134450 matches found
Kibana 8.x < 8.19.18 / 9.x < 9.4.3 Path Traversal (ESA-2026-157)
The version of Kibana installed on the remote host is 8.x prior to 8.19.18, or 9.x prior to 9.4.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-157 advisory. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet...
RHEL 9 : glib2 (RHSA-2026:65770)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65770 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...
CVE-2026-87766: Improper Link Resolution Before File Access
A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is...
PT-2026-89194
Name of the Vulnerable Software and Affected Versions eKuiper versions prior to 2.4.1 Description A path traversal issue in administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. In the...
CVE-2026-71805
An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...
CVE-2026-87023: Improper Limitation of a Pathname to a Restricted Directory
Tanium addressed a path traversal vulnerability in Comply...
PT-2026-96198
Summary Unzipper::unzip extracts each archive entry to a path built from the entry's raw, attacker-controlled name without any traversal check. A ZIP archive whose entry names contain ../ components or an absolute path can therefore cause files to be written outside the destination directory chos...
CVE-2026-71805
An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...
PT-2026-89180
Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...
CVE-2026-86775: Improper Limitation of a Pathname to a Restricted Directory
knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...
CVE-2026-21103: Path Traversal: '.../...//'
Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege...
CVE-2026-15913: Relative Path Traversal
In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...
CVE-2026-21092: Path Traversal: '.../...//'
Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege...
PT-2026-88764
Tanium addressed a path traversal vulnerability in Tanium Data Service...
PT-2026-88882
The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...
CVE-2026-79728: Relative Path Traversal
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker...
PT-2026-89157
In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...
CVE-2026-87927: Improper Control of Filename for Include/Require Statement in PHP Program
MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...
PT-2026-88939
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this...
CVE-2026-87815: External Control of File Name or Path
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory...