Tgstation vulnerabilities
We track 3 vulnerabilities in Tgstation products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on January 6, 2025.
Latest Tgstation vulnerabilities
- 8.8 High severity
tgstation-server: Improper Authorization
tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to mos
- 9.9 Critical severity
tgstation-server: Improper Limitation of a Pathname to a Restricted Directory
tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users using the "Set .dme Path" privilege could potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme fi
- 7.5 High severity
tgstation-server: Incorrectly Specified Destination in a Communication Channel
tgstation-server is a production scale tool for BYOND server management. The DreamMaker API (DMAPI) chat channel cache can possibly be poisoned by a tgstation-server (TGS) restart and reattach. This can result in sending chat messages to one of any of the conf