Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mediacms-io/mediacms
main @ 90b9fad
9
Fixes
1
CVEs
CRITICAL
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 5 prior fixes. Scrutinize any change in this area.
cms/permissions.py: most-fixed (2 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Multimedia background tasks executed external binaries (FFmpeg and mp4hls) via shell execution rather than safe parameter lists, enabling remote command execution.
Auth Bypass: Flawed object ownership validation compared the object itself instead of the object's associated user to the requesting user, leading to complete permission bypasses on critical operations.
Path Traversal: Path traversal vulnerability in the Nginx X-Accel authorization logic permitted unauthorized access to private media files due to improper URI validation.