You're in the live demo

You're exploring with sample data. Refresh resets the workspace. Subscribe when you're ready to track real records.

Sealed May 01, 2026, 20:16 UTC by anya@atlas-security.examplehash 0xd4e5f6…d4e5prev 0xa1b2c3…a1b2REC-DEMO04

VulnerabilityMediumNon-reportableMitigating

Path traversal in /api/v1/files

Awareness

May 01, 2026, 20:16 UTC

Notification

May 02, 2026, 08:16 UTC

Patch available

May 03, 2026, 08:16 UTC

Created

May 01, 2026, 20:16 UTC

Status & actions

Status

Submission stage

Not reportable to a CSIRT

Recorded for the chain, but no Article 14 deadlines apply.

Reasoning

This vulnerability isn't actively exploited (no in-the-wild evidence) and has no security impact on availability, integrity or confidentiality. CRA Article 14 only mandates notification for actively exploited vulnerabilities, so we keep the record but skip the 24h / 72h / 14d clocks.

If this changes

Promote via Status → and the deadline clocks will start at the moment of promotion. We do not back-date.

Response workflow

Sealed facts (frozen)

Hash-chained at creation. Anchors authority filings.

Operational context (appendable)

Append-only updates. The audit trail is preserved.

Operational details

Sealed first save, then amended in place. Every change is logged with from → to and reason.

Impact

Plain-language description of who is affected and how. Goes into the regulator file.

Authenticated users could read arbitrary files outside their workspace via crafted file IDs.

Actions takenamended 1×

What you actually did. Goes into the 72h and final reports.

Patch in 4.2.2 normalises and validates file IDs server-side.

Cause or actor

Internal regression, third-party dep, opportunistic scanner, named APT…

Insufficient input validation in legacy file controller.

Notes

Scratch space — not included in authority files.

Awaiting reporter coordination before public disclosure.

Data sensitivity

internal

Customer guidance

None required; server-side fix shipped to all tenants.

Evidence of exploitation

Not recorded

Affected products

CSIRT routing requires at least one attached product.

Atlas Gateway v4.2.1

Evidence vault

0 items · sealed in chain order

No evidence attached yet. Add files, links, or notes; each item is timestamped and added to the record timeline.

Indicators of compromise

Auto-extracted from evidence. Suggested IoCs need a human accept before they ride along to ENISA.

No indicators suggested yet. Accepted indicators will flow into reports and authority files.

Activity

4 events on the chain

Record created
May 01, 2026, 20:16 UTC
Submission marked
May 02, 2026, 08:16 UTC
Status changed
May 03, 2026, 00:16 UTC
Open → Mitigating
Details amended
May 03, 2026, 08:16 UTC
Actions taken updated

Sealed May 01, 2026, 20:16 UTC by anya@atlas-security.examplehash 0xd4e5f6…d4e5prev 0xa1b2c3…a1b2REC-DEMO04

VulnerabilityMediumNon-reportableMitigating

Path traversal in /api/v1/files

Awareness

May 01, 2026, 20:16 UTC

Notification

May 02, 2026, 08:16 UTC

Patch available

May 03, 2026, 08:16 UTC

Created

May 01, 2026, 20:16 UTC

Status & actions

Status

Submission stage

Not reportable to a CSIRT

Recorded for the chain, but no Article 14 deadlines apply.

Reasoning

If this changes

Promote via Status → and the deadline clocks will start at the moment of promotion. We do not back-date.

Response workflow

Sealed facts (frozen)

Hash-chained at creation. Anchors authority filings.

Operational context (appendable)

Append-only updates. The audit trail is preserved.

Operational details

Sealed first save, then amended in place. Every change is logged with from → to and reason.

Impact

Plain-language description of who is affected and how. Goes into the regulator file.

Authenticated users could read arbitrary files outside their workspace via crafted file IDs.

Actions takenamended 1×

What you actually did. Goes into the 72h and final reports.

Patch in 4.2.2 normalises and validates file IDs server-side.

Cause or actor

Internal regression, third-party dep, opportunistic scanner, named APT…

Insufficient input validation in legacy file controller.

Notes

Scratch space — not included in authority files.

Awaiting reporter coordination before public disclosure.

Data sensitivity

internal

Customer guidance

None required; server-side fix shipped to all tenants.

Evidence of exploitation

Not recorded

Affected products

CSIRT routing requires at least one attached product.

Atlas Gateway v4.2.1

Evidence vault

0 items · sealed in chain order

No evidence attached yet. Add files, links, or notes; each item is timestamped and added to the record timeline.

Indicators of compromise

Auto-extracted from evidence. Suggested IoCs need a human accept before they ride along to ENISA.

No indicators suggested yet. Accepted indicators will flow into reports and authority files.

Activity

4 events on the chain

Record created
May 01, 2026, 20:16 UTC
Submission marked
May 02, 2026, 08:16 UTC
Status changed
May 03, 2026, 00:16 UTC
Open → Mitigating
Details amended
May 03, 2026, 08:16 UTC
Actions taken updated