gistfile1.txt

[CVE ID]
CVE-2026-39052

[PRODUCT]
Oinone Pamirs (Pamirs Framework)

[VERSION]
7.0.0

[PROBLEM TYPE]
Dynamic Script Execution leading to Remote Code Execution

[AFFECTED COMPONENT]
pamirs-framework/pamirs-framework-faas/src/main/java/pro/shushi/pamirs/framework/faas/script/ScriptRunner.java
Method: ScriptRunner.run(String expression, String type, Map<String, Object> context)

[DESCRIPTION]
Oinone Pamirs 7.0.0 contains a remote code execution vulnerability in its dynamic script execution subsystem. ScriptRunner registers Groovy as a default script engine and forwards attacker-controlled expressions directly to the underlying script engine through ScriptRunner.run(...) without sandboxing, allowlist restrictions, or capability controls. Any application endpoint, workflow, plugin path, or administrative feature that allows untrusted input to reach this method can be abused to execute arbitrary Groovy or Java code in the application process, which may lead to file access, configuration disclosure, network access, or operating system command execution with the privileges of the running service.

[ATTACK VECTOR]
Remote, when untrusted script content is accepted by an application feature that invokes ScriptRunner.run(...).

[IMPACT]
Arbitrary code execution in the server-side application context.

[DISCOVERER]
Mon2on

[REFERENCE]
https://www.oinone.top/changelog
https://github.com/oinone/oinone-pamirs
[CVE ID]
CVE-2026-39053

[PRODUCT]
Oinone Pamirs (Pamirs Framework)

[VERSION]
7.0.0

[PROBLEM TYPE]
XML External Entity (XXE)

[AFFECTED COMPONENT]
pamirs-framework/pamirs-framework-orm-xml/src/main/java/pro/shushi/pamirs/framework/orm/xml/PamirsXmlUtils.java
pamirs-boot/pamirs-boot-ui/src/main/java/pro/shushi/pamirs/boot/web/utils/ViewXmlUtils.java

[DESCRIPTION]
Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) vulnerability in its XStream-based XML parsing logic. PamirsXmlUtils creates XStream parsers with permissive configuration and exposes fromXML(...) entry points that are reused by framework components such as ViewXmlUtils.fromXML(...). When attacker-controlled XML is routed into these parsing paths, unsafe XML processing can permit external entity resolution or related parser abuse, potentially resulting in local file disclosure or server-side request forgery, depending on the deployment and runtime parser configuration.

[ATTACK VECTOR]
Remote, when untrusted XML is accepted by an application endpoint, template import path, metadata parser, or workflow that passes data into PamirsXmlUtils.fromXML(...) or ViewXmlUtils.fromXML(...).

[IMPACT]
Information disclosure and SSRF through unsafe XML entity processing.

[DISCOVERER]
Mon2on

[REFERENCE]
https://www.oinone.top/changelog
https://github.com/oinone/oinone-pamirs
[CVE ID]
CVE-2026-39054

[PRODUCT]
Oinone Pamirs (Pamirs Framework)

[VERSION]
7.0.0

[PROBLEM TYPE]
OS Command Injection

[AFFECTED COMPONENT]
pamirs-core/pamirs-core-common/src/main/java/pro/shushi/pamirs/core/common/command/CommandHelper.java
Method: CommandHelper.executeCommands(String processPath, String... commands)

[DESCRIPTION]
Oinone Pamirs 7.0.0 contains an OS command injection vulnerability in CommandHelper.executeCommands(...). On affected deployments, the helper starts a shell process and writes each supplied command string directly to the process standard input without sanitization, command allowlisting, or argument separation. Any application functionality, operational module, or extension that forwards untrusted input into this helper can therefore be abused to execute arbitrary operating system commands with the privileges of the running service.

[ATTACK VECTOR]
Remote, when user-controlled input can reach CommandHelper.executeCommands(...) through an application feature, extension module, or plugin.

[IMPACT]
Arbitrary operating system command execution in the server context.

[DISCOVERER]
Mon2on

[REFERENCE]
https://www.oinone.top/changelog
https://github.com/oinone/oinone-pamirs