EUVD-2026-62195

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

Summary Every Linuxfabrik check plugin that supports the shared --test argument routed through lib.lftest.test will, when --test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT — running as root when the plugin is invoked...

GHSA-RH9C-RQVG-F7PR linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

Summary Every Linuxfabrik check plugin that supports the shared --test argument routed through lib.lftest.test will, when --test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT — running as root when the plugin is invoked...

CVE-2026-48796

CefSharp's FolderSchemeHandlerFactory used a raw string-prefix check (filePath.StartsWith(rootFolder)) that allowed ..%2fwww2/secret.txt to escape a www root into a sibling www2 directory, exposing local files. Fixed in version 148.0.90 by appending a directory separator to the normalized root be...

CVE-2026-73974 linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...

EUVD-2026-62185

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...

CVE-2026-73974

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...

CVE-2026-73973 Linuxfabrik Monitoring Plugins: Arbitrary root file disclosure via unconfined --filename in logfile plugin (sudoers LPE)

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/logfile/logfile accepted a free-form --filename path and opened it as root when invoked through the shipped nagios or icinga sudoers allowlist, without confini...

CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...

CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...

CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...

CVE-2026-69160

In server/handles/sharing.go, strings.HasPrefix(requested_path, user.BasePath) fails to enforce a directory separator boundary. An authenticated user with CanShare permission and a BasePath like /base can create a share for a sibling path like /base2/secret.txt, then use the public share download...

GHSA-8J49-MMCX-4MP5 MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

Summary The findiconpathzip function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path. An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitra...

MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

Summary The findiconpathzip function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path. An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitra...

CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads

MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...

EUVD-2026-61132

MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...

CVE-2026-68922

In MobSF versions before 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py constructs paths from the manifest android:icon value without sanitizing traversal or verifying containment. An authenticated user can upload a crafted ZIP/APK to read server files matching A...

CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads

MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...

WordPress StoreEngine plugin <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL vulnerability

Authenticated Vendor+ Arbitrary File Read via Path Traversal in Downloadable File URL vulnerability discovered by zickzick2 - Sejong University of cyber security student in WordPress Plugin StoreEngine versions = 2.1.1...

CVE-2026-75912

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...