11 matches found
CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename
Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...
EUVD-2026-51398
CodeIgniter: Path traversal in UploadedFile::move when using client-provided filenames...
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Impact In affected versions, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences e.g. ../../public/shell.php t...
GHSA-HHMC-Q9HP-R662 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Impact In affected versions, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences e.g. ../../public/shell.php t...
CVE-2026-63223 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...
CVE-2026-63222
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...
CVE-2026-63222 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...
FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE
Summary FacturaScripts\Core\UploadedFile::move$destiny, $destinyName concatenates $destiny and $destinyName without normalizing the resulting path. Every caller in the codebase passes UploadedFile::getClientOriginalName — the unsanitized client-supplied filename — as $destinyName, so an...
PT-2026-48810
Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.7.3 Description An upload validation bypass exists in the ext in rule within system/Validation/StrictRules/FileRules.php. The rule incorrectly validates the MIME-derived guessed extension instead of the actual...
Resty has a Path Traversal vulnerability
A security vulnerability has been detected in Dreampie Resty versions up to the 1.3.1.SNAPSHOT. This affects the function Request of the file /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java of the component HttpClient Module. Such manipulation of the argument filename leads to...
