110319 matches found
CVE-2026-71805
An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...
PT-2026-89000
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and...
CVE-2026-71805
An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...
Amazon Linux 2 : 389-ds-base (ALAS-2026-3909)
The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3909 advisory. A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL...
PT-2026-89129
A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...
CVE-2026-87030: Improper Limitation of a Pathname to a Restricted Directory
Tanium addressed a path traversal vulnerability in Comply...
PT-2026-89191
Summary In a process run with full administrative rights on Windows, gix-sec wrongly treats all locations as trusted, leading to the execution of commands configured in repositories controlled by limited user accounts. Details In a similar way to Git, gitoxide tries to avoid operating in local...
PT-2026-89262
Name of the Vulnerable Software and Affected Versions Direct Download for WooCommerce versions prior to 1.20 Description A Directory Traversal issue exists in the top-level include function. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitiv...
PT-2026-89266
Name of the Vulnerable Software and Affected Versions WP BackItUp Community Edition versions prior to 2.1.1 Description An issue exists where authenticated attackers with administrator-level access and above can perform Directory Traversal, a technique used to access files and directories that ar...
CVE-2026-73787: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...
PT-2026-89212
Name of the Vulnerable Software and Affected Versions Joker versions prior to 1.8.2 Description When using the joker --lint command, the software searches for a .jokerd/ directory by traversing upwards from the target file and executes any matching linter. files found within that directory. Since...
SUSE CVE-2026-76560
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...
EUVD-2026-74295
The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...
GHSA-2Q42-4Q24-7RGV OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree
Summary The @typespec/openapi3 emitter retains the value of a @versioned enum member and interpolates it into the output filename as version without sanitizing path separators or traversal components. The completed path reaches the compiler's emitFile, which creates the parent directory and write...
EUVD-2026-69612
Hono: Incomplete fix for CVE-2026-39408: toSSG still writes files outside the output directory...
Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
Summary The fix released for CVE-2026-39408 does not cover every traversal sequence. toSSG can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Details Static site generation builds each output path from the route pat...
NPM: Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
NPM: Hono: Incomplete fix for CVE-2026-39408: toSSG still writes files outside the output directory vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...
GHSA-GQVV-2MRQ-WPJV Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
Summary The fix released for CVE-2026-39408 does not cover every traversal sequence. toSSG can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Details Static site generation builds each output path from the route pat...
GHSA-C7R6-VX3H-W5G2 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Summary Excel::store resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with fopen, bypassing the disk entirely. An application that passes a...