Project

General

Profile

Actions
Copy link

Bug #16947

closed
JP JP

Potential Local File Include vulnerability via Dashboard widget sequence data

Bug #16947: Potential Local File Include vulnerability via Dashboard widget sequence data

Added by Jim Pingle 2 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Urgent
Assignee:
Jim Pingle
Category:
Dashboard
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

The Dashboard widget layout data (sequence) is not validated when making changes to widgets or when displaying widget data.

If a user can write an arbitrary file on the firewall (e.g. /tmp/test.widget.php), they could store a widget sequence value including a widget name that traverses the path to that file (e.g. ../../../../../../../../../../../tmp/test)

The Dashboard will read that PHP file and execute it as if it were a Dashboard widget.

Files

Download all files
16947.patch (4.52 KB) 16947.patch Jim Pingle, 07/13/2026 07:40 PM
16947-v2.patch (4.63 KB) 16947-v2.patch Jim Pingle, 07/14/2026 05:35 PM

Related issues 1 (1 open — 0 closed)

Related to Todo #16950: Add upgrade code to normalize widget sequence dataNew

Actions

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #1

Fixed in commit 61e736e10e6f6542ce7a7c7bed37fb333c09467f

Added widget data validation before saving and before display.

Patch is attached.

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #3

  • Status changed from Feedback to In Progress
  • % Done changed from 100 to 90

There is a problem with certain dashboard configurations rendering blank still, needs more work

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #4

Fixed in commit 8fa0daeafdfbbcf9629c51dfc74c55bdab83554d

Some configurations, including the default config.xml, may contain outdated values in some widget data that should be allowed to pass validation.

Updated patch attached.

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #5

I also updated the default config.xml widget sequence data in ports commit 6d3d4da0cb6e47b821c82382a40e220f99f8da49

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #6

  • Related to Todo #16950: Add upgrade code to normalize widget sequence data added

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #7

  • Status changed from Feedback to Resolved

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #8

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom