CVE-2026-117615: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system...

Link following vulnerability allows arbitrary file read

When renaming an item, Jenkins moves its directory on the controller file system, or copies it if it cannot be moved. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed. This allows attackers with Item/Create and...

PT-2026-129175

Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.15.3 Echo versions prior to 5.2.0 Description The middleware.Static component double-unescapes URL paths. Because Go's net/http already decodes Request.URL.Path, the static middleware unconditionally calling...

MiracleLinux 8 : flatpak-1.12.9-9.el8_10 (AXSA:2026-2183:09)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2183:09 advisory. flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin CVE-2026-97023 flatpak: flatpak: Arbitra...

CVE-2026-103688: Unknown Checkout Files Upload for WooCommerce: The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its…

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that...

PT-2026-128213

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding http decode on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f URL-encoded ../ sequences in the URL path. These sequences survive the URL...

CVE-2026-118485: Axel Download Accelerator Axel: Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename…

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding httpdecode on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f URL-encoded ../ sequences in the URL path. These sequences survive the URL...

CVE-2026-109384: melograno The Innovative Form Builder – IvyForms: The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions…

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...

Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...

PT-2026-128305

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.588 Jenkins LTS versions prior to 2.580.2 Description An issue exists during the extraction of archives where the system checks for symbolic links in the path of an extracted file only before creating parent...

CVE-2026-117617: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers...

WordPress midi-Synth 1.1.0 Arbitrary File Upload

WordPress midi-Synth plugin versions through 1.1.0 contain an unauthenticated arbitrary file upload vulnerability in the export AJAX action. The proof of concept uploads a test file or PHP shell. https://packetstorm.news/download/238053...

Magento Open Source 2.4.9 Unrestricted File Upload

Magento Open Source versions through 2.4.9 contain an unrestricted file upload flaw in the guest-cart REST API. The proof of concept starts a loopback lab and demonstrates accepting a GIF/PHP polyglot using a non-executing witness payload. https://packetstorm.news/download/238040...

PT-2026-127862

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...

VulnCheck KEV: CVE-2026-73181

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-58257

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...

CVE-2026-58257

The GRR resource management and reservation application is vulnerable to Arbitrary File Read and Deletion prior to version 4.5.0 . The root cause is a failure to validate or enforce file paths within the database restoration feature . An attacker with administrator privileges can manipulate input...

EUVD-2026-111410

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...

CVE-2026-58257 GRR vulnerable to Arbitrary File Read and Deletion

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...

CVE-2026-58257 GRR vulnerable to Arbitrary File Read and Deletion

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...