EUVD-2026-87315

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

NPM: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

NPM: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools vulnerability discovered by ? in WordPress Npm knowns versions = 0.29.1...

EUVD-2026-72555

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools...

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

Overview Verified. Multiple Unrestricted Path Traversal vulnerabilities exist in the Knowns MCP docs and memory tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions Get, Create, Update, Rename, Delete in both docstore.go and...

CVE-2026-63006

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-48482

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...

CVE-2026-48482

The GLPI asset and IT management software (versions 11.0.0 through 11.0.8 ) is vulnerable to a path traversal flaw during the Form import process. A form administrator can use a crafted illustration or scene identifier to traverse outside the intended custom-asset directory. This allows an attack...

CVE-2026-48482 GLPI: RCE via Form import

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...

CVE-2026-48482 GLPI: RCE via Form import

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...

CVE-2026-48482 GLPI: RCE via Form import

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...

CVE-2026-63006

Prior to version 7.1.2 , the Zammad helpdesk system is vulnerable to a security bypass where attacker-controlled HTML in inbound emails or tickets can circumvent the image URL sanitizer . By using path traversal sequences , an attacker can cause the browser to resolve a URL to a protected API end...

CVE-2026-63006 Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

EUVD-2026-87270

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-63006 Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-63006 Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...

CVE-2026-61525

Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to...

EUVD-2026-87222

Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to...

CVE-2026-61525

The Zammad helpdesk system versions 7.0.2 and 7.1.0 are vulnerable to a path traversal attack within the session management for websocket and long-polling connections. The root cause is the insufficient validation of client-supplied session identifiers before they are used to construct internal f...

CVE-2026-61525 Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller

Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to...

CVE-2026-61525 Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller

Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to...