PT-2026-103610

Name of the Vulnerable Software and Affected Versions bisheng versions 2.3.0 through 2.4.0 Description A directory traversal issue exists in the save download file function located in src/backend/bisheng/core/cache/utils.py:290. Directory traversal is a flaw that allows an attacker to access file...

Authorization Bypass Through User-Controlled Key

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the download-file handler, which fails open when a file lacks the share metadata used to prove it belongs to the requested conversatio...

CVE-2026-100531

The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An authenticated caller restricted to a...

CVE-2026-100531 openclaw Slack before 2026.8.1 Authorization Bypass

The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An authenticated caller restricted to a...

CVE-2026-100531

The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An authenticated caller restricted to a...

CVE-2026-100531

The @openclaw/slack npm package (versions before 2026.8.1 ) contains an authorization flaw in the Slack download-file handler . The vulnerability occurs because the conversation-authorization check fails open when a file lacks the share metadata required to prove it belongs to a specific conversa...

EUVD-2026-87519

The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An authenticated caller restricted to a...

CVE-2026-100531 openclaw Slack before 2026.8.1 Authorization Bypass

The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An authenticated caller restricted to a...

CVE-2026-100531 openclaw Slack before 2026.8.1 Authorization Bypass

The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An authenticated caller restricted to a...

CVE-2026-100531: Authorization Bypass Through User-Controlled Key

The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An authenticated caller restricted to a...

PT-2026-99168

Name of the Vulnerable Software and Affected Versions @openclaw/slack versions prior to 2026.8.1 Description An authorization flaw exists in the Slack download-file handler. When a file lacks the share metadata required to verify its association with a requested conversation, the...

PT-2026-94077

Name of the Vulnerable Software and Affected Versions LibreTranslate versions prior to 1.9.7 Description The download file route omits the access check decorator, which enables unauthenticated access to translated files. This allows attackers to bypass API key requirements and ignore ban lists to...

CVE-2026-18907 PathTravelsal Vulnerability in com.talpa.hibrowser

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

CVE-2026-18907

The TECNO Hi Browser (com.talpa.hibrowser) version 2.23.1.1 on Android is vulnerable to a Path Traversal vulnerability (CWE-23) in its download file feature . The root cause is that the browser trusts an attacker-controlled Content-Disposition filename and fails to sanitize path separators or per...

CVE-2026-18907: Relative Path Traversal

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

pretix vulnerable to Authorization Bypass Through User-Controlled Key

When creating an export through the pretix API, API clients are returned an UUID value for their export job a long, random string like 35742818-c375-4d15-839f-d49aecce94d6. Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places...

PYSEC-2026-1262 ComposioHQ has a directory traversal vulnerability

Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the downloadfileordir function...

Nicotine+ DoS on Null Character in Download Request

Denial of service DoS vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character...

PT-2026-52609

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.6 Description An arbitrary file read issue exists where the chatId parameter in the '/api/v1/get-upload-file' and '/api/v1/openai-assistants-file/download' endpoints is not validated. This value is passed to the...

📄 WordPress OrderConvo 13.5 Path Traversal / File Read

This Metasploit module exploits a path traversal vulnerability in WordPress OrderConvo plugin versions prior to 14 for WooCommerce. The vulnerability exists in the download-file endpoint which fails to properly sanitize the filename parameter, allowing attackers to read arbitrary files from the...