Cp0204 Quark-Auto-Save vulnerabilities

CVE-2026-45229 [HIGH] CWE-915 CVE-2026-45229: Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out leg

CVE-2026-45228 [MEDIUM] CWE-79 CVE-2026-45228: Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configur Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the template renders push_config key names using Vue.js's v-html directive without escaping. Authenticated attackers can inject HTML or JavaScript payloads as key names through the POST /update endpoint, which are persisted to disk and