CVE-2026-82521: Improper Limitation of a Pathname to a Restricted Directory

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes...

CVE-2026-85456: Improper Limitation of a Pathname to a Restricted Directory

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and...

PT-2026-85305

Name of the Vulnerable Software and Affected Versions MOOS-IvP versions prior to 24.8.2 Description The SplitHandler fails to properly validate variable names extracted from alog files. On Windows systems, an attacker can provide specially crafted alog files containing backslash sequences in...

CVE-2026-85396: Improper Limitation of a Pathname to a Restricted Directory

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

VulnCheck KEV: CVE-2026-63219

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary .x...

CVE-2026-85176: External Control of File Name or Path

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...

path traversal vulnerability in pre-3.4.0 rubyzip gem

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-52832 Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

CVE-2026-52832 Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

CVE-2026-84671

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

CVE-2026-84671

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

CVE-2026-84671

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

CVE-2026-84671

The Jenkins File Parameter Plugin (versions 425.v3fa_801681b_5e and earlier) is vulnerable to a path traversal flaw. The root cause is that the plugin uses the Stapler framework's @DataBoundConstructor to instantiate objects and bind submitted data, but fails to validate parameter names when stor...

EUVD-2026-70143

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

EUVD-2026-63414

Banks: Path traversal in DirectoryPromptRegistry.set allows arbitrary file write outside the registry root...

Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Summary DirectoryPromptRegistry.set interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory. Details...

GHSA-X8WG-4XGC-VR54 Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Summary DirectoryPromptRegistry.set interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory. Details...

EUVD-2026-68816

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

Summary The virtual store linker constructs package installation directories using path.joinmodules, pkgName where pkgName is extracted from lockfile packages keys via dp.parsedepPath.name without validation. A crafted pnpm-lock.yaml with traversal sequences in depPath keys e.g.,...

GHSA-C59Q-G84Q-2GJ5 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

Summary The virtual store linker constructs package installation directories using path.joinmodules, pkgName where pkgName is extracted from lockfile packages keys via dp.parsedepPath.name without validation. A crafted pnpm-lock.yaml with traversal sequences in depPath keys e.g.,...