WordPress Unlimited Elements for Elementor plugin < 2.0.21 - Authenticated Arbitrary File Write vulnerability

Authenticated Arbitrary File Write vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.21...

CVE-2026-85015 Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

CVE-2026-85015 Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

CVE-2026-85015

The Unlimited Elements for Elementor WordPress plugin (versions before 2.0.21 ) is vulnerable to an authenticated arbitrary file write via path traversal. The flaw exists because the plugin fails to sanitize file paths within uploaded archives before extraction. This allows authenticated users wi...

CVE-2026-73034-PoC

CVE-2026-73034 — DB-GPT v0.8.1 인증되지 않은 경로 탐색 → 임의 파일 쓰기 CVSS 9.8 치명적 · CWE-22 · GHSA/이슈 3104 요약 DB-GPT v0.8.1의 POST /api/v1/python/file/upload는 user-id HTTP 헤더를 받아 경로 구성 요소로 그대로 사용 합니다: uploaddir = os.path.joinbasedir, "pythonuploads", userid os.makedirsuploaddir, existok=True openfilepath, "wb"...

POC-CopyEscape-CVE-2026-17106

CopyEscape — CVE-2026-17106 PoC CopyEscapeCVE-2026-17106에 대한 교육용 개념 증명PoC입니다. docker cp의 TOCTOU 레이스 조건 취약점으로, 악성 컨테이너가 Docker 호스트에 임의의 파일을 쓸 수 있게 합니다. 이 취약점을 발견하고 "CopyEscape: Taking Over Docker Hosts with docker cp" 블로그에 문서화한 masasron 의 원래 연구에서 영감을 받았습니다. 목차 1. 요약 2. 법적 고지 3. 공격 체인 구조 4. 요구 사항 5...

CVE-2025-8110

Произвольная запись файлов в RCE в Gogs CVE-2025-8110 - Эксплойт для образовательных целей Этот репозиторий содержит скрипт доказательства концепции PoC на Python для демонстрации и анализа уязвимости, зарегистрированной как CVE-2025-8110 в самоуправляемом Git-сервисе Gogs версии 0.13.3 и ниже. ⚠️...

CVE-2026-5027

This post is a research article published by EQSTLab. Thanks toYahia Hamza, who reported and analyzed this vulnerability. CVE-2026-5027 ★ CVE-2026-5027 Langflow 경로 탐색 / 임의 파일 쓰기 PoC ★ Description CVE-2026-5027 : Langflow 임의 파일 쓰기 취약점 description: Langflow Reverse shell via cron job python3...

CVE-2026-85015: Improper Limitation of a Pathname to a Restricted Directory

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:4417-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4417-1 advisory. - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction...

cve-2025-59532-poc

Docker-среда для CVE-2025-59532 Docker-среда для исследования и анализа CVE-2025-59532 — уязвимости обхода каталога path traversal в OpenAI Codex CLI, которая позволяет записывать произвольные файлы за пределами предназначенной песочницы рабочего каталога. Часть курса CMU: 18-739 Hacking &...

CVE-2026-37068

CVE-2026-37068 Veno File Manager Project 4.4.9의 /vfm-admin/index.php?section=translations&action=update에서 발생하는 임의 파일 쓰기 취약점으로, 슈퍼 관리자 역할을 가진 인증된 사용자가 영향을 받는 엔드포인트에 특수하게 조작된 POST 요청을 통해 애플리케이션 내의 모든 php 파일을 덮어쓸 수 있습니다...

Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

Affected files dulwich/index.py Methods: validatepathelementntfs, treetofspath dulwich/porcelain/init.py Method: checkedworktreepath Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible for...

GHSA-8MCX-5RQC-VHMF Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

Affected files dulwich/index.py Methods: validatepathelementntfs, treetofspath dulwich/porcelain/init.py Method: checkedworktreepath Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible for...

GHSA-8W8G-WQ8H-FQ33 Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

Summary Dulwich's porcelain.checkoutpaths=... code path writes files using raw os.openfilepath, OWRONLY|OCREAT|OTRUNC, mode followed by f.writeobj.data. This code path does NOT call buildfilefromblob at all, completely bypassing any symlink protections including the unreleased d09f8af fix. os.ope...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the paths= branch of porcelain.checkout in dulwich, which wrote file content using a raw os.openfilepath, OWRONLY|OCREAT|OTRUNC call that follows existing symlinks at the target path. An attacker...

Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

Summary Dulwich's stash.py:pop function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The pop function at dulwich/stash.py:236 uses os.path.existsparentdi...

GHSA-CM62-GVXX-VMXX Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

Summary Dulwich's stash.py:pop function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The pop function at dulwich/stash.py:236 uses os.path.existsparentdi...

CVE-2026-17106

CVE-2026-17106 — CopyEscape:docker cp 컨테이너에서 호스트로의 임의 파일 쓰기 HackSpeak 배포 이미지입니다. 이 저장소는 Imperva 레드팀Ron Masas이 공개한 CopyEscape PoCCVE-2026-17106의 배포 이미지 이며, 코드는 업스트림과 일치합니다. 업스트림에 LICENSE가 포함되어 있지 않아 배포 관례에 따라 MIT License, Copyright c 2026 HackSpeak 를 적용하며, 소스 코드의 저작권은 원저작자에게 있습니다. ⚠️ 보안 연구 및 승인된 테스...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — TECNO Hi Browser 다운로드 처리기의 경로 탐색Path Traversal CVE-2026-18907CVSS 7.5 High, CWE-23에 대한 개념 증명PoC으로, TECNO Hi Browsercom.talpa.hibrowser 버전 2.23.1.1 의 다운로드 파일 기능 에 존재하는 상대 경로 탐색 취약점입니다. 이 브라우저는 공격자가 제어하는 Content-Disposition 파일명을 신뢰하여, 경로 구분자를 정화하거나 결과의 정규 경로를 검사하지 않고 다운로드 디렉터리에 그대로...