CVE-2026-79304

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

PT-2026-97665

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view...

Debian dla-4785 : zip - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4785 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4785-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-80156 Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass

Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to...

CVE-2026-95500 JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

CVE-2026-95273

A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function staticcontent of the file changedetectionio/flaskapp.py of the component visualselectordata. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch...

CVE-2026-95273

dgtlmoon changedetection.io (up to version 0.60.7 ) is affected by a path traversal vulnerability in the static_content function of changedetectionio/flask_app.py, specifically within the visual_selector_data component. By manipulating the filename argument, a remote attacker with low privileges ...

EUVD-2026-84370

A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function staticcontent of the file changedetectionio/flaskapp.py of the component visualselectordata. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch...

CVE-2026-95273 dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal

A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function staticcontent of the file changedetectionio/flaskapp.py of the component visualselectordata. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch...

EUVD-2026-84365

A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function staticcontent of the file changedetectionio/flaskapp.py of the component Screenshot Handler. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate th...

EUVD-2026-84248

A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote...

PT-2026-96716

Name of the Vulnerable Software and Affected Versions dgtlmoon changedetection.io versions prior to 0.60.8 Description A path traversal issue exists in the visual selector data component within the static content function of the changedetectionio/flask app.py file. A remote attacker can manipulat...

PT-2026-96715

Name of the Vulnerable Software and Affected Versions dgtlmoon changedetection.io versions prior to 0.60.8 Description A path traversal issue exists in the Screenshot Handler component within the static content function of the changedetectionio/flask app.py file. A remote attacker can exploit thi...

CVE-2026-94489 OctoPrint File Download API files.py _validate path traversal

A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote...

CVE-2026-94489

A path traversal vulnerability in OctoPrint 1.0.0 affects the _validate function in src/octoprint/server/api/files.py (File Download API). Manipulation of the filename argument allows a remote attacker with low privileges to traverse directories, resulting in low confidentiality impact . The expl...

CVE-2026-52835

Tautulli , a Python-based monitoring and tracking tool for Plex Media Server, is affected by a path traversal / arbitrary file write vulnerability prior to version 2.17.2 . The flaw exists in the import_config handler and the database_file branch of import_database in plexpy/webserve.py, where an...

CVE-2026-94383

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...

CVE-2026-94383

MISP versions prior to 2.5.47 are affected by an arbitrary code execution vulnerability in the blocklist workflow module . The module accepted a user-supplied blocklist filename parameter without validating the file extension, applying only basename() to strip path components and a check for empt...

CVE-2026-94383 MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...

CVE-2026-88857 Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions saveWatermark copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension chec...