Attributed metadata history
Up to 100 retained publisher events per page for f4c393af6629a9249f4453cbc32db5b8342928f7e881d7ec523ead3f3d697972. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_732996d4d78decf6b7
observed · 2026-10-12 11:25:04 UTC
v4.25.2 - 2026-10-02 Security Fixes Backport fix for [GHSA-575j-qr6p-9763] via adding REQUEST_FILENAME to the targets of the RCE rules, so command injection payloads placed in the URL path are inspected like those in ARGS (rules 932125-932390, except 932200, where every URL path contains the / it requires) (Max Leske) Backport fix for [GHSA-89h9-2j8h-9gp2] via lowercasing the charset parameter name before matching, so an uppercase or mixed-case CHARSET= in Content-Type can no longer skip the charset allow-list check (rule 920480) (Felipe Zipitría) Backport fix for [GHSA-qmx4-jfcv-fgww] via collecting every _charset_ value so a second multipart part or a query-string _charset_ can no longer shadow a disallowed charset (rule 922100) (Ervin Hegedüs) Backport fix removing a bypassable length bound in the SQL (X)OR injection detection (rule 942390) (Felipe Zipitría, cherry-pick of #4713) Backport fix for [V29-260924] via tolerating trailing slashes as well as dots after the extension, so a PHP or JSP upload filename ending in / can no longer bypass the upload extension checks (rules 933110, 944140) (Felipe Zipitría, cherry-pick of #4815) Bug Fixes Backport false positive fix for
Fingerprint: 519f70200ba383b1af40fb66c956f75ae1c88b3500fe8ffaf20d7d4d29e15d55
intelligence_src_732996d4d78decf6b7
observed · 2026-10-12 11:25:04 UTC
available
Fingerprint: 9a0f29d779ed105525dbafb009db821a5ae58acc46f95bd8f9161f2e63576dd8