CVE-2026-47253

Anyquery (an SQL query engine built on SQLite) is vulnerable to path traversal in the clear_plugin_cache(plugin) SQL scalar function (namespace/other_functions.go). Prior to 0.4.5 , the caller-controlled plugin argument is passed through path.Join to os.RemoveAll without rejecting .. segments, al...

CVE-2026-47253 Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clearplugincacheplugin SQL scalar function in namespace/otherfunctions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token...

CVE-2026-90929

File Browser versions 2.5.0 through 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS handler, the direct-upload path does not reject a target that is an existing directory. A POST with ?override=true aimed at a...

PT-2026-91205

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2026-89257

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $REQUEST'id' to Category::deleteAssets, which...

EUVD-2026-76069

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $REQUEST'id' to Category::deleteAssets, which...

GHSA-C23Q-FW86-9H5X LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

Summary A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. Details In internal/plugin/native/manager.go, the plugin installation endpoint...

CVE-2026-86099

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and...

EUVD-2026-74908

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and...

CVE-2026-86099

Chainlit versions through 2.12.0 fail to validate the client-supplied socket.io sessionId parameter, enabling unauthenticated attackers to perform path traversal by injecting absolute or relative path sequences. Maliciously crafted sessionId values can escape the upload directory and recursively ...

CVE-2026-86099 Chainlit through 2.12.0 Path Traversal via socket.io sessionId

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and...

CVE-2026-86099 Chainlit through 2.12.0 Path Traversal via socket.io sessionId

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and...

PT-2026-89000

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and...

CVE-2026-42048

CVE-2026-42048 CVE-2026-42048 Langflow Path Traversal / Arbitrary Directory Deletion PoC https://github.com/user-attachments/assets/6e5481ff-e953-47a5-8870-70b30c6550de Description CVE-2026-42048 : Langflow Arbitrary Directory Deletion Vulnerability description: A path traversal vulnerability in...

CVE-2026-85160

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...

EUVD-2026-70395

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...

CVE-2026-85160

AVideo (through commit c91b5975d) is affected by a combined CSRF and path traversal vulnerability in stopLive.php . The root cause is missing token validation and unsanitized key parameter concatenation, allowing an attacker to craft a malicious image tag with a traversal payload (e.g., key=../.....

CVE-2026-85160 AVideo through c91b5975d CSRF and Path Traversal via stopLive.php

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...

CVE-2026-79743

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

EUVD-2026-68691

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...