CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

CVE-2026-79306

CyberPanel v1.9.1 is vulnerable to a path traversal vulnerability in the compress method via the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can provide absolute or out-of-scope file paths in the listOfFiles JSON property, along with ...

CVE-2025-57231

CVE-2025-57231 - Docmost 0.22.0 - 任意ファイル読み取り このリポジトリには、CVE-2025-57231 の概念実証PoCエクスプロイトが含まれています。 免責事項 このプロジェクトは教育目的および許可されたセキュリティテストのみを目的として提供されています。所有していないシステム、またはテストの許可を得ていないシステムに対して使用しないでください。 概要 Docmost のディレクトリトラバーサル脆弱性により、バージョン 0.2.1 から 0.21.0 までの任意ファイル読み取りが可能です。アプリケーションの...

CVE-2001-0680

CVE-2001-0680 QPC QVT/Net 4.0 および AVT/Term 5.0 の ftpd におけるディレクトリトラバーサルの脆弱性 Packetstorm 公開情報: https://packetstormsecurity.com/files/24931/alt3kx-advisories-2001.txt.html Securiteam 公開情報: http://www.securiteam.com/windowsntfocus/5IP0G2040Q.html 作者 Alex Hernandez 別名 @alt3kx...

CVE-2025-9345

Managefy 製 File Manager、Code Editor、および Backup におけるパストラバーサルの概念実証 脆弱性タイプ: パストラバーサル（任意のファイルダウンロード） 影響を受ける関数: ajaxdownloadfile 影響: 低権限の認証済みユーザー（Subscriber 以上）は、flmfile パラメータの検証不足を悪用して、機密設定ファイルを含むサーバー上の任意のファイルをダウンロードできます。 CVSS v3.1 スコア: 6.5 中 ベクター: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 説明 GET リクエストの...

PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core

On September 22, 2026, the WordPress Security Team released WordPress 7.1.2, as well as security backports for every branch back to WordPress 4.7 to address a critical unauthenticated path traversal vulnerability. The issue is tracked as CVE-2026-87902 and has a CVSS v4.0 score of 9.2 Critical. T...

CVE-2026-18133

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: ページテンプレート解決における未認証パストラバーサル WordPress Core における未認証のローカル PHP ファイルインクルード。二重エンコードされた pagename 値を通じて発生し、特定のデプロイ条件下では Web サーバーアカウントの権限で PHP コードが実行される。...

CVE-2026-18133

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a path traversal flaw (CWE-22 ). This vulnerability could allow a remote authenticated attacker to modify server files. The affected versions include 4.0.6.0 through 4.0.10.0 (specifically 4.0.6.0 iFix6, 4.0.6.0 iFix6 R...

CVE-2026-18133 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

Exploit for CVE-2026-87902

CVE-2026-87902 — PoC Unauthenticated remote code execution...

CVE-2021-33558

CVE-2021-33558 参照: https://www.cvedetails.com/cve/CVE-2021-33558 Shodan dork: product:"Boa Web Server" 0.94.13 ペイロード: root@kitploit: /backup.html /preview.html /js/log.js /log.html /email.html /online-users.html /config.js POC:...

CVE-2023-2825-Gitlab

CVE-2023-2825 2023年5月23日，GitLab 发布了版本 16.0.1，修复了一个影响社区版 CE 和企业版 EE 16.0.0 的严重漏洞 CVE-2023-2825。该漏洞允许未经身份验证的用户通过路径遍历缺陷读取任意文件。该漏洞由 pwnie 通过 HackerOne 的漏洞赏金计划发现。 截至撰写本文时，尚无公开的概念验证可用。 GitLab 安全公告...

GHSA-9VM9-PQXX-X83V KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

Description KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components,...

EUVD-2026-84005

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join...

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

Description KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components,...

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...

MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)

Summary mcp-atlassian exposes an MCP tool confluenceuploadattachment whose filepath argument is passed directly to openfilepath, "rb" without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart uploa...

MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

Summary The upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The uploadattachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validatesafepath...

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

Summary The uploadattachment functions in both the Jira and Confluence modules accept a user-controlled filepath parameter and open the specified file for reading without calling validatesafepath. An authenticated MCP client can supply an arbitrary path such as /etc/passwd or /proc/self/environ,...