awx: project archive extraction allows path traversal file writes

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding

A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the IndexFile.checkout and TagReference.create functions. An authenticated attacker can exploit this by passing unsafe options through keyword arguments, leading to the ability to...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

awxkit: path traversal via YAML !include directive

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...

awx: project archive extraction allows path traversal file writes

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding

A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the IndexFile.checkout and TagReference.create functions. An authenticated attacker can exploit this by passing unsafe options through keyword arguments, leading to the ability to...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

CVE-2026-77679

A path traversal ZIP slip vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, the decompressxpithread function extracts XPI archives ZIP format to disk using libarchive. For each archive entry, the output path i...

CVE-2026-71364

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-77914 rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

CVE-2026-77914

rConfig versions prior to 8.2.13 contain a path traversal vulnerability in the export download endpoint . An authenticated attacker can manipulate the filename parameter with directory traversal sequences to escape the intended export directory and read arbitrary files accessible to the applicati...

EUVD-2026-64952

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences t...

CVE-2026-77914 rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

CVE-2026-77914 rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

Exploit for CVE-2026-60093

CVE-2026-60093 — camel-azure-storage-datalake downloadToFile...

CVE-2026-71364

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-71364

A path traversal vulnerability in AWX 's project_archive action plugin (part of Red Hat Ansible Automation Platform ) allows arbitrary file writes on the execution node. The plugin extracts zip/tar members by joining the project directory path with the member filename without path normalization o...

EUVD-2026-64918

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-71364 Awx: project archive extraction allows path traversal file writes

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...