在这间“不能见光”的实验室里，藏着地震“定年”的秘密

yun2025

在这间“不能见光”的实验室里，藏着地震“定年”的秘密

Kroki：绘图后端安全模式未覆盖全部文件读取操作

11月7日公开的漏洞记录CVE-2026-102359涉及Kroki。Kroki可将文字描述转换成图形。处理TikZ图表时，特定安全检查只拦截了一种文件读取方式，排版引擎还有其他读取操作可用。向绘图接口提交的内容因此可能接触服务器上的文件，即使部署者已经启用了预期用于隔离输入的安全模式。版本清单标出的受影响范围包括低于0.31.2。

这条记录给出的CVSS 3.1基础评分为7.5分，分级为高危。按照评分列出的条件，利用者可通过网络接触相关功能，不以事先取得系统权限为必要条件，并且无需另一名用户进行额外交互。数据保密性、内容完整性和服务可用性三项的影响等级分别为高、无、无。评分把利用复杂度列为较低，所反映的是触发这一缺陷需要满足的技术条件。

https://v.youku.com/v_show/id_XNjU4NzgzNDg0NA==.html
https://v.youku.com/v_show/id_XNjU3ODE1MzYxMg==.html
https://v.youku.com/v_show/id_XNjU4NzgzMTkwMA==.html
https://v.youku.com/v_show/id_XNjU4NzgzMDQwMA==.html
https://v.youku.com/v_show/id_XNjU4NzgzNzgyMA==.html
https://v.youku.com/v_show/id_XNjU3ODE0NzYyMA==.html
https://v.youku.com/v_show/id_XNjU4NzgzMDM2NA==.html
https://v.youku.com/v_show/id_XNjU4NzgzNzc5Ng==.html
https://v.youku.com/v_show/id_XNjU4NzgzNDY5Mg==.html
https://v.youku.com/v_show/id_XNjU4NzgzMDMzNg==.html
https://v.youku.com/v_show/id_XNjU4NzgzNzc4MA==.html
https://v.youku.com/v_show/id_XNjU4NzgzMzQ3Ng==.html
https://v.youku.com/v_show/id_XNjU3ODE0NjIyNA==.html
https://v.youku.com/v_show/id_XNjU3ODE0NjIyMA==.html
https://v.youku.com/v_show/id_XNjU3ODE0NjIwMA==.html
https://v.youku.com/v_show/id_XNjU3ODE1MDQ1Mg==.html
https://v.youku.com/v_show/id_XNjU4NzgzMzQzNg==.html
https://v.youku.com/v_show/id_XNjU3ODE0NjE4OA==.html
https://v.youku.com/v_show/id_XNjU4NzgzNjAzMg==.html
https://v.youku.com/v_show/id_XNjU4NzgzMzQwNA==.html
https://v.youku.com/v_show/id_XNjU4NzgzNDQyOA==.html
https://v.youku.com/v_show/id_XNjU3ODE0NzM0NA==.html
https://v.youku.com/v_show/id_XNjU4NzgzMDA0OA==.html
https://v.youku.com/v_show/id_XNjU4NzgzMDA0MA==.html
https://v.youku.com/v_show/id_XNjU4NzgzMTUyMA==.html
https://v.youku.com/v_show/id_XNjU4NzgzMDAzMg==.html
https://v.youku.com/v_show/id_XNjU4NzgzMTUwOA==.html
https://v.youku.com/v_show/id_XNjU3ODE0MzA1Mg==.html
https://v.youku.com/v_show/id_XNjU3ODE0MTU1Mg==.html
https://v.youku.com/v_show/id_XNjU4NzgyOTkwOA==.html
https://v.youku.com/v_show/id_XNjU3ODE0Mjk0NA==.html
https://v.youku.com/v_show/id_XNjU4NzgzMTMyNA==.html
https://v.youku.com/v_show/id_XNjU3ODEzODM5Mg==.html
https://v.youku.com/v_show/id_XNjU3ODEzODM4MA==.html
https://v.youku.com/v_show/id_XNjU3ODE0MTM5Mg==.html
https://v.youku.com/v_show/id_XNjU4NzgzMTI3Ng==.html
https://v.youku.com/v_show/id_XNjU4NzgyOTg2MA==.html
https://v.youku.com/v_show/id_XNjU4NzgyODEwMA==.html
https://v.youku.com/v_show/id_XNjU4NzgyNjcxNg==.html
https://v.youku.com/v_show/id_XNjU4NzgyNTQ0OA==.html
https://v.youku.com/v_show/id_XNjU4NzgyNjY4NA==.html
https://v.youku.com/v_show/id_XNjU3ODE0NDEwMA==.html
https://v.youku.com/v_show/id_XNjU4NzgyNTQwOA==.html
https://v.youku.com/v_show/id_XNjU4NzgyNTM4NA==.html
https://v.youku.com/v_show/id_XNjU3ODE0MTA1Ng==.html
https://v.youku.com/v_show/id_XNjU3ODEzNzk2NA==.html
https://v.youku.com/v_show/id_XNjU3ODEzNzk1Ng==.html
https://v.youku.com/v_show/id_XNjU3ODEzNzk0OA==.html
https://v.youku.com/v_show/id_XNjU3ODEzNzkyOA==.html
https://v.youku.com/v_show/id_XNjU3ODEzNzkxMg==.html