CVE-2026-37069: Exposure of Sensitive Information to an Unauthorized Actor

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

EUVD-2026-66606

Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mageai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling...

PYSEC-2026-3790

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. loadlangngrams joins the corpus root with crubadancode, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open rather than the pathsec-validated opener, s...

CVE-2026-71514

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. loadlangngrams joins the corpus root with crubadancode, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open rather than the pathsec-validated opener, s...

EUVD-2026-64295

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. loadlangngrams joins the corpus root with crubadancode, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open rather than the pathsec-validated opener, s...

CVE-2026-71514 NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. loadlangngrams joins the corpus root with crubadancode, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open rather than the pathsec-validated opener, s...

PT-2026-79555

Name of the Vulnerable Software and Affected Versions NLTK versions 3.9.4 through 3.10.2 Description A path traversal issue exists in the CrubadanCorpusReader component. The load lang ngrams function joins the corpus root with the crubadan code variable, which is the value read from the column-0 ...

BIT-PYTHON-MIN-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

If shutil.unpackarchive is given a ZIP archive with an absolute Windows path containing a drive C:\... then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability...

BIT-PYTHON-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

If shutil.unpackarchive is given a ZIP archive with an absolute Windows path containing a drive C:\... then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability...

CVE-2026-47630

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution...

CVE-2026-47606

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure...

PT-2026-77264

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution...

CVE-2026-47630: Absolute Path Traversal

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution...

CVE-2026-47606: Absolute Path Traversal

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure...

CVE-2026-53795

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside t...

CVE-2026-53795

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside t...

Duplicate Advisory: Absolute filesystem path and OS username disclosure via resolveAssetPath

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jv8v-xq2h-657v. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that...

CVE-2026-72802

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to...

CVE-2026-72802

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to...

PT-2026-71244

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the 'resolveAssetPath' endpoint. The endpoint returns absolute filesystem paths unmodified when processing CheckAuth-only requests. An attacker can collect...