CVE-2026-111925 Mopidy before 4.0.5 Path Traversal via File Backend library.lookup

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...

CVE-2026-111925

Mopidy versions prior to 4.0.5 are vulnerable to a path traversal vulnerability in the File Backend library. The root cause is a missing containment check in the FileLibraryProvider.lookup() function. This flaw allows unauthenticated clients to access local files outside the designated file/media...

GHSA-X883-2VMG-XWF7 Authelia's Group Changes may not have the expected results (YAML file backend)

Impact Under very specific conditions changes to a users groups may not have the expected results. The specific conditions are: The file authentication backend is being used. The watch option is set to true. The refreshinterval is configured to a non-disabled value. The users groups are adjusted ...

GHSA-733V-22MG-7F8W TYPO3 Cross-site Scripting vulnerability in the file backend module

Cross-site scripting XSS vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

GNU glibc denial of service vulnerability (CNVD-2015-01962)

glibc is the libc library, or c runtime library, released by GNU. glibc is the lowest level api in the linux system, and almost any other runtime library will depend on glibc. Name Service Switch NSS's file backend fails to isolate the entire database iteration from key-based query API calls, and...

Oracle Linux 7 : glibc (ELSA-2015-0327)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0327 advisory. - Fix parsing of numeric hosts in gethostbynamer CVE-2015-0235, 1183545. - Prevent NSS-based file backend from entering infinite loop when different AP...

CVE-2008-5644

Cross-site scripting XSS vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2008-5644: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...