two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — Path Traversal in TECNO Hi Browser Download Handler Proof-of-concept for CVE-2026-18907 CVSS 7.5 High, CWE-23, a relative path-traversal vulnerability in the download file feature of TECNO Hi Browser com.talpa.hibrowser version 2.23.1.1. The browser trusted an attacker-controlled...

CVE-2019-14530

CVE-2019-14530 Vulnerabilidad de path traversal y DoS en el proyecto OpenEMR Función vulnerable en el archivo: /openemr/custom/ajaxdownload.php Condiciones: 1. cualquier usuario autorizado 2. para el caso de DoS: debe existir el directorio "/sites/default/documents/cqmqrda/" en el servidor Debido...

CVE-2026-19264

CVE-2026-19264 - Unauthenticated Path Traversal to Full Instance Takeover in Postiz Author: Krithik Babu P @DarkLycn1976 Published: 2026-08-10 CVE: CVE-2026-19264 Severity: Critical - CVSS 4.0 9.3 / CVSS 3.1 9.8 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory Affected:...

WordPress Post Export Import with Media plugin <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin Post Export Import with Media versions = 1.17.1...

ragflow-audit

ragflow-audit RAGFlow three-vulnerability audit tool CVE-2026-28797 / CVE-2026-24770 / CVE-2025-69286 ssti : Detect and exploit SSTI - RCE in the StringTransform / Message components zipslip : Offline detection of path traversal in zip entries Zip Slip apikey : Derive API key from sharing link be...

CVE-2026-108158

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

CVE-2026-108156

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

CVE-2018-12596

CVE-2018-12596 Ektron CMS 9.20 SP2 permite a atacantes remotos llamar a páginas aspx a través de la página "activateuser.aspx", incluso si una página se encuentra bajo la ruta /WorkArea/, que está prohibida normalmente disponible exclusivamente para administradores locales. Publicación de...

grafana-CVE-2021-43798

Grafana CVE Scan 21-43798 0.1 Scanner for Grafana Path Traversal Vulnerability found in CVE-2021-43798 Disclaimer: This is for Educational Purposes only! References for CVE: 1 - NIST CVE Details 2 - Grafana Notes Workarounds All installations between v8.0.0-beta1 and v8.3.0 should be upgraded as...

CVE-2026-64824-PoC

CVE-2026-64824 — Home Assistant Core Backup-Restore Symlink Path Traversal → RCE CVSS 8.4 Critical · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Authenticated admin attacker uploads a crafted backup tar. The restore path extracts the inner homeassistant.tar.gz with filter="fullytrusted" and only...

CVE-2026-75345

OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service...

CVE-2026-108158 plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

EUVD-2026-95906

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

CVE-2026-108158

The plugNmeet Server through 2.5.2 version is vulnerable to a path traversal vulnerability in the /api/whiteboard/convert endpoint. An authenticated meeting participant can provide crafted filePath values containing ../ sequences to force the server to convert arbitrary files into page images. Th...

EUVD-2026-95904

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

Security update for flatpak

This update for flatpak fixes the following issues: CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc1282514...

SUSE-SU-2026:4610-1 Security update for flatpak

This update for flatpak fixes the following issues: - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. - CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc128251...

CVE-2026-66493

Path Traversal in File Operations Delete / Copy / Move PhocaCommander ≤ 6.1.3 — Authenticated Admin Manipulates Files Outside Webroot SUMMARY The file action handler in PhocaCommander constructs source and destination paths from attacker-controlled base64-encoded parameters pathfrom, pathwhere...

CVE-2026-85706_docker_exp

1. Pull docker git clone https://github.com/FlowerWitch/CVE-2026-85706dockerexp docker compose up -d 2. Write LFI test information docker exec gitlab-vuln bash -c 'echo "SECRET-CANARY-85706-%%%" /tmp/canary.txt' 3. Read and verify Bypass method 1: .json suffix curl -s -w "\nHTTP %httpcode\n" -X...

CVE-2026-66492

Path Traversal in File Upload Destination PhocaCommander ≤ 6.1.3 — Authenticated Admin Writes Files Outside Webroot SUMMARY The file upload handler in PhocaCommander constructs the destination path from an attacker-controlled base64-encoded folder parameter without any path containment validation...