# Information leakage through Graphviz blocks

Graphviz blocks in Phabricator Remarkup let attackers render arbitrary server-readable image files and probe file existence via dot error output.

- Payout: hidden
- Severity: medium
- Program: Phabricator
- Found by: jbeta
- Disclosed: 2015-09-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/88395
- Library page: https://bugbountylibrary.com/r/h1%3A88395
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:command-injection vuln:info-disclosure

**Target:** Remarkup Graphviz block rendering (dot)
**Root cause:** Graphviz `image`/`shapefile` node attributes accept arbitrary filesystem paths, and `dot` runs unsandboxed, so it reads any file the webserver can access and echoes paths in error output.
**Steps:**
1. Install Graphviz alongside Phabricator so `dot` is available.
2. Paste a Remarkup graph snippet using `image`/`shapefile` attributes pointing at a target path.
3. Insert a deliberate syntax error to trigger `dot` error output revealing file existence/readability.
**How found:** Noticed Graphviz node attributes accept file paths and that dot error output reflects them, then tested with intentional syntax errors.
**Exploitation:** Attacker with Remarkup write access supplies graph specs referencing arbitrary paths; successful render or dot error messages confirm file existence and readability, leaking installed packages and potentially Phabricator-stored images.
**Escalation:** Chaining with GhostScript support in dot could execute arbitrary PostScript commands in specific old-gs setups.
**Insight:** When a feature shells out to a renderer like dot, check whether its file-path attributes (image, shapefile) are constrained and whether error output reflects filesystem state.