91 matches found
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130113)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130113 advisory. rsync before3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated client...
CVE-2026-88046
A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows an attacker to bypass configured directory restrictions by including parent-directory segments e.g., '..' in source object names. When a specially crafted source object is uploaded or copied, it can...
EUVD-2026-75761
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
CVE-2026-62801
Improper limitation of a pathname to a restricted directory 'path traversal' in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network...
PT-2026-87733
Improper limitation of a pathname to a restricted directory 'path traversal' in Windows PowerShell allows an authorized attacker to elevate privileges over a network...
NLTK IPIPANCorpusReader Unauthorized Access
The vulnerability of the IPIPANCorpusReader component in the NLTK library package for symbolic and statistical processing of natural language is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access...
EUVD-2026-63735
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security restrictions due to improper limitation of a pathname to a restricted directory...
CVE-2026-53783
A time-of-check to time-of-use TOCTOU race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended...
CVE-2026-53457
In Blueprint Studio before 2.5.2, the legacy terminal path in terminal_manager.py accepted a cwd parameter and only checked directory existence, allowing an admin to run commands in directories outside the Home Assistant config boundary, weakening filesystem restrictions. Fixed in version 2.5.2. ...
SUSE CVE-2026-53783
rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer...
EUVD-2026-58797
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limitation of a pathname to a restricted directory...
CVE-2026-53783
rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer...
PT-2026-71622
Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description The rrsync restricted shell wrapper contains a time-of-check to time-of-use TOCTOU race condition. This occurs when a system checks a condition such as a file path validation and then uses the result o...
CVE-2026-17266
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
CVE-2026-64400
A flaw was found in the Linux kernel's ksmbd component. A vulnerability in the ksmbd component allows a remote authenticated attacker to bypass path restrictions. Specifically, a bug in the caseless retry logic during path resolution fails to properly handle directory traversal attempts. This...
PYSEC-2026-3538 Prompty: Arbitrary file read via file reference expansion
Summary Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to t...
PT-2026-64138
Summary Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to t...
GHSA-WXHM-2MQ7-7697 Prompty: Arbitrary file read via file reference expansion
Summary Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to t...
Path Traversal
github.com/eat-pray-ai/yutu is vulnerable to Path Traversal. The vulnerability is due to the caption-download MCP tool passing a caller-controlled file path directly to os.Create without path validation, canonicalization, or restriction to the YUTUROOT directory, which allows an attacker to write...