PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Another Byte Bites the Dust - How XBOW Turned a Blind SSRF into a File Reading Oracle

xbow.com | vulnerability | Critical | #vulnerability-research | #ssrf | #exfiltration | #file-read | #titiler | #geospatial
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Details how XBOW escalated a blind SSRF in TiTiler into a full arbitrary file read via byte-by-byte exfiltration in a 48-step chain, from OpenAPI recon to the final oracle.
CVSS
9.3
Published
Collected

Related coverage

Critical · vulnerability · xbow.com
Beyond the Bands: Exploiting TiTiler’s Expression Parser for Remote Code Execution
A methodical study of TiTiler's expression parser that ends in arbitrary Python code execution on the server, with a bonus arbitrary file read saved for a follow-up post.
vulnerability · bishopfox.com
PhpSpreadsheet Versions<=1.5.0 - XXE injection
PhpSpreadsheet up to 1.5.0 is vulnerable to XXE (CVE-2018-19277): attackers bypass its entity check with a UTF-7 encoded XLSX payload to read files, secrets and source code.
vulnerability · slcyber.io
High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619)
The research team releases an open source tool php2shell-scanner which contains a high fidelity scanning mechanism to check for CVE-2026-109618 and CVE-2026-109619 across hosts.
vulnerability · yokai.hakaisecurity.io
[Pt-Br] Por Trás do Espelho: Investigando Vulnerabilidades no MagicMirror² (CVE-2026-63642, CVE-2026-63643)
# [Pt-Br] Por Trás do Espelho: Investigando Vulnerabilidades no MagicMirror² (CVE-2026-63642, CVE-2026-63643) RESEARCHER **Gabriel Alves** READ TIME**6 MINUTES** PUBLISHED**01 Oct 2026**...
vulnerability · yokai.hakaisecurity.io
[EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)
During an analysis of the source code of MagicMirror², an open-source platform used to turn a semi-transparent mirror into a smart display, the Yokai Research Team from Hakai Security identified two recent Server-Side Request Forgery (SSRF) vulnerabilities: CVE-2026-63642 and CVE-2026-63643. The vulnerabilities affect
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
Back