$ grep -r "arbitrary-file-read"
A ticket-booking site leaks files through an unauthenticated arbitrary file read on its /download endpoint. A second vHost running Gitea reveals a docker-compose bind mount, which we use to read the Gitea config and pull its SQLite database off disk. Cracking the developer PBKDF2 hash gives SSH access, and a root cron running a vulnerable ImageMagick (CVE-2024-41817) with an empty LD_LIBRARY_PATH is abused with a malicious shared library for root.
An exposed .git directory on a dev vhost is dumped to recover a Ghost CMS admin password from a committed change. Ghost 5.58.0 is vulnerable to CVE-2023-40028, an authenticated symlink arbitrary file read, used to read the Ghost config and recover bob's SSH password. bob may run a symlink-cleaning script as root that reads a file after a vulnerable check; a TOCTOU race swaps the symlink target to root's SSH key, leaking it for a root login.