CVE-2026-30952-PoC

CVE-2026-30952: LiquidJS Path Traversal PoC This repository contains a Proof of Concept PoC for CVE-2026-30952 , a high-severity path traversal vulnerability discovered in the liquidjs library versions 10.25.0. Authors & Researchers: Moriel Harush Maor Caplan Description The vulnerability allows...

POC-CVE-2026-1357

CVE-2026-1357 WPvivid Backup & Migration RCE PoC Discovered by: Lucas Montes NiRoX Vulnerability: Unauthenticated Arbitrary File Upload leading to Remote Code Execution RCE CVE ID: CVE-2026-1357 CVSS: Critical9.8 Status: Patched in version 0.9.124 Overview This repository contains the analysis an...

CVE-2026-91123 Discourse: Reject literal backslash path separators in iframe src traversal guard

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowediframes subpath check while browser...

CVE-2026-91123

The open-source discussion platform Discourse is vulnerable to an iframe src traversal issue in versions prior to 2026.1.8 , 2026.6.3 , 2026.7.2 , and 2026.8.0 . The root cause is that the iframe src traversal guard fails to treat literal backslashes as path separators following decoded dot segme...

CVE-2026-91123 Discourse: Reject literal backslash path separators in iframe src traversal guard

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowediframes subpath check while browser...

EUVD-2026-86300

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowediframes subpath check while browser...

CVE-2026-31802

CVE-2026-31802: tar Symlink Path Traversal / Arbitrary File Overwrite Research: Joshua van Rijswijk Description This repository contains my proof of concept and write-up for CVE-2026-31802 , a high-severity vulnerability in the npm tar package node-tar affecting versions = 7.5.10. I found that ta...

CVE-2026-29786

CVE-2026-29786 Research: Joshua van Rijswijk Description This repository contains a Proof of Concept PoC for CVE-2026-29786 , a vulnerability in the tar npm package that allows a crafted archive to create a hardlink pointing outside the intended extraction directory. The issue occurs when a tar...

CVE-2026-23745

CVE-2026-23745: node-tar Arbitrary File Overwrite Research: Joshua van Rijswijk Description PoC for CVE-2026-23745 , a high-severity path traversal vulnerability in node-tar 7.5.2. The library fails to sanitize absolute paths in the linkpath field for Hardlinks and Symlinks. This allows malicious...

apache-cve-2021-41773-lab

Apache 2.4.49 Path Traversal Lab — CVE-2021-41773 Clone root@kitploit: git clone https://github.com/zubairahm3d/apache-cve-2021-41773-lab.git cd apache-cve-2021-41773-lab chmod +x apachelab.sh Usage Start the vulnerable server: root@kitploit: ./apachelab.sh choose option 1 Manual exploit:...

CVE-2023-41474

IVANTI AVALANCHE - PATH TRAVERSAL A new vulnerability has been found on Ivanti Avalanche. Tested on Avalanche Server v6.3.4.153 and identified as CVE-2023-41474. It’s a limited unauthenticated path traversal vulnerability, meaning that unauthorized attackers can access to any file under C:\PROGRA...

CVE-2026-23491

CVE-2026-23491: InvoicePlane has Unauthenticated Path Traversal in Guest Controller Overview...

CVE-2026-23907

Apache PDFBox Path Traversal Vulnerability Vulnerability Summary Description Apache PDFBox's ExtractEmbeddedFiles example code does not sanitize filenames when extracting embedded files from PDFs. An attacker can embed files with path traversal sequences ../ to write files to arbitrary filesystem...

CVE-2026-97226

A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initia...

ESPOCRM-RCE-POC-CVE-2026-33656

EspoCRM = 9.3.3 CVE-2026-33656 — Authenticated RCE via Formula ACL Bypass + Attachment sourceId Path Traversal + .htaccess Poisoning Author : Jiva jivasecurity.com Writeup : https://jivasecurity.com/writeups/espocrm-rce-cve-2026-33656 Product : EspoCRM = 9.3.3 Auth : Admin credentials required...

CVE-2026-1107

CVE-2026-1107 Nuclei Template Nuclei template for detecting CVE-2026-1107 in EyouCMS. The vulnerability allows unauthenticated attackers to perform Path Traversal/Arbitrary File Read via the checkuserinfo function in Diyajax.php. Vulnerability Details CVE ID: CVE-2026-1107 Target: EyouCMS 1.7.1...

CVE-2021-41773

CVE-2021-41773 Apache2 2.4.49 - LFI & RCE Exploit Info root@kitploit: Exploit Title: Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution RCE Exploit Author: Gaurav Raj https://gauravraj.xyz https://blog.gauravraj.xyz Vendor Homepage: https://apache.org/ Version: 2.4.49 Tested on:...

Path-traversal-RCE-Apache-2.4.49-2.4.50-Exploit

Exploit for CVE-2021-41773 and CVE-2021-42013 Path traversal attack and RCE in Apache/2.4.49-2.4.50 Features - Take a list of urls - Works for both CGI and non-CGI - Works for Apache/2.4.49 - 2.4.50 Usage $ git clone https://github.com/CalfCrusher/Path-traversal-RCE-Apache-2.4.49-2.4.50-Exploit $...

CVE-2021-43798-Grafana-File-Read

Grafana-File-Read Grafana Unauthorized File Read Affected versions: 8.0.0-latest poc: /public/plugins/icon/../../../../../../../../../../../../../../../../../../etc/passwd root@kitploit: GET /public/plugins/icon/../../../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1 Host:...

CVE-2026-5027

🔥 CVE-2026-5027 - Langflow Path Traversal Arbitrary File Write to RCE Unauthenticated Remote Code Execution via File Upload -orange?style=for-the-badge 📌 Overview Langflow suffers from a critical path traversal vulnerability in the file upload endpoint POST /api/v2/files. An attacker can send a...