Security Digest: April 8, 2026 - 10 Critical Vulnerabilities

Today, we highlight 10 critical vulnerabilities affecting GitHub Actions, Emmett, FileBrowser, and more. Immediate actions include patching, validation updates, and upgrading to secure versions.

· 5 min read

Security Digest: April 8, 2026 - 10 Critical Vulnerabilities

Executive Summary

Today, we highlight 10 critical vulnerabilities affecting GitHub Actions, Emmett, FileBrowser, and more. Immediate actions include patching, validation updates, and upgrading to secure versions.

Critical Vulnerabilities

  • CVE-2026-35580: Shell Injection in GitHub Actions
    • Impact: Arbitrary code execution, repository poisoning.
    • Affected Systems: Emissary GitHub Actions workflows.
    • Immediate Action: Upgrade to release 8.39.0 and apply environment variable indirection.
    • Mitigation: No workaround other than upgrading.
  • CVE-2026-39847: Path Traversal in Emmett
    • Impact: Arbitrary file read.
    • Affected Systems: Emmett's internal assets handler.
    • Immediate Action: Patch to secure version.
    • Mitigation: Apply path traversal checks.
  • CVE-2026-35607: Proxy Auth Permission Flaw
    • Impact: Unintended execution rights granted.
    • Affected Systems: FileBrowser v2.62.2.
    • Immediate Action: Apply PR #5890 fix.
    • Mitigation: Restrict proxy auth user permissions.
  • CVE-2026-39371: Method Bypass in rwsdk
    • Impact: Unintended state changes.
    • Affected Systems: rwsdk server functions.
    • Immediate Action: Upgrade to rwsdk 1.0.6.
    • Mitigation: Ensure HTTP method enforcement.
  • CVE-2026-39369: GIF Path File Disclosure
    • Impact: Local file disclosure.
    • Affected Systems: WWBN AVideo.
    • Immediate Action: Implement strict path validation.
    • Mitigation: Use `realpath()` checks.
  • CVE-2026-39376: Infinite Loop in Fastfeedparser
    • Impact: Denial of service, potential SSRF.
    • Affected Systems: Fastfeedparser URL parsing.
    • Immediate Action: Apply depth and recursion checks.
    • Mitigation: Limit meta-refresh redirects.
  • CVE-2026-39356: SQL Injection in Drizzle ORM
    • Impact: SQL injection via identifiers.
    • Affected Systems: Drizzle ORM with dynamic inputs.
    • Immediate Action: Patch identifier escaping logic.
    • Mitigation: Prevent untrusted input in identifiers.
  • CVE-2026-35611: ReDoS in Addressable
    • Impact: Denial of service.
    • Affected Systems: Addressable URI templates.
    • Immediate Action: Upgrade to Addressable 2.9.0.
    • Mitigation: Avoid vulnerable template patterns.
  • CVE-2026-35581: Command Execution in Executrix
    • Impact: Arbitrary command execution.
    • Affected Systems: Emissary utility class.
    • Immediate Action: Apply allowlist character sanitization.
    • Mitigation: Restrict configuration inputs.
  • CVE-2026-39370: SSRF Bypass in AVideo
    • Impact: Internal response exfiltration.
    • Affected Systems: WWBN AVideo upload flow.
    • Immediate Action: Enforce SSRF checks on all URLs.
    • Mitigation: Remove extension-based SSRF exceptions.

What to Do Now

  1. Review and prioritize patching all affected systems.
  2. Validate configurations and inputs for potential injection points.
  3. Monitor network traffic for unusual activity, especially on internal resources.

Related Resources

  • Visit our blog for more insights (coming soon).
  • Check official advisories from relevant vendors.

Keep reading