macms10 v2026.1000.4055 Security Patch: SSRF, Auth Bypass, ZipSlip Fixes

Vulnerability Overview Vulnerability Name: macms10 updated to v2026.1000.4055 Vulnerability Description: - New Plugin Market and Online Installation: RS256 signature verification, SSRF outbound protection, double ZipSlip validation, and multi-language i18n support. - New Social Features: Follow/fans functionality, activity streams, content sharing, and private messaging, accompanied by social templates. - New PWA and Web Push Notifications: SSRF whitelist for subscriptions, CSRF protection and rate-limiting quotas, asynchronous broadcast queues, and an in-site message center. - Frontend Integration for User Promotions: Limited-time flash sales and points mall. - New AI Operations Pipeline: AI content tagging, intelligent recommendations, user profiling, and content quality scoring for operational statistics. - AI Chat Integration: Connected to in-site semantic search with optimized embedding semantic mapping. - Enhanced Push Failure Handling: Automatic line switching (script fallback and external link detection), with optimized loading screens for resource sites. - Strengthened Paid Downloads: Per-episode locking and containment of in-episode address leaks, fixes for purchase verification and credit deduction, and completion of CSRF protection. - Bug Fixes: Privilege escalation in cross-session private messages, failure to create orders for top-ups without coupons, unresponsiveness when clicking on crawled/linked categories, and post-statistics issues. - General Improvements: Removal of the legacy backend and other detailed optimizations. Scope of Impact Affected Versions: macms10 updated to v2026.1000.4055 Remediation Remediation Measures: - New Plugin Market and Online Installation: RS256 signature verification, SSRF outbound protection, double ZipSlip validation, and multi-language i18n support. - New Social Features: Follow/fans functionality, activity streams, content sharing, and private messaging, accompanied by social templates. - New PWA and Web Push Notifications: SSRF whitelist for subscriptions, CSRF protection and rate-limiting quotas, asynchronous broadcast queues, and an in-site message center. - Frontend Integration for User Promotions: Limited-time flash sales and points mall. - New AI Operations Pipeline: AI content tagging, intelligent recommendations, user profiling, and content quality scoring for operational statistics. - AI Chat Integration: Connected to in-site semantic search with optimized embedding semantic mapping. - Enhanced Push Failure Handling: Automatic line switching (script fallback and external link detection), with optimized loading screens for resource sites. - Strengthened Paid Downloads: Per-episode locking and containment of in-episode address leaks, fixes for purchase verification and credit deduction, and completion of CSRF protection. - Bug Fixes: Privilege escalation in cross-session private messages, failure to create orders for top-ups without coupons, unresponsiveness when clicking on crawled/linked categories, and post-statistics issues. - General Improvements: Removal of the legacy backend and other detailed optimizations. POC Code or Exploit Code No POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

macms10 v2026.1000.4055 Security Patch: SSRF, Auth Bypass, ZipSlip Fixes

More from this source