CVE-2026-88940 knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further...

CVE-2026-88940 knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further...

CVE-2026-88940

knowns through version 0.33.0 fails to validate the path query parameter in the workspace browse endpoint , allowing remote, unauthenticated attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identi...

EUVD-2026-75583

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further...

EUVD-2026-75580

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal...

CVE-2026-88899 knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

CVE-2026-88899

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. This allows remote, unauthenticated attackers to supply arbitrary directory paths, enabling file operations outside the project root on the host system. The vulnera...

CVE-2026-88899 knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

EUVD-2026-75579

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

CVE-2026-88899

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

CVE-2026-88899 knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...

buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerability

A flaw was found in BuildKit. A custom client with valid permissions to access the BuildKit control API can produce an upload request that allows files to escape from the BuildKit-controlled state directory. This could lead to unauthorized modification or disclosure of sensitive data...

vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user...

Directory Traversal

Spring Framework is vulnerable to Directory Traversal. The vulnerability is due to improper validation of untrusted view names when using SpringTemplateLoader for FreeMarker template resolution, which allows an attacker to manipulate the view name and access files outside the intended template...

CVE-2026-78085

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

CVE-2026-78085

SP Property is a Joomla extension published by joomshaper.com. A path traversal vulnerability exists in the gallery image management controller, which lacked directory confinement checks, allowing unauthenticated remote attackers to traverse directories. The vulnerability affects versions below 4...

CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...