{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://dcsf.net/vex.json",
  "author": "DataHouse / eTop sp. z o.o. <dat@etop.pl>",
  "role": "Document Creator",
  "timestamp": "2026-10-08T13:46:20.628Z",
  "version": 6,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2026-65638",
        "@id": "https://www.cve.org/CVERecord?id=CVE-2026-65638"
      },
      "products": [
        {
          "@id": "pkg:generic/datahouse/dcsf@15.10.32",
          "hashes": {
            "sha-256": "ba8e5a738dec83bf4ef3abd8b59add85e88f495555f5dd8f116d837b70f86268"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "The released Messenger removes the legacy reCAPTCHA verification and unblock command path. The former PHP challenge endpoint returns HTTP 403. The upstream request-URL shell injection path is absent. Authentic, unmodified release package and its managed templates. This does not attest to a particular server installation, residual administrator configuration, every vulnerability, or earlier DCSF releases.",
      "status_notes": "Fresh pinned-key signature, artifact digest and complete inventory verification. Six reviewed Messenger sources and Apache templates remain byte-identical. LFD matches the signed-package source commit; its complete diff from the previously reviewed source changes only three LF_FLUSH arguments in process tracking, outside Messenger and the retired unblock queue. Not a new live exploit test. Evidence: https://dcsf.net/security/messenger-assessment.json; upstream advisory: https://support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release"
    },
    {
      "vulnerability": {
        "name": "CVE-2026-67402",
        "@id": "https://www.cve.org/CVERecord?id=CVE-2026-67402"
      },
      "products": [
        {
          "@id": "pkg:generic/datahouse/dcsf@15.10.32",
          "hashes": {
            "sha-256": "ba8e5a738dec83bf4ef3abd8b59add85e88f495555f5dd8f116d837b70f86268"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "The packaged Apache HTTP and HTTPS templates do not map /usr/bin through ScriptAlias. They serve static GET/HEAD content, disable executable handlers and .htaccess overrides, and deny script extensions. Authentic, unmodified release package and its managed templates. This does not attest to a particular server installation, residual administrator configuration, every vulnerability, or earlier DCSF releases.",
      "status_notes": "Fresh pinned-key signature, artifact digest and complete inventory verification. Six reviewed Messenger sources and Apache templates remain byte-identical. LFD matches the signed-package source commit; its complete diff from the previously reviewed source changes only three LF_FLUSH arguments in process tracking, outside Messenger and the retired unblock queue. Not a new live exploit test. Evidence: https://dcsf.net/security/messenger-assessment.json; upstream advisory: https://support.cpanel.net/hc/en-us/articles/43171958716439-Security-CSF-Security-Release-September-3rd-2026"
    }
  ]
}