Уязвимости grumpydictator/firefly-iii

CVE-2026-50886

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

## Summary The Twig template `resources/views/list/ale.twig` renders the piggy bank name from `AuditLogEntry.after.piggy` using the `|raw` filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log. ## Root Cause The `|raw` filter is required on the outer `trans()` call to preserve `<span>` tags in the `amount` parameter (currency styling). However, this also disables escaping for the user-controlled `name` parameter. **Vulnerable code (`resources/views/list/ale.twig` lines 107, 110):** ```twig {{ trans('firefly.ale_action_

• Обновитесь до 6.6.3

Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)

### Summary The User management API endpoints (`GET /api/v1/users` and `GET /api/v1/users/{id}`) are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status. ### Affected Endpoints 1. **GET /api/v1/users** (UserController::index, line 94) — Lists ALL users with full details. No role check. 2. **GET /api/v1/users/{id}** (UserController::show, line 126) — Shows any user's details by ID. No role check. ### Root Cause (1-of-N Inconsistency) Other methods in the same controller properly check for the 'owner' role: - `store()` — `UserStoreRequest::authorize()`

• Обновитесь до 6.5.1

MFA bypass in oauth flow in Firefly III

Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from other sources. As OAuth applications are easily enumerable using an incrementing id, an attacker could try sign an OAuth application up to a users profile quite easily if they have created one. The attacker would also need to know the victims username and password. This problem has been patched in Firefly III v6.1.17 and up. Users are advised to upgrad

• Обновитесь до 6.1.17

C5 Firefly III CSV Injection.

### Summary CSV injection is a vulnerability where untrusted user input in CSV files can lead to unauthorized access or data manipulation. In my subsequent testing of the application. ### Details I discovered that there is an option to "Export Data" from the web app to your personal computer, which exports a "csv" file that can be opened with Excel software that supports macros. P.S I discovered that the web application's is offering a demo-site that anyone may access to play with the web application. So, there's a chance that someone will export the data (CVS) from the demo site and execute it on their PC, giving the malicious actor a co

• Обновитесь до 6.1.7

CVE-2024-22075

Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.

• Обновитесь до 6.1.1

Insufficient Session Expiration in firefly-iii/firefly-iii

Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.

• Обновитесь до 6.0.0

Improper Input Validation in firefly-iii/firefly-iii

Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.

• Обновитесь до 6.0.0

Incorrect Authorization in firefly-iii/firefly-iii

Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.

• Обновитесь до 5.8.0

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

• Обновитесь до 5.6.5

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

• Обновитесь до 5.6.5

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

• Обновитесь до 5.6.3

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Open Redirect in firefly-iii/firefly-iii

firefly-iii is vulnerable to URL Redirection to Untrusted Site

• Обновитесь до 5.6.2

Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iii

firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type

• Обновитесь до 5.6.2

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

• Обновитесь до 5.6.1

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

• Обновитесь до 5.6.0

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

• Обновитесь до 5.6.0

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

• Обновитесь до 5.6.0