CVE-2026-118561 Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

CVE-2026-118561

The Single Content Sync module for Drupal (versions 0.0.0 to 1.4.19 ) is vulnerable to an External Control of File Name or Path (CWE-73) issue. The root cause is the module's failure to sufficiently validate file sources and destinations during content imports. An attacker with the import single ...

CVE-2026-119250

A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device...

CVE-2026-119250

A vulnerability in WiFiman Desktop for macOS allows a malicious actor with local access and low privileges to exploit an External Control of File Name or Path (CWE-73) flaw. Successful exploitation enables the execution of arbitrary commands with root privileges on the host device. No specific ve...

CVE-2026-119250

A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device...

CVE-2026-119250

A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device...

EUVD-2026-113328

A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device...

External Control of File Name or Path

Overview pdfmake is a Client/server side PDF printing in pure JavaScript Affected versions of this package are vulnerable to External Control of File Name or Path via the SVG rendering path in src/Renderer.js, where local images embedded within SVG content bypass the setLocalAccessPolicy...

Plex Media Server External Control of File Name or Path Vulnerability

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655...

External Control of File Name or Path

Overview docling-core is an A python library to define and validate data types in Docling. Affected versions of this package are vulnerable to External Control of File Name or Path via withembeddedpictures and ImageRef when exporting a DoclingDocument containing untrusted content. Plain filesyste...

External Control of File Name or Path

Overview graphifyy is an AI coding assistant skill Claude Code, CodeBuddy, Codex, OpenCode, Kilo Code, Cursor, Gemini CLI, Aider, OpenClaw, Factory Droid, Trae, Hermes, Kiro, Pi, Devin CLI, Google Antigravity - turn any folder of code, docs, papers, images, or videos into a queryable knowledge...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the -J option in the command-line tool when handling HTTP 103 Early Hints responses or specific header ordering. An attacker can overwrite existing local files by controlling the remote server's...

CVE-2026-106042

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application...

CVE-2026-106042

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application...

EUVD-2026-98848

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application...

CVE-2026-106042

Ivanti Xtraction versions before 2026.4 are affected by an External Control of File Name or Path vulnerability (CWE-73). This flaw allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint. Successful exploitation enables the attacker to ...

CVE-2026-106042: External Control of File Name or Path

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application...

PT-2026-111673

Name of the Vulnerable Software and Affected Versions Ivanti Xtraction versions prior to 2026.4 Description An External Control of File Name or Path issue allows a remote authenticated attacker to redirect application-generated requests to an endpoint under their control. This can lead to the the...

External Control of File Name or Path

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to External Control of File Name or Path via the writemissingweakimports method in src/datamodelcodegenerator/parser/protobuf.py when processing a Protocol Buffers schema file containi...

External Control of File Name or Path

Overview @backstage/backend-defaults is a Backend defaults used by Backstage backend apps Affected versions of this package are vulnerable to External Control of File Name or Path via the cloud storage URL reader implementations AwsS3UrlReader, AwsCodeCommitUrlReader, AzureBlobStorageUrlReader, a...