CVE-2026-50186 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

EUVD-2026-62202

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

CVE-2026-52875 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

EUVD-2026-62199

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

CVE-2026-52875 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

CVE-2026-52875

Streambert is a cross-platform Electron desktop app for streaming and downloading video. Prior to 2.6.0 , the perform-scheduled-backup IPC handler in src/ipc/storage.js accepts settings.path from a renderer-supplied object and performs filesystem operations (fs.mkdirSync, fs.writeFileSync, fs.rea...

CVE-2026-52876

Streambert is a cross-platform Electron desktop application for streaming and downloading video content. Prior to version 2.6.0 , the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. When mpv or VLC launch attempts ...

CVE-2026-52876 Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or...

EUVD-2026-62196

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer...

CVE-2026-52872 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...

CVE-2026-52872 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...

EUVD-2026-62195

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...

CVE-2026-47699 Confidential Containers Guest Components image-rs: zip-slip-class arbitrary file write via absolute entry path in hardlink fallback

Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...

CVE-2026-47699

Confidential Containers Guest Components (versions 0.16.0 through 0.19.x) contains a path traversal vulnerability in the image-rs crate's try_hardlink_fallback() function. When unpacking a crafted OCI image layer, the function computes the hardlink destination using destination.join(&entry_rel). ...

CVE-2026-47699 Confidential Containers Guest Components image-rs: zip-slip-class arbitrary file write via absolute entry path in hardlink fallback

Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

Summary Every Linuxfabrik check plugin that supports the shared --test argument routed through lib.lftest.test will, when --test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT — running as root when the plugin is invoked...

GHSA-RH9C-RQVG-F7PR linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

Summary Every Linuxfabrik check plugin that supports the shared --test argument routed through lib.lftest.test will, when --test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT — running as root when the plugin is invoked...

moby/go-archive: Crafted tar archive can write outside the extraction directory

Summary The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. Details The extracto...

GHSA-HFG8-HC9C-6C3H moby/go-archive: Crafted tar archive can write outside the extraction directory

Summary The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. Details The extracto...

CVE-2026-48796

CefSharp's FolderSchemeHandlerFactory used a raw string-prefix check (filePath.StartsWith(rootFolder)) that allowed ..%2fwww2/secret.txt to escape a www root into a sibling www2 directory, exposing local files. Fixed in version 148.0.90 by appending a directory separator to the normalized root be...