement: 3 registro(s), com severidade, exploração e correções.
CVE-2026-111363
Média · 6.5
CWE-639 15/10/2026
BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.
CVE-2026-82285
Alta · 8.2
CWE-918 28/08/2026
BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names.
CVE-2026-82278
Alta · 8.8
CWE-94 28/08/2026
BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.