Skip to content
OpenAdvisories

Package · crates.io

kanidmd_lib

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium —
    GHSA-84jc-3hj2-hwc7

    kanidmd_lib: Image upload validators run before authorization; PNG validator panics on malformed input

    ### Summary The `POST /v1/domain/_image` and `POST /v1/oauth2/{rs_name}/_image` handlers call `validate_image()` on the uploaded body **before** the ACL check that restricts image upload to admins. Any bug in an image validator is therefore reachable by an un…

    kanidmd_lib crates.io