ETK-2026-3866Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3866",
  "cve_id": null,
  "display_id": "ETK-2026-3866",
  "ghsa_id": "GHSA-vv3x-jpvc-w468",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Cross-caller file disclosure in pain001 REST API",
  "summary": "pain001 REST API deployments before 0.0.80 can return one caller's generated payment file to another caller because jobs of the same message type reuse an output path. An attacker able to submit and download jobs in a shared API deployment may obtain another caller's payment instructions or cause their file to be replaced.",
  "mitigation": "Upgrade pain001 to version 0.0.80 or later. Until upgraded, isolate callers by running separate API instances or assigning each request a distinct output directory.",
  "vendor": "pip",
  "product": "pip:pain001",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.0.48, <= 0.0.79"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "0.0.80"
      ],
      "package_name": "pain001",
      "purl": "pkg:pypi/pain001"
    }
  ],
  "cwes": [
    668
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.54690835,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-07T23:07:07+00:00",
      "days": -0.017819363136574073,
      "is_lower_bound": true,
      "measured_at": "2026-11-07T23:32:46.632177+00:00",
      "url": "https://github.com/sebastienrousseau/pain001/security/advisories/GHSA-vv3x-jpvc-w468"
    }
  }
}