Better-CVE-2022-29464

Better CVE-2022-29464 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a...

CVE-2026-46652 Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename extracts the destination filename from a server-supplied Content-Disposition response header and passes it directl...

CVE-2026-46652

The Goobi viewer web application is vulnerable to a path traversal flaw in versions 24.03 to before 26.05 . The root cause exists in ExternalFilesDownloader.getFilename(), which extracts a filename from a server-supplied Content-Disposition response header and passes it to Path.resolve() without ...

EUVD-2026-109060

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename extracts the destination filename from a server-supplied Content-Disposition response header and passes it directl...

WSOB

😭 WSOB CVE-2022-29464 😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464. CVE-2022-29464 details: Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a...

st2-046-poc

Struts2 Content-Disposition filename null-byte variant of CVE-2017-5638 Struts2 Security Bulletin S2-046 A null byte \x00 in a request¡¯s Content-Disposition header filename field can trigger a InvalidFileNameException with the same client controlled filename string in the exception message that ...

CVE-2020-5398

CVE-2020-5398 - RFDReflected File Download Attack for Spring MVC In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — Path Traversal in TECNO Hi Browser Download Handler Proof-of-concept for CVE-2026-18907 CVSS 7.5 High, CWE-23, a relative path-traversal vulnerability in the download file feature of TECNO Hi Browser com.talpa.hibrowser version 2.23.1.1. The browser trusted an attacker-controlled...

CVE-2026-92390

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

EUVD-2026-105320

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

CVE-2026-92390

When invoked with "--remote-header-name" "-J", curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an "ETag" header is processed before "Content-Disposition" under "--etag-save". This flaw allows an...

CVE-2026-92390

The curl command-line tool fails to maintain its documented anti-clobbering protection when the --remote-header-name (-J) option is used. A malicious HTTP(S) server can bypass this protection by providing an intermediate 103 Early Hints response or by processing an ETag header before a Content-Di...

CVE-2026-92390

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

CVE-2026-92390

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

Red Hat: CVE-2026-92390: curl: curl: -J no-clobber guarantee bypassed with 103 early hints

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

Astra Linux – Vulnerability in libsoup2.4

A flaw was discovered in libsoup, where the soupmessageheadersgetcontentdisposition function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function...

Astra Linux – Vulnerability in ruby-sinatra

Sinatra is a domain-specific language for creating web applications in Ruby. A vulnerability was discovered in Sinatra 2.0 before versions 2.2.3 and 3.0 before version 3.0.4. The application is vulnerable to a reflected file download RFD attack, which causes the Content-Disposition header of a...

-J no-clobber guarantee bypassed with 103 early hints

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

CURL-CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

CVE-2026-92390

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...