Priority MEDIUM 64
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values.
Vulnerabilities
3 records
TI-2026-56750 CVE-2026-82285 · GHSA-qch5-28r4-f5gj
BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback
Priority HIGH 77
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering.
TI-2026-56743 CVE-2026-82278 · GHSA-h3mc-9q4p-46jg
BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once
Priority HIGH 73
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code.