Description
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.
Remediation
References
Related Vulnerabilities
SharePoint CVE-2022-24472 Vulnerability (CVE-2022-24472)
WordPress Plugin VideoWhisper Video Presentation 'vw_upload.php' Arbitrary File Upload (3.17)
MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2025-61639)