UBUNTU-CVE-2026-62996

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

UBUNTU-CVE-2026-62992

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 5.8.2 and 4.5.7 on the 4.x line, Security::checkDir does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. A...

CVE-2026-62992

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 5.8.2 and 4.5.7 on the 4.x line, Security::checkDir does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. A...

GHSA-HH9P-6WH2-4MFC GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

Summary IndexFile.remove and Head.checkout forward kwargs into git rm and git checkout with no guard. Passing --pathspec-from-file= together with --pathspec-file-nul makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec error quotes it verbatim. GitPython...

External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path in the remove and checkout functions. An attacker can access the contents of arbitrary files by supplying crafted arguments to...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the stream resource type, which allows bypassing intended security checks on PHP stream wrappers. An attacker can read arbitrary local files accessible to the PHP process by including specially crafted templa...

CVE-2026-62996 Smarty Security stream restriction bypass through stream: resource

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the Security::checkDir process. An attacker can access arbitrary files outside of trusted directories by creating a symbolic link within a trusted directory and causing a template to reference th...

CVE-2026-62992

Smarty (PHP template engine) prior to 5.8.2 and 4.5.7 (4.x line) is affected by a symlink path-traversal in Security::_checkDir() that does not fully resolve symbolic links before validating the directory containment. An attacker who can place or reference a symlink inside a trusted Smarty direct...

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

EUVD-2026-54488

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

CVE-2026-66491

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

CVE-2026-66491 Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

CVE-2026-66491

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

CVE-2026-66491 Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

EUVD-2026-54412

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

CVE-2026-66491

CVE-2026-66491 affects the Joomla extension phoca.cz Phoca Commander (versions 1.0.0–6.1.3). The issue is an improper limitation of paths in the getSource function, enabling an arbitrary file read. The CVSS v4 metrics indicate a high severity (8.2) with network attack vector, low attack complexit...

CVE-2026-61632

A flaw was found in PyMdown Extensions. The b64 extension, used for inlining images in Markdown, is vulnerable to a path traversal issue. An attacker can craft untrusted Markdown with specially formed image source containing directory traversal sequences e.g., ../ or absolute paths. This allows t...

UBUNTU-CVE-2026-61632

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured basepath with...