GHSA-HJQX-J4RW-G7XV zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

Summary - Verified version: zip 9.0.0-pre3 - Affected versions: 7.2.0 and later - Precondition: The attacker knows or can guess the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can write arbitrary files outside the...

EUVD-2026-109985

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically...

EUVD-2026-112469

Vite: server.fs.deny bypassed with queries...

npm: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

npm: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist vulnerability discovered by ? in WordPress npm parse-server versions = 8.6.83...

GHSA-R899-H629-J84R Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

Impact Parse Server's file upload validation uses the fileUpload.fileExtensions option enabled by default with a blocklist to reject files that browsers may render as active content, mitigating stored cross-site scripting XSS. When an uploaded file's extension is not recognized by the mime packag...

Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

Impact Parse Server's file upload validation uses the fileUpload.fileExtensions option enabled by default with a blocklist to reject files that browsers may render as active content, mitigating stored cross-site scripting XSS. When an uploaded file's extension is not recognized by the mime packag...

SUSE-SU-2026:4944-1 Security update for flatpak

This update for flatpak fixes the following issues: - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. - CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc128251...

CVE-2026-1556

Information disclosure in the file URI processing of File Field Paths in Drupal File Field Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hooknodeinsert consumers for example, email attachment...

CVE-2022-25277

Drupal core sanitizes filenames with dangerous extensions upon upload reference: SA-CORE-2020-012 and strips leading and trailing dots from filenames to prevent uploading server configuration files reference: SA-CORE-2019-010. However, the protections for these two vulnerabilities previously did...

CVE-2023-31250

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your...

CVE-2024-11942

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

CVE-2026-93570

Szafir and Szafir Weryfikująca are vulnerable to XML External Entity XXE injection. When a user signs or verify a crafted XML file containing a DOCTYPE with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem...

CVE-2026-93571

Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. This issue was fixed in version 2.0 build 708...

CVE-2026-90864

A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope...

CVE-2026-90862

Improper authentication in the Web Transfer Module of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements...

CVE-2026-84294

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories...

CVE-2026-77819

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory...

CVE-2026-119145

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...

CVE-2026-106036

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their...

CVE-2026-104312

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file...