Flowise - Path Traversal

Flowise = 2.2.8 contains a path traversal vulnerability caused by missing validation of chatflowId and chatId parameters in file handling, letting unauthenticated attackers read and write arbitrary files, exploit requires no authentication. id: CVE-2025-71334 info: name: Flowise - Path Traversal...

Plenti < v0.7.2 - OS Command Injection

Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The /postLocal endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the...

esm.sh <= v136 - Arbitrary File Write via Path Traversal

esm.sh = 136 contains a path traversal caused by improper canonicalization of the X-Zone-Id HTTP header, letting attackers write files outside the intended storage directory, exploit requires crafted header input. id: CVE-2025-59342 info: name: esm.sh = v136 - Arbitrary File Write via Path...

YouPHPTube Encoder - Arbitrary File Write

Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube.The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack. id: CVE-2019-5128 info: name: YouPHPTube Encoder - Arbitrary...

Camaleon CMS < 2.8.1 Arbitrary File Write to RCE

An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on depending on the permissions of the underlying filesystem. E.g. This can lead to a remote...

Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

GL.iNet <= 4.3.7 - Arbitrary File Write

GL.iNet = 4.3.7 is vulnerable to an arbitrary file write exploit, allowing an attacker to overwrite arbitrary system files. id: CVE-2023-46455 info: name: GL.iNet = 4.3.7 - Arbitrary File Write author: Zierax severity: high description: | GL.iNet = 4.3.7 is vulnerable to an arbitrary file write...

CVE-2026-15601

The CVE affects the Kirki plugin for WordPress (versions

EUVD-2026-51745

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

CVE-2026-15601

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

SUSE CVE-2026-54093

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, filebrowser builds the download-as-zip / download-as-tar archive entry names with filepath.ToSlash, which on a Linux host is a no-op for...

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Summary image.download fetches a URL and writes the response to disk. It does not use the central path guard validatepathwithenvconfig, which confines writes to FLYTOSANDBOXDIR; instead it confines the output to outputdir, but outputdir is itself a caller parameter. Since the attacker sets both t...

CVE-2026-15435

IBM App Connect Enterprise is vulnerable to an arbitrary file write due to a path traversal flaw (CWE-22). A remote attacker could send a crafted URL containing dot-dot sequences (/../) to traverse directories and write arbitrary files on the system. Affected versions are 13.0.1.0–13.0.7.2 and 12...

EUVD-2026-51138

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

UBUNTU-CVE-2026-56390

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429

Flyto2 Core (execution kernel for automation/AI-agent workflows) contains an Arbitrary File Write vulnerability in image.download and related file-writing modules prior to version 2.26.6. The root cause is caller-controlled output_dir, which bypasses validate_path_with_env_config and FLYTO_SANDBO...

CVE-2026-13346

Pip has a vulnerability (CVE-2026-13346) where doubly-encoded package URLs from indexes can lead to files being installed to arbitrary locations on disk, even when installing wheels. The issue is exploitable only when downloading/installing from a malicious package index; malicious packages alone...

GHSA-F42X-P2MX-HM8R Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such ...