125720 matches found
BIT-RCLONE-2026-88046 rclone: source object names can escape the configured root on upload
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...
BIT-RCLONE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...
CVE-2026-93987: External Control of File Name or Path
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...
PT-2026-95876
Name of the Vulnerable Software and Affected Versions Gopeed versions prior to 2.0.0-beta.4 Description A path traversal issue exists during archive extraction, allowing attackers to write arbitrary files outside the intended extraction directory. This occurs when users download and extract...
CVE-2026-93992: Improper Limitation of a Pathname to a Restricted Directory
Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling...
CVE-2026-93988: Improper Limitation of a Pathname to a Restricted Directory
QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...
PT-2026-95839
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...
Linux Distros Unpatched Vulnerability : CVE-2026-85731
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can...
PT-2026-95824
Name of the Vulnerable Software and Affected Versions rclone versions 1.56.0 through 1.75.0 Description A path traversal issue exists in the rclone serve docker volume plugin. The newVolume function in cmd/serve/docker/volume.go calculates a volume mountpoint using the name variable from a Docker...
PT-2026-95843
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...
PT-2026-95872
Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description Authenticated back-office users can read arbitrary files due to a path traversal issue in the getEmailHTML action of the 'admin/ajax.php' endpoint. By providing relative path sequences in the email...
CVE-2026-93986: Improper Limitation of a Pathname to a Restricted Directory
rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...
PT-2026-95823
Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.1 Description The software fails to confine names from server and third-party listing responses to the listed directory. This allows path traversal sequences in object names, where attackers can craft special name...
CVE-2026-85272
Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...
CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation
Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...
CVE-2026-85272
CVE-2026-85272 affects Open edX Platform from Aspen.1 through the Ulmo and Verawood.1 releases. The root cause lies in openedx/core/lib/extract_archive.py, where the _is_bad_path function validates extracted archive targets using a string prefix comparison (startswith) instead of comparing indivi...
EUVD-2026-83399
Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...
CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation
Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...
CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation
Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...