Advisories

An unauthenticated X-Forwarded-For header reaches shell_exec() through a broken IP-validation helper that returns the raw input instead of its sanitized fallback. Yields code execution as www-data inside the Notes Station 3 container with no user interaction.

A www-data-writable crontab is installed by a root-owned monitor inside the container, and host home directories are bind-mounted writable with no user-namespace remapping. Chains from the pre-auth RCE to container root and then admin SSH on the NAS host.

An unauthenticated backup_restore handler concatenates _job_id into a SQL WHERE clause; db->escape() only handles single quotes and the value is interpolated unquoted, so the escape call is a no-op. Time-based blind extraction of contacts, IMAP and SMTP credentials, and live NAS_SID session rows.