CVE-2026-110212

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...

CVE-2026-110212 ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...

CVE-2026-110212

The Stonewuu ai-fusion-video application (through version 1.2.0 ) is vulnerable to a path traversal vulnerability (CWE-22) in the media upload functionality. Authenticated users can leverage the subDir parameter of the POST /api/storage/upload endpoint to write files outside the intended media di...

CVE-2026-110212: Improper Limitation of a Pathname to a Restricted Directory

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...

CVE-2025-65112: Missing Authorization

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain...

CVE-2022-35569

Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted file...

PT-2022-22906

Name of the Vulnerable Software and Affected Versions Blogifier version 3.0 Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted file, exploiting an arbitrary file upload vulnerability at the /api/storage/upload/PostImage API endpoint. This enables attacke...

CVE-2022-35569: Improper Neutralization of Input During Web Page Generation

Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted file...