133882 matches found
EUVD-2026-69706
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path...
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Summary Excel::store resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with fopen, bypassing the disk entirely. An application that passes a...
CVE-2026-78624
The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...
EUVD-2026-74178
The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...
CVE-2026-77110
Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the...
GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
CWE: CWE-73 External Control of File Name or Path / CWE-22 Path Traversal, in the "escapes intended base directory" sense - Affected component: git/repo/base.py, Repo.unsafegitcloneoptions class attribute, lines 153-165 and Repo.clone lines 1477-1520, reached via the public Repo.clonefrom line...
GHSA-8MCC-HRX5-HVXC GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
CWE: CWE-73 External Control of File Name or Path / CWE-22 Path Traversal, in the "escapes intended base directory" sense - Affected component: git/repo/base.py, Repo.unsafegitcloneoptions class attribute, lines 153-165 and Repo.clone lines 1477-1520, reached via the public Repo.clonefrom line...
CVE-2026-66302
CVE-2026-66302 is a CRITICAL vulnerability (CVSS 9.8) in Skype for Business Server caused by external control of file name or path , allowing an unauthorized attacker to achieve remote code execution over the network with no privileges or user interaction. Affected products include Skype for Busi...
CVE-2026-81377
Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to perform tampering over a network...
CVE-2026-81377
Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to perform tampering over a network...
CVE-2026-79904
Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intende...
CVE-2026-78461
Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-78461
Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-77897
Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally...
CVE-2026-72948
Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally...
CVE-2026-69807
Improper limitation of a pathname to a restricted directory 'path traversal' in Windows PowerShell allows an authorized attacker to elevate privileges over a network...
CVE-2026-69612
Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally...
CVE-2026-69445
Improper limitation of a pathname to a restricted directory 'path traversal' in Windows Compressed Folder allows an authorized attacker to elevate privileges locally...