ash-project ash_paper_trail up to 0.6.x cleartext storage

Summaryinfo

A vulnerability categorized as problematic has been discovered in ash-project ash_paper_trail up to 0.6.x. This impacts an unknown function. Such manipulation leads to cleartext storage. This vulnerability is documented as CVE-2026-75847. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in ash-project ash_paper_trail up to 0.6.x and classified as problematic. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a cleartext storage vulnerability. Using CWE to declare the problem leads to CWE-312. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. Impacted is confidentiality. CVE summarizes:

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes. AshPaperTrail stores the values of tracked sensitive? attributes in the generated version resource's changes map, which is declared public? true and sensitive? false, so the values are returned by the version resource's default read action and printed in logs, inspect output, and error messages instead of being redacted. AshPaperTrail.Resource.Transformers.CreateVersionResource derives the changes map's sensitivity from the ignore_attributes list (the attributes excluded from changes) rather than from the tracked attributes actually stored in it, and ignore_attributes defaults to empty, so the flag is effectively always false. This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-75847 since 08/20/2026. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1555.

Upgrading to version 0.7.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_paper_trail

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6

Website

• Product: https://github.com/ash-project/ash_paper_trail/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion