[Verse 1] Picture a doc server trusting a name you send, ONLYOFFICE listens, waits for a file to append, Two thousand twenty-one, the number reads three-one-nine-nine, A slash-dot-dot sneaks in through the upload line, JWT's supposed to lock the door, keep the hallway tight, But the path escapes the folder, slips into the night, Attacker climbs out of the upload cage, then writes remote code, Walks the server like he owns the house, down every hallway and road, One sneaky sequence, one careless check, and the whole system bends, That's how a small upload box becomes where the breach begins. [Chorus] Patch the cracks before the water's in, October thirteen, the warnings spin, Path traversal, broken locks, forgotten gates, Critical CVEs don't wait, don't wait. [Verse 2] Now rewind to twenty fifteen, an old ghost still around, ProFTPD's got two commands making alarm bells sound, Site cpfr, site cpto — copy from, copy to, No real check on who you are, no gatekeeper asking you, Read any file on that server, write wherever you please, Config secrets, password hashes, grabbed with ease, Improper access control, the oldest trick alive, A decade later and it's still out there, patient, waiting to survive, Two little commands, never meant for strangers' hands, Still open on servers nobody scanned. [Verse 3] TeamCity's sandbox was supposed to hold the Kotlin script inside, Eight point eight on the CVSS scale, nowhere left to hide, Before twenty twenty-six one-three, or eleven-seven's patch, A clever build script climbs the wall and quietly lifts the latch, Sandbox escape becomes the key to the whole build machine, Remote code execution, the worst outcome you've seen, JetBrains flagged it, told you fix it, told you don't delay, Every pipeline that you trust could get hijacked today, A build meant to compile turns into a loaded gun, Patch before the next deploy, before the damage is done. [Bridge] Three different doors, three different cracks, A folder, a command, a sandbox — none of them hold back, Trust is the hinge and the hinge just snapped, Check your version numbers before the breach gets mapped, Old bugs, new bugs, sleeping bugs the same, Every unpatched system still answers to the name. [Chorus] Patch the cracks before the water's in, October thirteen, the warnings spin, Path traversal, broken locks, forgotten gates, Critical CVEs don't wait, don't wait. [Outro] ONLYOFFICE, ProFTPD, TeamCity too, Three names, three numbers, one quiet job for you, Update the server, close the slash, retire the old command, Eight point eight is loud enough — go on, take a stand.
← Critical CVEs (1 of 3) — October 13, 2026 | Critical CVEs (3 of 3) — October 13, 2026 →