CVE-2026-61632 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured basepath with...

CVE-2026-61632 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured basepath with...

EUVD-2026-54149

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured basepath with...

CVE-2026-61632

CVE-2026-61632 affects PyMdown Extensions (b64 extension) up to version 10.21.3. The b64 code path in pymdownx/b64.py joins the attacker-controlled image src onto a configured base_path (or uses an absolute path) and opens the result without ensuring the resolved path stays inside base_path, allo...

CVE-2026-61632 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured basepath with...

PYSEC-2026-3609 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured basepath with os.path.normpath and opens the result directly, with no check that the resolved path stays inside basepath. A src containing ../ sequences, or an...

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

SummaryThe b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured basepath with os.path.normpath and opens the result directly, with no check that the resolved path stays inside basepath. A src containing ../ sequences, or an...

CVE-2025-71401 better-auth before 1.4.2 basePath Modification DoS

better-auth npm before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined e.g., BETTERAUTHURL is unset. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users...

SUSE CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

PT-2026-65607

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.59.0 through 0.61.0 Description When generating Python data models from an XML Schema using the --input-file-type xmlschema option, the software improperly resolves schemaLocation values within , , , and...

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the customBasePath schema field. An attacker can execute arbitrary Python code by supplying a specially crafted value containing embedded newlines and a...

EUVD-2026-49050

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

PT-2026-64795

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.70.0 Description A code injection flaw exists where attackers controlling input schemas can achieve remote code execution. By providing a malicious customBasePath value containing embedded newlines...

GHSA-86CX-WWF4-PHQ4 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Summary An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user...

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Summary An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user...

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

Summary The /api/fs/batchrename handler validates and authorizes only the requested source directory. It rejects path separators in newname, but it does not validate srcname. The handler concatenates srcdir and attacker-controlled srcname, then passes the result to the filesystem rename layer,...