CVE-2026-81847 MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal

A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function savepipeline/loadpipeline of the file pipelinetools.py. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit has been made public and coul...

CVE-2026-81847 MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal

A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function savepipeline/loadpipeline of the file pipelinetools.py. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit has been made public and coul...

CVE-2026-81847

MAA-AI MaaMCP versions up to 1.1.1.dev6+g2e4a41287 are affected by a path traversal vulnerability in the save_pipeline/load_pipeline functions of pipeline_tools.py . The flaw allows a remote attacker with low privileges and user interaction to manipulate file paths, potentially reading or writing...

CVE-2026-81847 MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal

A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function savepipeline/loadpipeline of the file pipelinetools.py. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit has been made public and coul...

CVE-2026-81845

A path traversal vulnerability in arben-adm mcp-sequential-thinking (up to version 0.5.0) affects the import_session/export_session functions in mcp_sequential_thinking/server.py. Manipulating the file_path argument allows an attacker to access files outside the intended directory. The attack can...

CVE-2026-81845

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

CVE-2026-81845 arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

CVE-2026-81845 arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

CVE-2026-81845 arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

CVE-2026-81837 RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-81837 RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-81837

A path traversal vulnerability affects RooCodeInc Roo-Code versions up to 3.51.1 , specifically in the path.resolve function within src/core/tools/ApplyPatchTool.ts . The flaw allows remote exploitation with low complexity and no required privileges, though user interaction is needed. A proof-of-...

CVE-2026-81837

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-81838

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

CVE-2026-81730

Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it ...

CVE-2026-76639

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored wi...

CVE-2026-59294

ResourceCacheService.getCacheName builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new FileresourceParentFolder, newFileName before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 -...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54687

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the dbpath database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to dbpa...

CVE-2026-37066

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests POST and GET to the...