acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

Important: Red Hat Security Advisory: acl security update

An update for acl is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

Exploit for CVE-2026-85706

CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read...

CVE-2026-91200: Improper Limitation of a Pathname to a Restricted Directory

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

CVE-2026-86886: Improper Limitation of a Pathname to a Restricted Directory

A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files...

CVE-2026-84598: Improper Limitation of a Pathname to a Restricted Directory

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...

CVE-2026-84568: Improper Limitation of a Pathname to a Restricted Directory

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges...

CVE-2026-84541: Improper Limitation of a Pathname to a Restricted Directory

An input validation issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An application may be able to access restricted files...

CVE-2026-50006: Improper Limitation of a Pathname to a Restricted Directory

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...

CVE-2026-47253: Improper Limitation of a Pathname to a Restricted Directory

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clearplugincacheplugin SQL scalar function in namespace/otherfunctions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token...

CVE-2026-16335: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability...

CVE-2026-89021: Improper Link Resolution Before File Access

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...

CVE-2026-82035: Improper Limitation of a Pathname to a Restricted Directory

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...

CVE-2026-55846: Improper Limitation of a Pathname to a Restricted Directory

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath in Commands.setUpServer in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the...

CVE-2026-54178: Improper Limitation of a Pathname to a Restricted Directory

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts...

CVE-2026-54150: Improper Limitation of a Pathname to a Restricted Directory

next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted at /api/video accepts an unauthenticated url query parameter, while src/utils/utils.ts isRemote treats any value without an HTTP or HTTPS...

CVE-2026-47256: Improper Limitation of a Pathname to a Restricted Directory

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

CVE-2026-34151: Path Traversal: '../filedir'

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

CVE-2026-76440: Relative Path Traversal

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple...