CVE-2026-64836 ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

CVE-2026-64836

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint. The root cause is a logic error in the File::check() validation function, which compares realpath() to boolean true—a condition that never succeeds, effectively disabling the document-root confineme...

CVE-2026-64836 ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

CVE-2026-9166

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...

RamziRange3

🕶️ RamziRange9 A deliberately vulnerable web application bui...

CVE-2026-9166 LFI in GIS Informatics' GisLab Laboratory Management System

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...

EUVD-2026-75399

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...

CVE-2026-9166

CVE-2026-9166 is a Path Traversal vulnerability (local file inclusion) in GIS Informatics GisLab Laboratory Management System , affecting versions 1.4.03 through 1.5 (exclusive) . The flaw is classified as Improper Limitation of a Pathname to a Restricted Directory . The CVSS 3.1 score is 7.5 (HI...

CVE-2026-9166 LFI in GIS Informatics' GisLab Laboratory Management System

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...

Directory Traversal

Spring Framework is vulnerable to Directory Traversal. The vulnerability is due to improper validation of untrusted view names when using SpringTemplateLoader for FreeMarker template resolution, which allows an attacker to manipulate the view name and access files outside the intended template...

CVE-2026-78085

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

EUVD-2026-75389

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

CVE-2026-78085

SP Property is a Joomla extension published by joomshaper.com. A path traversal vulnerability exists in the gallery image management controller, which lacked directory confinement checks, allowing unauthenticated remote attackers to traverse directories. The vulnerability affects versions below 4...

CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

PYSEC-2026-3835 GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

SummaryGitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns a...

Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

SummaryAn authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundle...

Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

SummaryDirectoryPromptRegistry.set interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory...

PYSEC-2026-3810 Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Summary DirectoryPromptRegistry.set interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory. Details...