CVE-2026-86258

nbviewer through version 1.0.1 is affected by a path traversal vulnerability in LocalFileHandler.can_show(). The root cause is the use of string-prefix comparison instead of proper path validation, allowing attackers to request paths that share the configured root as a textual prefix and thereby ...

CVE-2026-86258 nbviewer through 1.0.1 Path Traversal via LocalFileHandler

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.canshow that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefi...

EUVD-2026-72109

h3 npm package versions = 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic. On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments %2e%2e are passed to decodeURI and decoded to ../ sequences without sanitization. An unauthenticated remote...

CVE-2026-86258: Improper Limitation of a Pathname to a Restricted Directory

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.canshow that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefi...

PT-2026-86528

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can show that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual...

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

CVE-2026-85693

Chatbot UI (open-source chat application) contains an authorization bypass in its retrieval endpoint (/api/retrieval/retrieve). The root cause is a service-role Supabase client that bypasses row-level security and fails to validate file ownership, allowing any authenticated user to retrieve index...

CVE-2026-85693 Chatbot UI Cross-User Private File Content Disclosure via Retrieval API

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

CVE-2026-85671 QAnything 2.0.0 Unauthenticated Cross-User File Disclosure

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and...

CVE-2026-85671

QAnything 2.0.0 contains an authentication bypass in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints. Unauthenticated attackers can enumerate file identifiers and retrieve base64-encoded files or parsed document chunks without ownership verification, enabling cross-t...

CVE-2026-85671 QAnything 2.0.0 Unauthenticated Cross-User File Disclosure

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and...

EUVD-2026-71127

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and...

EUVD-2026-70903

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

Flextype CMS 1.0.0-alpha.3 Path Traversal

Flextype CMS version 1.0.0-alpha.3 contains a path traversal vulnerability in the Entries copy functionality. An authenticated remote attacker can supply directory traversal sequences within both the source id and destination newid parameters submitted to /api/v1/entries/copy...

jdbhttpd 0.1.0 Path Traversal / File Disclosure

jdbhttpd version 0.1.0 suffers from path traversal and file disclosure vulnerabilities. https://packetstorm.news/download/230538...

CVE-2026-85671: Missing Authentication for Critical Function

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and...

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

CVE: This vulnerability corresponds to CVE-2026-69086. Summary Four attribute-view read endpoints build a filesystem path from a caller-controlled id/avID and read it without confining the result to the attribute-view storage directory DataDir/storage/av/. On the load file-exists code path there ...

GHSA-GW25-M53R-QH88 SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

Summary SiYuan's /export/ file handler was hardened against export disclosure issue 12213 by adding an IsSubPathexportBaseDir, fullPath check and an IsSensitivePath check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit...

SUSE CVE-2026-84373

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without...

File Inclusion postcss Dependency in Jira Software Data Center

This High severity File Inclusion vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This File Inclusion vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...