PT-2026-89494

Warning: A critical path traversal vulnerability in Plesk Backup Manager allows arbitrary root file writes by authenticated customers. CVE-2026-68487 CVSS3.0: 9.9. Read the advisory https://t.co/GniZ2f5Oox and Patch Patch Patch...

CVE-2026-68487: Absolute Path Traversal

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...

PT-2026-89599

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description An authenticated user can send a specially crafted request to write arbitrary files on the system. Recommendations At the moment, there is no information...

CVE-2026-49836: Improper Limitation of a Pathname to a Restricted Directory

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

PT-2026-89725

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with pat...

CVE-2026-76652: Improper Limitation of a Pathname to a Restricted Directory

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality cou...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : SPICE vdagent vulnerabilities (USN-8723-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8723-1 advisory. It was discovered that SPICE vdagent had an integer overflow in the buffer size...

CVE-2026-71805

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...

CVE-2026-88069 Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

CVE-2026-73787 Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-73787 Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-73787

HPE CPPM (Campus Policy Manager) contains a vulnerability in its web interface that allows an authenticated remote attacker to access directory information on the system, which can escalate to arbitrary command execution on the underlying operating system via an arbitrary file write mechanism (as...

CVE-2026-86775

knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...

CVE-2026-86775 knowns before 0.30.0 Path Traversal via Document API

knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...

CVE-2026-86775 knowns before 0.30.0 Path Traversal via Document API

knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...

CVE-2026-86775

CVE-2026-86775 affects the knowns npm package (versions ≤ 0.29.1) with a path traversal vulnerability in the Document API. The root cause lies in cleanDocPath() in internal/server/routes/docs.go, which strips leading/trailing slashes and the .md suffix but fails to neutralize ../ sequences, and i...

CVE-2026-86775 knowns before 0.30.0 Path Traversal via Document API

knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...

RUSTSEC-2026-0297 `unzip`: archive extraction is vulnerable to path traversal (zip-slip)

Summary Unzipper::unzip extracts each archive entry to a path built from the entry's raw, attacker-controlled name without any traversal check. A ZIP archive whose entry names contain ../ components or an absolute path can therefore cause files to be written outside the destination directory chos...

`unzip`: archive extraction is vulnerable to path traversal (zip-slip)

Summary Unzipper::unzip extracts each archive entry to a path built from the entry's raw, attacker-controlled name without any traversal check. A ZIP archive whose entry names contain ../ components or an absolute path can therefore cause files to be written outside the destination directory chos...