24 matches found
Open Redirect
Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Open Redirect via the sanitizeURI function in the trailing-slash middleware and static directory redirects. An attacker can request a path such as...
Open Redirect
Overview Affected versions of this package are vulnerable to Open Redirect via the sanitizeURI function in the trailing-slash middleware and static directory redirects. An attacker can request a path such as /%09/attacker.example/x/; when a redirect is generated, the decoded tab between the slash...
Open Redirect
Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Open Redirect via the sanitizeURI function in the trailing-slash middleware and static directory redirects. An attacker can request a path such as...
EUVD-2026-39800
Echo: Encoded slash %2F bypasses route-level protection and exposes static files...
CVE-2026-59149
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a...
PYSEC-2026-1552 Litestar and Starlite vulnerable to Path Traversal
Summary Local File Inclusion via Path Traversal in LiteStar Static File Serving A Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to...
Litestar and Starlite vulnerable to Path Traversal
SummaryLocal File Inclusion via Path Traversal in LiteStar Static File ServingA Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensiti...
PYSEC-2026-516 Ray Missing Authorization vulnerability
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here:...
Ray Missing Authorization vulnerability
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here:...
Directory Traversal
Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Directory Traversal via the StaticDirectoryHandler process. An attacker can gain unauthorized access to static files by sending requests with encoded slashes %2F i...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the StaticDirectoryHandler process. An attacker can gain unauthorized access to static files by sending requests with encoded slashes %2F in the URL, which bypasses route-level access controls due to inconsistent...
Directory Traversal
Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Directory Traversal via the StaticDirectoryHandler process. An attacker can gain unauthorized access to static files by sending requests with encoded slashes %2F i...
YARD static cache reads raw traversal paths before router sanitization
Summary YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static...
CVE-2026-25527
Changedetection.io versions prior to 0.53.2 are vulnerable to unauthenticated local file read via path traversal in the /static// route when group=".." is supplied, potentially exposing source files (e.g., flask_app.py). Root cause: send_from_directory("static/..", filename) can escape the app di...
Exploit for CVE-2025-54962
🔥 CVE-2025-54962 — Insecure File Upload in OpenPLC Runtime Web...
Safetytest Cloud-Master Server security vulnerabilities
Safetytest Cloud-Master Server is a cloud server from Safetytest, Inc. A security vulnerability exists in Safetytest Cloud-Master Server version 1.1.1 and earlier, which originates from the file /static/ that causes path traversal...
AI application scaling framework Python Ray Authentication Bypass File Read
The vulnerability of the AI application scaling framework and Python Ray is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to read arbitrary files from the /static/ directory using a specially crafted HTTP request...
GHSA-6CXR-8Q3M-JWRR Ray Missing Authorization vulnerability
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here:...
