CVE-2026-71313 rclone: Local Encoding Path Traversal

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

rclone: Path traversal in serve s3 allows reading and overwriting root-level files

Summary rclone serve s3 allows a client to read and write files at the root of the remote which would normally be inaccessible by using dot-dot path segments in the object key. It does not allow reading files outside of the root. A request such as GET /bucket/../root-secret.txt is handled as an...

CVE-2026-12942

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

CVE-2026-12942

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

CVE-2026-12942 Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

EUVD-2026-51243

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

EUVD-2026-51138

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

PT-2026-66487

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL reque...

goshs has a Path Traversal issue

Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. Finding Medium: upload filename escapes the served tree residual of CVE-2026-35393 The multipart filename fix updown.go lines 135-136 splits on the path...

CVE-2026-66063 goshs has a Path Traversal issue

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This...

CVE-2026-66063 goshs has a Path Traversal issue

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This...

EUVD-2026-47871

@fastify/static vulnerable to route guard bypass via path traversal...

CVE-2026-15074

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot...

CVE-2026-15074

The CVE-2026-15074 issue affects @fastify/static up to and including version 10.1.0, which fails to reject dot-dot path segments in request pathnames before file resolution. This bypasses the earlier fix for CVE-2026-6414 (encoded slashes only) because the underlying send library normalizes dot s...

CVE-2026-15074 @fastify/static vulnerable to route guard bypass via path traversal

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot...

PT-2026-63566

Name of the Vulnerable Software and Affected Versions @fastify/static versions prior to 10.1.1 Description An unauthenticated attacker can bypass route-scoped middleware and guards by using non-leading .. and %2E%2E path segments in request pathnames. This occurs because the find-my-way router do...

GHSA-W7X5-G22V-XQHR Eclipse Jetty: Path parameter traversal

Description as reported Summary In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot segment. A minimal example is: /public;/../admin/secret In my local reproduction,...

SUSE CVE-2026-26032

The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...

CVE-2026-55874

A flaw was found in SeaweedFS, a distributed storage system. The S3 API gateway in SeaweedFS does not properly validate X-Amz-Copy-Source headers, specifically failing to reject "dot-dot" path segments. This allows an authenticated user, even if scoped to a single bucket, to read objects from oth...

CVE-2026-53598

The CVE-2026-53598 issue affects Prompty (.prompty) loaders that expanded ${file:...} references in frontmatter before 2.0.0-beta.2, allowing an attacker-controlled prompt to read local files via absolute paths, .. traversal, or symlink escapes. Root cause: path confinement was not enforced durin...