https://syntetisk.tech/blog/Recent content on Syntetisk // ResearchHugoen-usWed, 05 Aug 2026 09:00:00 +0000https://syntetisk.tech/blog/posts/stored-xss-in-djangos-admin-via-an-unvalidated-urlfield-display-path-cve-2026-15920/Wed, 05 Aug 2026 09:00:00 +0000https://syntetisk.tech/blog/posts/stored-xss-in-djangos-admin-via-an-unvalidated-urlfield-display-path-cve-2026-15920/Django&rsquo;s admin auto-linked URLField values without validating the scheme — a stored javascript: value rendered as a live link. Fixed in 6.0.8 and 5.2.17.https://syntetisk.tech/blog/posts/privilege-escalation-to-root-in-lima-qemu-guests-via-a-world-writable-agent-socket-cve-2026-53657/Wed, 01 Jul 2026 09:00:00 +0000https://syntetisk.tech/blog/posts/privilege-escalation-to-root-in-lima-qemu-guests-via-a-world-writable-agent-socket-cve-2026-53657/An unprivileged user inside a Lima QEMU guest could reach the root-owned guest-agent socket and run commands as root in the VM. Fixed in Lima v2.1.3.https://syntetisk.tech/blog/posts/blind-post-ssrf-in-phpbb-4.0.0-alpha1-web-push-cvd-with-phpbb/Sun, 31 May 2026 09:00:00 +0000https://syntetisk.tech/blog/posts/blind-post-ssrf-in-phpbb-4.0.0-alpha1-web-push-cvd-with-phpbb/A registered phpBB 4.0.0-alpha1 user could point Web Push at any URL; the server fetched it. Coordinated disclosure; fixed in phpBB 4.0.0-a2.https://syntetisk.tech/blog/posts/empty-ciphertext-panic-in-aws-encryption-provider-cvd-with-aws/Fri, 29 May 2026 09:00:00 +0000https://syntetisk.tech/blog/posts/empty-ciphertext-panic-in-aws-encryption-provider-cvd-with-aws/A two-byte gRPC request crashed AWS&rsquo;s Kubernetes KMS plugin. Coordinated disclosure with AWS VDP; fix merged as aws-encryption-provider#169.https://syntetisk.tech/blog/posts/first-transmission-why-we-ship-the-research/Sun, 24 May 2026 09:00:00 +0000https://syntetisk.tech/blog/posts/first-transmission-why-we-ship-the-research/<p>We built Syntetisk around a single hypothesis: that adversarial tooling becomes sharper when <strong>operator judgment compounds</strong>. Every senior reviewer decision — &ldquo;this is a real finding,&rdquo; &ldquo;this is noise,&rdquo; &ldquo;this would have been signal if it had been chained with X&rdquo; — should feed the next agent run.</p> <p>This blog is where we share the parts of that work that travel well: primitives we discover, tooling we build, and field notes from running the loop against real surfaces.</p>