CVE-2026-104805: Improper Limitation of a Pathname to a Restricted Directory

DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific flaw exists within the backup restoration mechanism, which fai...

PT-2026-104759

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory...

CVE-2026-95264

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

EUVD-2026-92782

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

PT-2026-106225

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

CVE-2026-95264

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

CVE-2026-12171: Inclusion of Functionality from Untrusted Control Sphere

auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...

CVE-2026-95264: Improper Limitation of a Pathname to a Restricted Directory

Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to unlink without path traversal or directory...

Adobe Campaign Classic Cross-site Request Manipulation

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to the manipulation of cross-site requests. Exploiting this vulnerability could allow a malicious actor to read arbitrary files remotely...

CVE-2026-104478

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

PT-2026-104589

Name of the Vulnerable Software and Affected Versions wcms versions prior to 3.18.1 Description Authenticated editors can achieve remote code execution by exploiting an unvalidated path in the 'POST /api/v0/media/upload/:path' endpoint. This flaw allows the upload of .php files that the web serve...

PT-2026-104519

Name of the Vulnerable Software and Affected Versions MPG WordPress plugin versions prior to 4.2.3 Description Insufficient validation of the dataset source during project import allows users with the Editor role and above to specify a local filesystem path instead of a remote URL. This leads to ...

CVE-2026-104478: Improper Limitation of a Pathname to a Restricted Directory

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

CVE-2026-104478 Formwork before 2.3.13 Path Traversal via BackupController Download and Delete

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

CVE-2026-104478 Formwork before 2.3.13 Path Traversal via BackupController Download and Delete

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

CVE-2026-104478

Formwork versions prior to 2.3.13 are vulnerable to a path traversal vulnerability in the BackupController component. Authenticated panel users with backup download or delete permissions can exploit this by supplying a base64-encoded backslash-separated traversal payload . This payload bypasses t...

CVE-2026-104478

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

Vibe-Trading file-read tools expose arbitrary server-readable files

Summary: 2 findings — safeuserpath accepts any path under Path.home or Path.cwd, which inside the shipped root container resolves to /root and /app so all of root's home, including /root/.ssh/idrsa, /root/.aws/credentials, /root/.kube/config, and /app/agent/.env, passes the check F9. readdocument...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via validatepath in dulwich/index.py when processing tree entries whose leading path component is a DOS drive-letter prefix e.g., C:. On Windows, os.path.joinroot, b"C:..." discards the work-tree root and resolves to...

Directory Traversal

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Directory Traversal via readNxMigrateConfig in packages/nx/src/utils/package-json.ts, which returned the...