Repository navigation

Security

.github/SECURITY.md

Security Policy

Report a vulnerability privately. Open this repository's Security tab and choose Report a vulnerability. Never report one in a public issue.

The full policy, covering supported versions, how a report is handled and how reporters are credited, is in Documentation/SECURITY.md.

Insufficient minimum 7-Zip version permits archive-extraction symlink path traversal (zip-slip) leading to arbitrary file write on an unauthenticated server
GHSA-4cmg-x3g6-p322 published Nov 10, 2026 by zelon88

High
rectifySCAD() line-prefix removal is bypassed by a block comment ending on the call's line (incomplete fix for GHSA-qcq3-837w-2c9c)
GHSA-mqvr-h4q5-chg9 published Oct 31, 2026 by zelon88

Low
Unauthenticated persistent denial of service: an archive containing a symlink makes the cleanup sweep fail for every request
GHSA-mqqw-cx3x-cf7w published Oct 30, 2026 by zelon88

Moderate
Stored cross-site scripting (XSS) via uploaded SVG served same-origin from the webroot DATA directory (no CSP / nosniff / Content-Disposition)
GHSA-hrq7-pfhf-r2fw published Sep 2, 2026 by zelon88

Low
SSRF via unsandboxed LibreOffice document conversion (network isolation missing on the document path)
GHSA-4jp5-8jhf-cmgw published Aug 26, 2026 by zelon88

Moderate
Unauthenticated arbitrary file read via sanitizeSCAD() bypass in HRConvert2 v3.5.4
GHSA-qcq3-837w-2c9c published Aug 5, 2026 by zelon88

High
File deletion never removes the web-served copy (use-before-assign in deleteFiles)
GHSA-cwc2-f9j8-x8m2 published Aug 3, 2026 by zelon88

Moderate
Anonymous cross-session file disclosure via date+salt-predictable session hashes and web-served logs
GHSA-qj74-5h4j-f368 published Aug 3, 2026 by zelon88

High
Unauthenticated OS command injection (RCE) via sanitizeString() order-of-operations in convertCore.php
GHSA-wg57-wvw2-9cj8 published Aug 3, 2026 by zelon88

Critical
Missing Sanitization enables Unauthenticated Remote Command Execution
GHSA-f74g-4wj8-j35h published May 4, 2026 by zelon88

Critical

Learn more about advisories related to zelon88/HRConvert2 in the GitHub Advisory Database

Security: zelon88/HRConvert2

Security

.github/SECURITY.md

Security Policy