CVE-2026-87023: Improper Limitation of a Pathname to a Restricted Directory

Tanium addressed a path traversal vulnerability in Comply...

PT-2026-88773

Tanium addressed a path traversal vulnerability in Comply...

PT-2026-88837

Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege...

PT-2026-88826

Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege...

PT-2026-88882

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...

PT-2026-88953

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2 Description An authenticated administrator can exploit a path traversal issue via the '/api/riff/removeRiffDeck' endpoint. The system fails to properly validate the deckID parameter, allowing the use of path...

PT-2026-89044

🚨 CVE-2026-86775 knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not...

PT-2026-89266

Name of the Vulnerable Software and Affected Versions WP BackItUp Community Edition versions prior to 2.1.1 Description An issue exists where authenticated attackers with administrator-level access and above can perform Directory Traversal, a technique used to access files and directories that ar...

PT-2026-89000

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and...

CVE-2026-86099: Improper Limitation of a Pathname to a Restricted Directory

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and...

PT-2026-88939

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this...

CVE-2026-71805

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...

PT-2026-88771

Tanium addressed a path traversal vulnerability in Comply...

CVE-2026-71805

A critical arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0 . Unauthenticated remote attackers can exploit the directory parameter in the POST /app-api/infra/file/upload endpoint to upload arbitrary files and write them outside the intended storage directory. Explo...

PT-2026-89157

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

PT-2026-89180

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

CVE-2026-71805

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...

CVE-2026-14505: Improper Limitation of a Pathname to a Restricted Directory

Tanium addressed a path traversal vulnerability in Tanium Data Service...

CVE-2026-87030: Improper Limitation of a Pathname to a Restricted Directory

Tanium addressed a path traversal vulnerability in Comply...

CVE-2026-87815: External Control of File Name or Path

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory...