Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
nette/tracy
master @ 27801ff
3
Fixes
0
CVEs
MEDIUM
Peak severity
Highlights
Information Disclosure: 2 prior fixes. Scrutinize any change in this area.
Tracy/Logger.php: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Header Injection: The debugger's email notification system previously utilized the untrusted HTTP_HOST header without sanitization, allowing attackers to inject malicious headers or manipulate the mail routing via the PHP mail() sink. This is critical if the debugger runs in production environments.
Information Disclosure: Uncaught PHP exceptions during the debugger's initialization phase could leak absolute file paths and system state. Restricting these details through generic fallbacks is necessary to prevent attackers from mapping the local filesystem.
Information Disclosure: The rendering of local file paths in data-tracy-href attributes could leak physical server paths to unauthorized client sessions unless restricted to explicitly authorized developer environments.