133882 matches found
NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
Summary Several corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in open rather than nltk.pathsec.open. Details - Vulnerability type: Path travers...
NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely
Summary IPIPANCorpusReader nltk/corpus/reader/ipipan.py exposes public methods, channels, domains, categories, and fileidschannels=..., that accept a caller supplied fileids list and read a file via a completely unprotected builtin open call, with no nltk.pathsec involvement at all. A symlink...
GHSA-3HHW-38PF-PXJ6 NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely
Summary IPIPANCorpusReader nltk/corpus/reader/ipipan.py exposes public methods, channels, domains, categories, and fileidschannels=..., that accept a caller supplied fileids list and read a file via a completely unprotected builtin open call, with no nltk.pathsec involvement at all. A symlink...
GHSA-F833-7JW8-XWRV NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)
This is a new, distinct vulnerability: a bypass of the fix already published as GHSA-xh95-f55m-82fw "Path traversal in NLTK FramenetCorpusReader.frame allows arbitrary XML file read, bypassing the nltk.pathsec sandbox", not a duplicate of it. Summary The original advisory was fixed PR 3581 by...
NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)
This is a new, distinct vulnerability: a bypass of the fix already published as GHSA-xh95-f55m-82fw "Path traversal in NLTK FramenetCorpusReader.frame allows arbitrary XML file read, bypassing the nltk.pathsec sandbox", not a duplicate of it. Summary The original advisory was fixed PR 3581 by...
EUVD-2026-64337
NLTK: Stable FrameNet and NKJP readers parse outside-root XML...
NLTK: Stable FrameNet and NKJP readers parse outside-root XML
Summary Published nltk==3.9.4 still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary. Details - Vulnerability type: Path traversal and trusted-root bypass - Affected componen...
GHSA-568F-PV23-39P4 NLTK: Stable FrameNet and NKJP readers parse outside-root XML
Summary Published nltk==3.9.4 still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary. Details - Vulnerability type: Path traversal and trusted-root bypass - Affected componen...
Exploit for CVE-2026-74239
CVE-2026-74239 XenForo before 2.3.13 is vulnerable to path tr...
Security update for multipath-tools
This update for multipath-tools fixes the following issues: Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. Path traversal in device-mapper-multipath failedwwids management bsc1277210. SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows bsc127721...
SUSE-SU-2026:4093-1 Security update for multipath-tools
This update for multipath-tools fixes the following issues: - Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. - Path traversal in device-mapper-multipath failedwwids management bsc1277210. - SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows...
Security Bulletin: Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation
Summary Langflow uses a local and S3-backed storage service to manage files uploaded by users and referenced by flow components. The flow execution runtime accepts attacker-controlled file paths through the tweaks API without invoking the path containment guard, allowing traversal sequences to...
Security Bulletin: A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem
Summary A path traversal vulnerability existed in two independent file handling mechanisms used by the product's workflow execution and file management capabilities. The file upload endpoint accepted multipart filenames directly from HTTP request metadata without sanitization, allowing an...
python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination
A flaw was found in the Python tarfile module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX Portable Operating System Interface platforms. This occurs when processing a specially crafted archive containing member names...
NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
Summary nltk.corpus.reader.api.CorpusReader.open can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and .. traversal, the current boundary check is only lexical and does not account for symlink resolution. This lea...
GHSA-R6GQ-WHWQ-MVG9 NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
Summary nltk.corpus.reader.api.CorpusReader.open can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and .. traversal, the current boundary check is only lexical and does not account for symlink resolution. This lea...
python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination
A flaw was found in the Python tarfile module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX Portable Operating System Interface platforms. This occurs when processing a specially crafted archive containing member names...
Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring
Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 2.7.43 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...
python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination
A flaw was found in the Python tarfile module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX Portable Operating System Interface platforms. This occurs when processing a specially crafted archive containing member names...
python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination
A flaw was found in the Python tarfile module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX Portable Operating System Interface platforms. This occurs when processing a specially crafted archive containing member names...