EUVD-2026-109981

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies Zip Cloaking Leading to Arbitrary File Overwrite & RCE...

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Summary A critical architectural parser differential exists in the zip crate = 9.0.4 between random-access archive readers ZipArchive and streaming readers ZipStreamReader. ZipArchive considers the Central Directory File Header CDFH authoritative and ignores the filename declared in the Local Fil...

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

SoftReadWriteLock and AsyncSoftReadWriteLock, which wraps one checks once per lock object, by name, that .rw, .rw/gen and .rw/holders are real directories and not symbolic links files that redirect to another path. It then keeps only a boolean. Every later record operation resolves the full path...

EUVD-2026-105032

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock...

EUVD-2026-105017

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path...

EUVD-2026-105025

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders...

Double Decoding of the Same Data

Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Double Decoding of the Same Data via the serveStatic middleware in src/serve-static.ts, where a percent-encoded path sequence in a request URL is decoded by tryDecodeURI before the path...

Echo static file middleware route protection bypass via encoded dot-dot traversal

Summary Echo v5.2.0 contains a bypass of the fix for GHSA-vfp3-v2gw-7wfq. The fix rejects encoded path separators such as %2F and %5C before static file path unescaping, but two traversal forms still bypass route-level middleware protections for static files. The primary bypass uses encoded dot-d...

GHSA-3PMX-CF9F-34XR Echo static file middleware route protection bypass via encoded dot-dot traversal

Summary Echo v5.2.0 contains a bypass of the fix for GHSA-vfp3-v2gw-7wfq. The fix rejects encoded path separators such as %2F and %5C before static file path unescaping, but two traversal forms still bypass route-level middleware protections for static files. The primary bypass uses encoded dot-d...

GHSA-XWQ5-6CQP-VX96 Echo has a Static Middleware Double-Unescape Path Traversal

Summary Commit a9ede66a PR 3006, issue 2599 silently fixed a path traversal vulnerability in the Echo web framework's static file middleware. Vulnerability The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally...

Echo has a Static Middleware Double-Unescape Path Traversal

Summary Commit a9ede66a PR 3006, issue 2599 silently fixed a path traversal vulnerability in the Echo web framework's static file middleware. Vulnerability The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally...

EUVD-2026-112470

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

CVE-2026-118663

The @hono/node-server library (versions 1.19.10 through 2.1.3) is vulnerable to a middleware bypass due to double decoding of the request path. Specifically, the serveStatic function decodes the path a second time after Hono has already performed decoding for routing. An unauthenticated attacker ...

CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

CVE-2026-118663

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file...

CVE-2026-63190

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn authentication checks, CSRF protection or adequate path validation. On PHP's built-in...

CVE-2026-118654

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read...

DEBIAN-CVE-2026-118654

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read...