地图 / FS Permissions Bypass

FS Permissions Bypass

访问控制 / 违反安全设计原则（按标题归类） / #3417819

厂商: Node.js
严重程度: 中危 · CVSS 7.1
赏金: —
弱点: 违反安全设计原则（按标题归类）
研究员: @natann
披露日期: 2026-02-12
资产: https://github.com/nodejs/node
CVE: CVE-2025-55130

该报告还没有中文解读。

时间线

2025-11-09报告提交
2026-02-12公开披露

阅读 HackerOne 原文 ↗作者 @natann · 版权归作者与 Node.js 所有

同类报告

Exposure of Private Personal Information to an Unauthorized Actor - PII and soldier data (mos, schools, and speciality training)U.S. Dept Of Defense · 2025-01-24 Privilege escalation..., or not?!HackerOne · 2015-06-08 No user confirmation when an auto-updated extension gets more permissionsBrave Software · 2017-01-20 User with Read-Only permissions can request/approve public disclosureHackerOne · 2016-02-19 · $500 Missing Function Level Access Control in /cindex.php/widget/customize/Bookfresh · 2016-03-23 User with Read-Only permissions can manually public disclosure the reportHackerOne · 2016-04-21 · $500