69450 matches found
CVE-2026-61645
The Docat documentation hosting tool contains an arbitrary file upload vulnerability in its Upload API. The root cause is a lack of validation for the uploaded file path or type . An attacker can exploit this to overwrite sensitive configuration files or deposit malicious files on the web server....
CVE-2026-61645 Docat has Arbitrary File Upload exists in Upload API
Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious...
CVE-2026-119198
The Nuxt web development framework (versions 4.6.0 through 4.6.3 ) is vulnerable to an arbitrary file read via the development server. An attacker with TCP access to an exposed development server can send a nuxt:dev:client-error event over the HMR socket containing an absolute file path. The serv...
CVE-2026-119198 Nuxt dev server arbitrary file read through client error reports
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that fi...
CVE-2026-119198 Nuxt dev server arbitrary file read through client error reports
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that fi...
xz: Fix of CVE-2022-1271
CVE-2022-1271: xzgrep: fix arbitrary file write and command execution via crafted filenames...
CVE-2026-107055
Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files...
CVE-2026-107053
Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox...
GHSA-HJQX-J4RW-G7XV zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
Summary - Verified version: zip 9.0.0-pre3 - Affected versions: 7.2.0 and later - Precondition: The attacker knows or can guess the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can write arbitrary files outside the...
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
Summary - Verified version: zip 9.0.0-pre3 - Affected versions: 7.2.0 and later - Precondition: The attacker knows or can guess the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can write arbitrary files outside the...
CVE-2026-93570
Szafir and Szafir Weryfikująca are vulnerable to XML External Entity XXE injection. When a user signs or verify a crafted XML file containing a DOCTYPE with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem...
CVE-2026-77819
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory...
CVE-2026-104312
IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file...
CVE-2026-104312
IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file...
CVE-2026-118758 Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify a...
CVE-2026-118758
Kubeflow Pipelines versions prior to 2.18.0 are vulnerable to an unauthenticated path traversal vulnerability in the volume artifact handler for GET /artifacts/get?source=volume. The root cause is a failure to confine caller-supplied file paths to the selected volume, allowing an attacker to read...
CVE-2026-118758 Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify a...
EUVD-2026-113148
IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file...
CVE-2026-104312
IBM Langflow OSS versions 1.0.0 through 1.12.3 are vulnerable to a path traversal issue (CWE-22 ). An authenticated attacker can produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. If a victim extracts this archive using a non-san...