CVE-2026-73034 DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

CVE-2026-73034

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

CVE-2026-73034 DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

EUVD-2026-56925

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

CVE-2026-73034

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

CVE-2026-73034

DB-GPT v0.8.1 is affected by an unauthenticated path traversal flaw in the Python file-upload endpoint. By manipulating the user_id HTTP header with directory traversal sequences, an attacker can write arbitrary files to locations outside the intended upload directory (e.g., Python startup hooks,...

CVE-2026-48813

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-48813 Flawfinder output manipulation via untrusted filenames and source text

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-48813

Vulnerability summary (CVE-2026-48813) : Flawfinder (C/C++ static analysis tool) versions prior to 2.0.20 are affected by improper input neutralization causing output manipulation. Specifically, untrusted inputs (filenames, categories, code context) can introduce Terminal/ANSI Escape Sequence Inj...

CVE-2026-48813

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-48813 Flawfinder output manipulation via untrusted filenames and source text

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

EUVD-2026-56901

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-48813 Flawfinder output manipulation via untrusted filenames and source text

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

Security Bulletin: IBM Watsonx BI Assistant for CP4D affected by multiple CVEs

Summary Multiple CVE's were addressed in IBM Watsonx BI Assistant for CP4D version 5.4 patch 4 Vulnerability Details CVEID:CVE-2026-44665 DESCRIPTION: fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.17 Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C ...

CVE-2026-72713

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the filename form field with no path containment check. Attackers can register an...

CVE-2026-72713

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the "filename" form field with no path containment check. Attackers can register an...

EUVD-2026-56851

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the filename form field with no path containment check. Attackers can register an...

CVE-2026-72713

XAgent exposes a path traversal vulnerability in the /workspace/file endpoint. Authenticated-like access is not required since self-registered or default-credential users can craft file_name traversal sequences to read host files outside the Docker sandbox, including secrets and system files. The...

CVE-2026-72713 XAgent Path Traversal Arbitrary File Read via /workspace/file

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the filename form field with no path containment check. Attackers can register an...