134874 matches found
CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...
CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...
EUVD-2026-70061
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...
CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...
CVE-2026-78599 Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...
CVE-2026-78599 Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...
CVE-2026-78599
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...
EUVD-2026-70060
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...
CVE-2026-78599
Kibana Fleet feature is affected by a stored path traversal (CWE-22) that allows a low-privileged user with Fleet write access to cause a subsequent administrative delete action to act on unintended internal resources, resulting in availability impact . Affected versions are 8.0.0–8.19.17 and 9.0...
CVE-2026-78599 Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...
EUVD-2026-70055
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Elastic Maps Server can lead to information disclosure via Path Traversal CAPEC-126. An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside...
CVE-2026-78602
Elastic Maps Server is affected by a path traversal (CWE-22) vulnerability that allows an unauthenticated network attacker to read files outside the server's intended content directory, resulting in information disclosure . The vulnerable versions are 8.19.11 through 8.19.18 , 9.3.0 through 9.4.3...
CVE-2026-78602 Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Elastic Maps Server can lead to information disclosure via Path Traversal CAPEC-126. An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside...
CVE-2026-78602 Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Elastic Maps Server can lead to information disclosure via Path Traversal CAPEC-126. An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside...
Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root
Summary DirectoryPromptRegistry.set interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory. Details...
GHSA-X8WG-4XGC-VR54 Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root
Summary DirectoryPromptRegistry.set interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory. Details...
EUVD-2026-63414
Banks: Path traversal in DirectoryPromptRegistry.set allows arbitrary file write outside the registry root...
EUVD-2026-68816
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
Summary The virtual store linker constructs package installation directories using path.joinmodules, pkgName where pkgName is extracted from lockfile packages keys via dp.parsedepPath.name without validation. A crafted pnpm-lock.yaml with traversal sequences in depPath keys e.g.,...
NPM: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
NPM: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.5...