Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

Untriaged
Filter by:
With package: zotero_7

Found 1 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-31801
7.7 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
created 1 month, 1 week ago Activity log
  • Created suggestion 1 month, 1 week ago
zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the tag already exists and reference != "latest". As a result, when latest already exists, a user who is allowed to create (but not allowed to update) can still pass the authorization check for an overwrite attempt of latest. This vulnerability is fixed in 2.1.15.

Affected products

zot
  • ==>= 1.3.0, < v2.1.15

Matching in nixpkgs

pkgs.zotero

Collect, organize, cite, and share your research sources

pkgs.zotify

Fast and customizable music and podcast downloader

pkgs.zotero_7

Collect, organize, cite, and share your research sources

Package maintainers