Read the docs
TI-2026-22769 Aliases CVE-2026-28507GHSA-37j7-56xc-c468

Idno: Remote Code Execution via Chained Import File Write and Template Path Traversal

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Idno is a social publishing platform. Prior to version 1.6.4, there is a remote code execution vulnerability via chained import file write and template path traversal. This issue has been patched in version 1.6.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00766 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed idno (idno): 1.6.4idno/known (Packagist): 1.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
idnoidnobefore 1.6.41.6.4Patch availableCNA
—idno/known (Packagist)before 1.6.41.6.4Patch availableGHSA-37j7-56xc-c468
  • idno Vendoridno Affected before 1.6.4 Fixed in 1.6.4 Patch available CNA
  • idno/known (Packagist) Vendor— Affected before 1.6.4 Fixed in 1.6.4 Patch available GHSA-37j7-56xc-c468

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:withknown:known:*:*:*:*:*:*:*:*before 1.6.4Vulnerableidno
  • cpe:2.3:a:withknown:known:*:*:*:*:*:*:*:* Versions before 1.6.4 Vulnerable ·idno

Remediation

  • Fix · CNA idno (idno) Fixed in 1.6.4
  • Fix · GHSA-37j7-56xc-c468 idno/known (Packagist) Fixed in 1.6.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28507
  2. 2026-10-03 Alias added: GHSA-37j7-56xc-c468

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-21243 Known affected by Account Takeover via Password Reset Token Leakage CVSS 3.0CRITICAL 9.8
  • TI-2026-22770 Idno: Unauthenticated SSRF via URL Unfurl Endpoint CVSS 4.0CRITICAL 9.2
  • TI-2022-14517 Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover… CVSS 3.1HIGH 8.8
  • TI-2022-13859 An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute… CVSS 3.1MEDIUM 6.1
  • TI-2022-13308 A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows… CVSS 3.1MEDIUM 5.4
  • TI-2022-12959 Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR). CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences