PT-2026-91225

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

PT-2026-91199

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk...

PT-2026-91208

Name of the Vulnerable Software and Affected Versions LaraDashboard versions 0.9.2 through 1.2.2 Description A path traversal issue exists in the core-upgrade backup handling. The CoreUpgradeController and BackupService specifically the deleteBackup function concatenate the user-supplied backup...

CVE-2023-40772

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component...

PT-2026-91423

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A path traversal issue allows a remote authenticated attacker to read, write, or delete arbitrary files. Path traversal is a flaw that allows an attacker to access files and...

PT-2026-91398

Name of the Vulnerable Software and Affected Versions PyMuPDF versions prior to 1.28.3 Description A path traversal issue exists in the extract objects function within src/ main .py. The software constructs output filenames by joining a document-controlled BaseFont name to a user-supplied output...

PT-2026-91441

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the confluence upload attachment and confluence upload attachments tools pass a client-controlled file path through src/mcp atlassian/confluence/attachments.py upload attachment, and...

Low: mount-s3

Issue Overview: libgit2 Submodule path traversal CVE-2026-53584 Affected Packages: mount-s3 Issue Correction: Run dnf update mount-s3 --releasever 2023.12.20260914 or dnf update --advisory ALAS2023-2026-2137 --releasever 2023.12.20260914 to update your system. More information on how to update yo...

Medium: composer

Issue Overview: Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the permissions of a file outside that package's own directory and to register a...

PT-2026-91625

Name of the Vulnerable Software and Affected Versions macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 Description A path traversal issue exists where an attacker controlling a network directory server can bypass path validation to...

PT-2026-91401

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 7.24.2 Description A path traversal issue exists in the container package OCI/tar image extraction. This allows attackers to write files outside the container root by providing a crafted container image...

PT-2026-91844

It was discovered that cgit incorrectly handled repository paths when HTTP cloning was enabled. A remote attacker could possibly use this issue to access files outside the repository and obtain sensitive information...

PT-2026-91052

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component...

PT-2026-91109

A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManager of the file hexstrike server.py of the component API Files Endpoint. The manipulation of the argument filename leads to path...

PT-2026-91167

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its...

PT-2026-91292

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions includin...

PT-2026-91266

Name of the Vulnerable Software and Affected Versions Cisco Secure Email Gateway versions 15.5 and earlier Cisco Secure Email and Web Manager versions 15.5 and earlier Description Multiple path traversal issues exist within the software. Path traversal is a flaw that allows an attacker to access...

PT-2026-91742

Name of the Vulnerable Software and Affected Versions ZFile versions prior to 5.0.6 Description The download endpoint fails to validate requested file paths against the allowed entries of a share link. This allows an attacker with a valid share link to provide arbitrary file paths as query...

PT-2026-91648

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...

PT-2026-91687

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.7 iPadOS versions prior to 26.7 iOS versions prior to 27 iPadOS versions prior to 27 watchOS versions prior to 27 Description A path traversal issue exists due to insufficient input validation. This flaw allows an...