CVE-2026-21249

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing locally...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the /3/Parse and /3/Frames/framename/export endpoints. An attacker can overwrite arbitrary files on the server, including sensitive files such as private SSH keys or script files, by injecting...

Windows Telephony Service Elevation of Privilege Vulnerability

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2025-67461

CVE-2025-67461 affects Zoom Rooms for macOS prior to 6.6.0. The issue is external control of a file name or path, enabling an authenticated user to disclose information via local access. Impact is information disclosure (confidentiality). Remediation: update Zoom Rooms for macOS to version 6.6.0 ...

The vulnerability of the NTLM protocol implementation in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the NTLM protocol implemented by the Windows operating system is related to external file name or path control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Fortinet FortiClientMAC 安全漏洞

Fortinet FortiClientMAC is a U.S. fly tower Fortinet company based on macOS platform security tools. A code execution vulnerability exists in Fortinet FortiClientMAC that originates from an external control of a file name or path, which can be exploited by a local attacker to execute arbitrary co...

Reliance on File Name or Extension of Externally-Supplied File

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Reliance on File Name or Extension of Externally-Supplied File due to insufficient scanning of non-standard pickle file extensions. Remediation...

PT-2024-6549 · Microsoft · Outlook

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook affected versions not specified Description: The issue is related to incorrect external control of a file name or path in Microsoft Outlook for Windows operating systems. Exploitation of this issue may allow an attacker to...

CVE-2024-38432

Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File...

The vulnerability of the Firmware Upload Handler component of the Siemens RUGGEDCOM CROSSBOW secure access control system allows a perpetrator to upload arbitrary files and execute arbitrary code.

The vulnerability of the Firmware Upload Handler component of the Siemens RUGGEDCOM CROSSBOW access control system is related to incorrect external manipulation of file names or files. Exploiting this vulnerability allows a malicious actor to upload arbitrary files and execute arbitrary code...

Mitsubishi Electric FA Engineering Software Security Vulnerability

Mitsubishi Electric FA Engineering Software is a series of engineering software from Mitsubishi Electric Japan. A security vulnerability exists in Mitsubishi Electric FA Engineering Software, which is a malicious code execution vulnerability that originates from an externally controlled file name...

VulnCheck KEV: CVE-2019-7195

QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files...

CVE-2019-7195

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions...