Loading story…
Paymenter released v1.2.11 to patch a critical remote code execution flaw tracked as CVE-2025-58048 and GHSA-5pm9-r2m8-rcmj. The vulnerability affects paymenter/paymenter versions earlier than 1.2.11 and stems from the ticket attachments feature, where a malicious authenticated user could upload arbitrary files and trigger code execution on the server. The issue was assigned a CVSS v3.1 score of 9.9, reflecting the risk that even a low-privilege account could compromise the application environment.
Successful exploitation could allow attackers to execute arbitrary code, extract database contents, read sensitive files such as .env, and run system commands in the web server context. Paymenter said the flaw was fixed in commit 87c3db4 and shipped in release commit 79b2a5d as part of v1.2.11. While temporary mitigations include forcing downloads from /storage/ through nginx or blocking direct access to /storage/ with a WAF such as Cloudflare, the project states that upgrading to v1.2.11 or later is the only complete remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub security advisory disclosed CVE-2025-58048 / GHSA-5pm9-r2m8-rcmj as a critical remote code execution flaw in Paymenter affecting versions before 1.2.11. The advisory said authenticated users could exploit ticket attachments to upload arbitrary files and potentially execute code, access database data, and read sensitive files.
Paymenter published version 1.2.11, which remediates the remote code execution vulnerability tracked as CVE-2025-58048. The release notes identify the fix as addressing the RCE issue in the project.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FOSSBilling disclosed two critical vulnerabilities that can be chained to give unauthenticated attackers administrative access and remote code execution on billing platforms used by hosting providers. **CVE-2026-27604** is an authorization bypass in versions `0.5.4` through `0.7.2` that lets remote attackers reach privileged `/api/system/*` endpoints because the `system` API role is incorrectly mapped to the cron admin identity. **CVE-2026-28496** is a Twig server-side template injection flaw affecting versions `0.1.0` through `0.7.2`, where templates are rendered without a sandbox, exposing the Twig environment, API context, and the dependency injection container. Researchers said the chain allows attackers to read and modify databases, enumerate administrators, create admin accounts, generate privileged API tokens, poison the Symfony cache used by the extension installer, and install a malicious module to execute code as the web server user. The exposure is significant because affected instances may hold customer PII, billing records, payment processor secrets, hosting control panel credentials, sessions, and API tokens. FOSSBilling patched both issues in version **`0.8.0`** and advised defenders to block external access to `/api/system/*`, restrict API access to trusted IPs, rotate admin and client API tokens, invalidate active sessions, reset high-privilege credentials, audit templates for malicious Twig expressions, and review logs for suspicious `/api/system/` activity.
Jun 29, 2026
Two high-severity vulnerabilities in **PHP Composer** could let attackers execute arbitrary commands through the package manager’s **Perforce VCS driver**. The flaws, tracked as `CVE-2026-40176` and `CVE-2026-40261`, were caused by improper input validation and insufficient escaping when Composer built shell commands from repository configuration and source metadata. One issue can be triggered by a malicious `composer.json` in an untrusted root project, while the other can be exploited through a crafted source reference from a malicious or compromised repository. The bugs affect Composer versions `>= 2.3` and `< 2.9.6`, as well as `>= 2.0` and `< 2.2.27`, and were patched in **2.9.6** and **2.2.27 LTS**. Maintainers said injected commands could run even if Perforce is not installed on the target system. Composer, Packagist.org, and Private Packagist reported no evidence of active exploitation, but Packagist disabled publication of Perforce source metadata and the Perforce VCS driver as a precaution. Users were urged to update immediately, scrutinize `composer.json` files, rely only on trusted repositories, and avoid dependency installation via `--prefer-dist` or the `preferred-install: dist` setting.
Jun 29, 2026
gitroomhq released **Postiz App** `v2.21.8` with fixes for three security vulnerabilities tracked as `PSA-2026-2CAQ96`, `PSA-2026-WWFR8X`, and `PSA-2026-Q3TCPK`, and urged all users to upgrade immediately. The release was published by egelhaus and bundled the security patches with additional bug fixes, UI changes, and feature updates after 41 commits were merged into `main` since `v2.21.7`. One of the addressed issues, `PSA-2026-Q3TCPK`, was disclosed as an **unauthenticated arbitrary lifetime PRO grant via NowPayments webhook**, indicating that an attacker could abuse the payment webhook flow to assign PRO access without authentication. Alongside the security remediation, the release added contributor forms, media type detection helpers, notification list updates, and post creation method tracking, with bsantosh909 and egelhaus listed as contributors.
Jul 16, 2026