Description

A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-29T04:17:54.917Z",
  "pubdate": "2026-09-29T04:17:54.917Z",
  "executiveSummary": "A critical security flaw has been identified in REBUILD versions up to 4.4.11, specifically within the /commons/file-editor-save endpoint.\nThe vulnerability is characterized as a missing authorization check, allowing unauthenticated or unauthorized remote attackers to manipulate the system.\nBy targeting the url/fileKey arguments, an adversary can bypass security controls to perform unauthorized actions related to file editing.\nThis vulnerability is particularly concerning as functional exploit code has been publicly released, lowering the barrier to entry for malicious actors.\nThe vendor has remained unresponsive to disclosure attempts, leaving affected systems at risk without a direct patch.\nSuccessful exploitation allows for remote code manipulation or unauthorized file system access, potentially leading to full system compromise or sensitive data exfiltration depending on the environment's configuration.\nOrganizations using REBUILD 4.4.11 or earlier are currently exposed to remote exploitation and should implement immediate defensive measures to mitigate the risk of unauthorized access.",
  "technicalDetails": "The vulnerability resides in the /commons/file-editor-save file, which fails to implement adequate access control checks for user-supplied input.\nThe root cause is a lack of server-side authorization validation when processing requests targeting specific resources identified by the url or fileKey arguments.\nBecause the application logic assumes the integrity of these parameters without verifying the requester's identity or permissions, it proceeds to execute the file-saving operation regardless of the user's authentication status or authorization level.\nThe attack flow begins with a remote attacker identifying a target installation of REBUILD up to version 4.4.11. The attacker crafts a malicious HTTP request directed at the /commons/file-editor-save endpoint.\nBy manipulating the url/fileKey parameters within the request body or URI, the attacker can force the application to interface with unintended file paths or sensitive system files.\nSince the application performs no validation of the requester's authority to modify these resources, the backend service processes the input and commits changes to the file system as requested by the attacker.\nThis vulnerability is remotely exploitable, requiring no prior authentication, and is reachable over the network, effectively bypassing the intended security perimeter of the REBUILD application.\nThe post-exploitation impact includes the ability to overwrite critical configuration files, inject malicious scripts, or modify existing application code, which could facilitate remote code execution or facilitate a broader compromise of the underlying server infrastructure.\nGiven that exploit scripts have been publicly disclosed, the exploitability of this flaw is high, as attackers can automate the identification and exploitation of vulnerable instances without requiring specialized knowledge of the proprietary code base."
}