{"document":{"acknowledgments":[{"names":["Gabriele Quagliarella"],"organization":"Nozomi Networks"}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-US","notes":[{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. KUNBUS RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.","title":"Legal Disclaimer"}],"publisher":{"category":"vendor","contact_details":"product-security@kunbus.com","issuing_authority":"KUNBUS GmbH develops and produces the Revolution Pi Family, Revolution Pi OS and the extension modules for RevPi amongst others. KUNBUS PSIRT is responsible for vulnerability handling across all KUNBUS products and services.","name":"KUNBUS PSIRT","namespace":"https://www.kunbus.com"},"references":[{"category":"self","summary":"URL generated by system","url":"https://psirt.kunbus.com/white/2026/kunbus-2026-0000009.json"}],"title":"Multiple Vulnerabilities in KUNBUS Packages for Revolution Pi","tracking":{"current_release_date":"2026-08-12T07:05:11.736137118Z","generator":{"date":"2026-08-06T11:11:39.460Z","engine":{"name":"csaf-cms-backend","version":"1.0.0-kunbus.1"}},"id":"Kunbus-2026-0000009","initial_release_date":"2026-07-27T14:39:00.926463392Z","revision_history":[{"date":"2026-07-27T14:39:00.926463392Z","number":"1.0.0","summary":"Initial Publication"},{"date":"2026-08-06T11:12:41.164768186Z","number":"1.1.0","summary":"Updated vulnerability references"},{"date":"2026-08-12T07:05:11.736137118Z","number":"1.2.0","summary":"Remove the yet not valid Vulnerability References"}],"status":"final","version":"1.2.0"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"2.17.0","product":{"name":"KUNBUS Pictory 2.17.0","product_id":"CSAFPID-0001","product_identification_helper":{"purl":"pkg:deb/debian/pictory@2.17.0-1%2Bdeb13%2B1"}}},{"category":"product_version_range","name":"vers:deb/<=2.16.0","product":{"name":"KUNBUS Pictory vers:deb/<=2.16.0","product_id":"CSAFPID-0002","product_identification_helper":{"purl":"pkg:deb/debian/pictory@%3C%3D2.16.0"}}}],"category":"product_name","name":"Pictory"},{"branches":[{"category":"product_version","name":"0.11.1","product":{"name":"KUNBUS revpipyload 0.11.1","product_id":"CSAFPID-0003","product_identification_helper":{"purl":"pkg:deb/debian/revpipyload@0.11.1-2%2Bdeb13%2B1"}}},{"category":"product_version_range","name":"vers:deb/<= 0.11.0","product":{"name":"KUNBUS revpipyload vers:deb/<= 0.11.0","product_id":"CSAFPID-0004","product_identification_helper":{"purl":"pkg:deb/debian/revpipyload@%3C%3D0.11.0"}}}],"category":"product_name","name":"revpipyload"}],"category":"vendor","name":"KUNBUS"}]},"vulnerabilities":[{"cve":"CVE-2026-57469","cwe":{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)"},"notes":[{"category":"description","text":"The pictory web config tool has a CSRF vulnerability that could enable a attacker to take over a session and perform actions on behalf of the logged in user. ","title":"Description"}],"product_status":{"fixed":["CSAFPID-0001"],"known_affected":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","date":"2026-07-13T10:00:00.000Z","details":"Update to Pictory Version 1.17.0","product_ids":["CSAFPID-0002"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","environmentalScore":5.4,"environmentalSeverity":"MEDIUM","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":5.4,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"products":["CSAFPID-0002"]}],"title":"CSRF in Pictory"},{"cve":"CVE-2026-57471","cwe":{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"},"notes":[{"category":"description","text":"An attacker that can access revpipyload XML-RPC interface can gain access to all files the revpipyload process has access to due to improper path checks for the download endpoint.","title":"Describtion"}],"product_status":{"fixed":["CSAFPID-0003"],"known_affected":["CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","date":"2026-07-13T10:00:00.000Z","details":"Update to revpipyload 0.11.1","product_ids":["CSAFPID-0004"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","environmentalScore":5.5,"environmentalSeverity":"MEDIUM","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","temporalScore":5.5,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["CSAFPID-0004"]}],"title":"Possible Extraction of files with the rights of the default user in revpipyload"},{"cve":"CVE-2026-57472","cwe":{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"},"notes":[{"category":"description","text":"An attacker with access to the revpipyload XML-RPC interface can delete all files the revpipyload process has access rights.","title":"Description"}],"product_status":{"fixed":["CSAFPID-0003"],"known_affected":["CSAFPID-0004"]},"remediations":[{"category":"vendor_fix","date":"2026-07-13T10:00:00.000Z","details":"Update to revpipyload 0.11.1","product_ids":["CSAFPID-0004"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","environmentalScore":7.1,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","temporalScore":7.1,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["CSAFPID-0004"]}],"title":"Possible Deletion of files with the rights of default user for a locally authenticated attacker"}]}