CVE-2024-5986: External Control of File Name or Path

A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the /3/Parse endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the...

H2O has an External Control of File Name or Path vulnerability

A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the /3/Parse endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the...

Directory Traversal

Overview omni-cortex is a Give Claude Code a perfect memory - auto-logs everything, searches smartly, and gets smarter over time Affected versions of this package are vulnerable to Directory Traversal. File operations fail to validate file path parameters against directory traversal sequences,...

BIT-GOLANG-2025-61731 Arbitrary file write using cgo pkg-config directive in cmd/go

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a...

Exploit for Code Injection in Apache Rocketmq

Apache RocketMQ NameServer 任意文件写入漏洞（CVE-2023-37582）漏洞复现POC，java版本 该poc为复现https://github.com/vulhub/vulhub/tree/master/rocketmq/CVE-2023-37582https://gitee.com/link?target=https%3A%2F%2Fgithub.com%...

python-multipart Upload Arbitrary Files

The vulnerability of the UPLOADDIR configuration and the UPLOADKEEPFILENAME=True setting in the Python-multipart streaming parser is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a remote attacker to write arbitrary files...

npm Path Traversal

The vulnerability of the npm package manager is related to incorrect restrictions on path names in the catalog. Exploiting this vulnerability allows a remote attacker to write arbitrary files...

pnpm Arbitrary File Write

The vulnerability in the fetch/binary-fetcher/src/index.ts and resolve/resolver-base/src/index.ts scripts of the package manager pnpm is related to an incorrect path name limitation. Exploiting this vulnerability could allow a remote attacker to write arbitrary files...

CVE-2026-24685

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s repository diff download endpoint /projects/:projectid/repository/diff.diff when rendering a single revision via git show. By...

SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

Summary The /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution RCE by writing to sensitive locations such as cron jobs, SSH authorizedkeys, or shell...

GHSA-C4JR-5Q7W-F6R9 SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

Summary The /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution RCE by writing to sensitive locations such as cron jobs, SSH authorizedkeys, or shell...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the copyFile function, which fails to validate the dest parameter. An attacker can write files to arbitrary locations on the filesystem by supplying crafted paths, potentially leading to execution of malicious co...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the copyFile function, which fails to validate the dest parameter. An attacker can write files to arbitrary locations on the filesystem by supplying crafted paths, potentially leading to execution of malicious co...

PT-2026-6318

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.5.5 Description SiYuan is a personal knowledge management system. The /api/file/copyFile endpoint does not validate the dest parameter. This allows authenticated users to write files to arbitrary locations on the...

AZL-75728 CVE-2025-68119 affecting package golang for versions less than 1.25.6-1

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial hg installed, downloading modules from non-standard sources e.g., custom domains can cause unexpected code execution due to how external VCS commands are constructed. This iss...

AZL-98691 CVE-2025-68119 affecting package golang 1.27.1-1

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial hg installed, downloading modules from non-standard sources e.g., custom domains can cause unexpected code execution due to how external VCS commands are constructed. This iss...

CVE-2025-61731 Arbitrary file write using cgo pkg-config directive in cmd/go

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a...

CVE-2025-61731 Arbitrary file write using cgo pkg-config directive in cmd/go

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a...

CVE-2025-68119

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial hg installed, downloading modules from non-standard sources e.g., custom domains can cause unexpected code execution due to how external VCS commands are constructed. This iss...

CVE-2025-61731

The Go Toolset (Golang) is vulnerable to an arbitrary file write via the #cgo pkg-config: directive in Go source files. An attacker can provide a --log-file argument to this directive, which is passed to the pkg-config command, causing it to write to an attacker-controlled location. This issue af...