Critical · published November 29, 2025
🚨 An unauthenticated upload could let anyone masquerade as any user! This critical flaw in PubNet allows identity spoofing with a simple API call. 🔥 Think of it like a restaurant where anyone can walk in, wear a chef's hat, and start serving orders under someone else's name — chaos in the kitchen! If exploited, an attacker could upload malicious packages under legitimate user identities, leading to privilege escalation and potentially devastating supply chain attacks. This could compromise not only individual accounts but could also ripple through your entire system, affecting countless users. The stakes are high!
Think of it like a restaurant where anyone can walk in, wear a chef's hat, and start serving orders under someone else's name — chaos in the kitchen! The vulnerability exists in the /api/storage/upload endpoint of PubNet prior to version 1.1.3, allowing unauthenticated users to upload packages by simply providing arbitrary author-id values without verification.
If exploited, an attacker could upload malicious packages under legitimate user identities, leading to privilege escalation and potentially devastating supply chain attacks. This could compromise not only individual accounts but could also ripple through your entire system, affecting countless users. The stakes are high! To secure your installation, upgrade to PubNet version 1.1.3 immediately. Additionally, review your API access controls to ensure proper authentication and authorization mechanisms are in place to prevent similar vulnerabilities in the future. You've got this! By patching and tightening your security, you're one step closer to being a security hero! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ricardoboss/pubnet | < 1.1.4 | 1.1.4 |