CVE-2026-45229: Mass Assignment in Quark Drive

The core impact of CVE-2026-45229 lies in the ability for an attacker to permanently compromise administrator accounts. By crafting a malicious POST request to the /update endpoint, an attacker can overwrite the stored login credentials. This effectively locks out legitimate administrators and grants the attacker persistent, unauthorized access to the entire Quark Drive instance. This access extends to all configured tasks, cloud tokens, and notification services, potentially enabling widespread disruption and data exfiltration. The vulnerability's reliance on authentication means an attacker must first gain a valid login, but once achieved, the impact is severe and long-lasting.

1. 予約済み2026-05-11
2. 公開日2026-05-13

The primary mitigation for CVE-2026-45229 is to immediately upgrade Quark Drive to version 0.8.5 or later. If an upgrade is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block POST requests to the /update endpoint containing arbitrary webui objects within the config_data dictionary. Alternatively, restrict access to the /update endpoint to trusted networks or users. Carefully review and validate all input received by the /update endpoint to prevent future mass assignment vulnerabilities. After upgrading, confirm the fix by attempting to modify administrator credentials via the /update endpoint with a crafted payload; the request should be rejected.