research
Original vulnerability research — 0/1/N-day analyses, root causes, exploitation. Nothing here yet; it ships with a reproducer or it doesn’t ship.
2026
Grav stored XSS via assets sandbox allowlist (editor→super-admin)
Twig sandbox allowed assets.addJs/addCss from untrusted content; stored XSS in page content escalates editor to super-admin. Fixed in 2.0.20.
phpMyFAQ: session-only auth downgrade, password change without verification, and TOTP secret in data export
Multiple authentication flaws: remove 2FA with CSRF+session only; set a new password without the current one; and export archives include the live TOTP shared secret in plaintext.
File Browser: stale shares, share cleanup, named-pipe DoS, and TUS race
Four issues across File Browser: TUS PATCH race bypasses Upload-Length; share links survive rename; share links not cleaned on privileged delete; named pipes block archive/public download handlers (DoS).