南非“小绿膏”每天卖出上千罐，入驻“四叶草”等于搭上中国大市场快车

yun2025

南非“小绿膏”每天卖出上千罐，入驻“四叶草”等于搭上中国大市场快车

Kroki：绘图后端安全模式未覆盖全部文件读取操作

11月7日公开的漏洞记录CVE-2026-102359涉及Kroki。Kroki可将文字描述转换成图形。处理TikZ图表时，特定安全检查只拦截了一种文件读取方式，排版引擎还有其他读取操作可用。向绘图接口提交的内容因此可能接触服务器上的文件，即使部署者已经启用了预期用于隔离输入的安全模式。版本清单标出的受影响范围包括低于0.31.2。

这条记录给出的CVSS 3.1基础评分为7.5分，分级为高危。按照评分列出的条件，利用者可通过网络接触相关功能，不以事先取得系统权限为必要条件，并且无需另一名用户进行额外交互。数据保密性、内容完整性和服务可用性三项的影响等级分别为高、无、无。评分把利用复杂度列为较低，所反映的是触发这一缺陷需要满足的技术条件。

https://v.youku.com/v_show/id_XNjU3ODIyMTIyOA==.html
https://v.youku.com/v_show/id_XNjU4Nzg5OTE3Ng==.html
https://v.youku.com/v_show/id_XNjU4NzkwMjEyNA==.html
https://v.youku.com/v_show/id_XNjU4NzkwNTA1Mg==.html
https://v.youku.com/v_show/id_XNjU4NzkwMDY4MA==.html
https://v.youku.com/v_show/id_XNjU3ODIyMTA5Ng==.html
https://v.youku.com/v_show/id_XNjU3ODIxOTU1Ng==.html
https://v.youku.com/v_show/id_XNjU3ODIxNzk2OA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNTE0MA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNTEzMg==.html
https://v.youku.com/v_show/id_XNjU3ODIxNjQyNA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNjQwNA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNzkwMA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNTA4MA==.html
https://v.youku.com/v_show/id_XNjU3ODIxOTQ0NA==.html
https://v.youku.com/v_show/id_XNjU4NzkwMzI5Mg==.html
https://v.youku.com/v_show/id_XNjU3ODIxNjM0NA==.html
https://v.youku.com/v_show/id_XNjU3ODIxOTQwOA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNzg0NA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNTAyNA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNzgzNg==.html
https://v.youku.com/v_show/id_XNjU3ODIxNzgyOA==.html
https://v.youku.com/v_show/id_XNjU4NzkwMTg4OA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNjI2MA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNjIyOA==.html
https://v.youku.com/v_show/id_XNjU3ODIxOTI5Mg==.html
https://v.youku.com/v_show/id_XNjU4Nzg5ODgzNg==.html
https://v.youku.com/v_show/id_XNjU4NzkwMDM2NA==.html
https://v.youku.com/v_show/id_XNjU3ODIxMzQyNA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNzY3Mg==.html
https://v.youku.com/v_show/id_XNjU3ODIxNDgzNg==.html
https://v.youku.com/v_show/id_XNjU3ODIwODc0NA==.html
https://v.youku.com/v_show/id_XNjU4NzkwMDMwOA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNDgyMA==.html
https://v.youku.com/v_show/id_XNjU3ODIwODcxMg==.html
https://v.youku.com/v_show/id_XNjU3ODIxNjAyNA==.html
https://v.youku.com/v_show/id_XNjU4NzkwMDIzNg==.html
https://v.youku.com/v_show/id_XNjU4Nzg5NzM1Ng==.html
https://v.youku.com/v_show/id_XNjU3ODIwODY0MA==.html
https://v.youku.com/v_show/id_XNjU3ODIwNzE3Ng==.html
https://v.youku.com/v_show/id_XNjU4Nzg5ODYwOA==.html
https://v.youku.com/v_show/id_XNjU3ODIxMzIzNg==.html
https://v.youku.com/v_show/id_XNjU3ODIxMzIwOA==.html
https://v.youku.com/v_show/id_XNjU3ODIxNDYxMg==.html
https://v.youku.com/v_show/id_XNjU3ODIxMDIwOA==.html
https://v.youku.com/v_show/id_XNjU4NzkwMDAxMg==.html
https://v.youku.com/v_show/id_XNjU3ODIwNzA3Mg==.html
https://v.youku.com/v_show/id_XNjU3ODIwNTYwMA==.html
https://v.youku.com/v_show/id_XNjU3ODIxMzA3Ng==.html
https://v.youku.com/v_show/id_XNjU3ODIwODQ1Ng==.html