Edit ndaal-sa-2026-416

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

Two defects on the same operator-initiated path. (1) Integrity: run_dump writes .sha-256/.sha-512/.sha3-512/.blake3-512/.shake256-512 sidecars for every dump, but restore_dump (src/dbdump.rs) validated only the SQLite magic, UTF-8 encoding and size caps — never the digests. Anyone able to write to the dump directory could therefore alter a dump, and a later restore would present the rewritten annotation history as authentic, defeating the append-only versioning the product relies on for its audit trail. (2) Replay authority: Store::restore_sql_dump (src/store.rs) executed the dump text as a single batch, so a hostile `.sql` could ATTACH a second database — reading or overwriting any file the viewer process could reach — and could leave triggers or views behind that fire on every subsequent annotation write, persisting long after the restore completed. Exploitation requires write access to a dump file the operator later chooses to restore, and the operator action of running --restore-dump, which is why the vector is AV:L/PR:L with user interaction required. Impact when those preconditions are met is high for both confidentiality and integrity. Rated CWE-345 with CWE-501 (trust-boundary violation) as the secondary weakness; ASVS V1.3 (safe deserialization of untrusted input) and V13.4.

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel