dotdotslash

dotdotslash Una herramienta para ayudarte a buscar vulnerabilidades de Directory Traversal Benchmarks Plataformas que probé para validar la eficiencia de la herramienta: DVWA low/medium/high bWAPP low/medium/high Capturas de pantalla Instalación Puedes descargar la última versión clonando este...

CVE-2026-108693

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with...

CVE-2026-108693

A flaw was found in ImageMagick. An insecure search path vulnerability allows a local attacker to achieve arbitrary code execution by placing a malicious executable into the application's working directory. When converting document formats such as PDF or PostScript on Windows systems without a...

EUVD-2026-96696

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with...

CVE-2026-108693

The ImageMagick software on Windows versions through 7.1.2-33 and 6.9.13-58 is vulnerable to an uncontrolled search path vulnerability within the NTGhostscriptEXE() function. When Ghostscript is unregistered, the application launches gswin64c.exe using its bare name. This allows an attacker to pl...

PT-2026-110073

Name of the Vulnerable Software and Affected Versions ag2ai ag2 versions prior to 0.13.5 Description A path traversal issue exists in the UserProxyAgent component. The problem occurs within the os.path.join function when processing the filename argument, allowing a remote attacker to manipulate...

PT-2026-110349

Name of the Vulnerable Software and Affected Versions bleenco abstruse versions prior to 2.1.1 Description A path traversal issue exists in the Cache Endpoint component within the file server/api/worker/download cache.go. The flaw occurs in the filepath.Join function when processing the File...

flatpak security update

1.16.0-9.4 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267891 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-267432 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271519 1.16.0-9....

flatpak security update

1.12.9-7 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271507 1.12.9-6 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267897 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-267425...

CVE-2026-108772: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/downloadcache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched...

CVE-2026-108725: Improper Neutralization of Input During Web Page Generation

Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/path URL to a signed-in victim, executing...

CVE-2026-108567: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function filesdeletefile of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remotely. The exploit has...

CVE-2026-108544: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function word.office.docxviewer.document.docx.reader.ViewTxt. Such manipulation of the argument displayname leads to path traversal. The attack may be performed from remote...

FreeBSD : py-WsgiDAV -- Multiple vulnerabilities (0f5aaca7-c4d5-11f1-96b4-74563cf85f9d)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0f5aaca7-c4d5-11f1-96b4-74563cf85f9d advisory. [email protected] reports: WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDA...

CVE-2026-108902: Improper Limitation of a Pathname to a Restricted Directory

pH7Builder pH7 Social Dating CMS before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picturelink parameter to remove other members' photos or...

PT-2026-109987

Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.1.2-33 and earlier ImageMagick versions 6.9.13-58 and earlier Description ImageMagick on Windows contains an uncontrolled search path issue within the NTGhostscriptEXE function. When Ghostscript is unregistered, the...

PT-2026-110128

Name of the Vulnerable Software and Affected Versions Cheshire Cat AI core versions prior to 2.0.24 Description A stored cross-site scripting issue exists in the uploads plugin. Authenticated users can upload HTML files via the 'POST /uploads' endpoint because there are no file type restrictions...

Linux Distros Unpatched Vulnerability : CVE-2026-108693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE that launches gswin64c.exe by bare...

CVE-2026-108543: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclos...

evilarc

evilarc Zweck Mit evilarc können Sie eine ZIP-Datei erstellen, die Dateien mit Directory-Traversal-Zeichen in ihrem eingebetteten Pfad enthält. Die meisten kommerziellen ZIP-Programme winzip usw. verhindern die Extraktion von ZIP-Dateien, deren eingebettete Dateien Pfade mit...