Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Only the latest release version of CodeChecker is supported by security updates.

Version	Supported
Latest Release	✅
Earlier Releases	❌

Reporting a Vulnerability

If you find a vulnerability in CodeChecker, please report it as a security vulnerability on GitHub https://github.com/Ericsson/codechecker/security/advisories/new

Buffer overflow in CodeChecker log command
GHSA-5xf2-f6ch-6p8r published Sep 22, 2025 by bruntib

Moderate
Open redirect when URL contains multiple slashes after the product name
GHSA-g839-x3p3-g5fm published Feb 28, 2025 by Discookie

Moderate
Open Redirect when URL contains multiple slashes in CodeChecker Docker image and servers running on older Python versions
GHSA-557h-rh8q-mg29 published Feb 28, 2025 by Discookie

Moderate
Cross-Site Request Forgery in CodeChecker API
GHSA-f8c8-4pm7-w885 published Jan 21, 2025 by bruntib

High
Authentication bypass when using specifically crafted URLs
GHSA-f3f8-vx3w-hp5q published Nov 6, 2024 by dkrupp

Critical
Authentication method confusion allows logging in as the built-in root user from an external service
GHSA-fpm5-2wcj-vfr7 published Nov 6, 2024 by dkrupp

High
Path traversal in CodeChecker server in the endpoint of CodeChecker store
GHSA-h26w-r4m5-8rrf published Jun 24, 2024 by vodorok

Moderate

Learn more about advisories related to Ericsson/codechecker in the GitHub Advisory Database