CVE-2026-12339

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on t...

CVE-2026-12339 Authenticated Arbitrary File Write Vulnerability in multiple devices

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on t...

CVE-2026-12339

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on t...

EUVD-2026-55700

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on t...

CVE-2026-12339

Technical details are not publicly available in the provided documents for CVE-2026-12339. No vendor-confirmed impact, affected products, or remediation are specified here. Monitor for updates and refer to the CVE entry for official details.

CVE-2026-49007

creationtimestamp| type| source ---|---|--- 2026-08-10 17:59:21+00:00| seen| https://gist.github.com/digitalgangst4r/e56a1a1494c1ac4d81a87fddc57a712a...

EUVD-2026-55652

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...

CVE-2026-72567

The CVE-2026-72567 entry concerns AsyncFuncAI/deepwiki-open. A path traversal flaw arises from improper validation in the wiki-cache API endpoint (api/api.py) which builds file paths from user-controlled owner, repo, and repo_type fields, allowing unauthenticated remote actors to write to or dele...

PT-2026-69945

Name of the Vulnerable Software and Affected Versions unearth versions prior to 0.18.2 Description A path traversal issue exists in the is within directory function, which fails to normalize paths before validation. This allows ../ sequences to bypass directory containment checks. An attacker can...

CVE-2026-48047

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

CVE-2026-48047

Affected component: XWiki Platform WebJars API (org.xwiki.platform:xwiki-platform-webjars-api). Vulnerability: Path traversal that can let an attacker write arbitrary files (e.g., configuration files or superadmin password) after installing a malicious WebJar extension and publishing it to a conf...

CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

UBUNTU-CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

CVE-2026-54208 TeamDavid: Arbitrary File Write leading to Stored XSS

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...