Fortinet FortiNAC - Arbitrary File Write

Fortinet FortiNAC is susceptible to arbitrary file write. An external control of the file name or path can allow an attacker to execute unauthorized code or commands via specifically crafted HTTP request, thus making it possible to obtain sensitive information, modify data, and/or execute...

PT-2026-97605

Name of the Vulnerable Software and Affected Versions Laravel-Mediable versions 7.0.0 through 7.0.1 Description An incomplete patch in the forbidden extensions blocklist within config/mediable.php allows the upload of files with the .pht extension. While other PHP-related extensions are blocked,...

CVE-2026-5695: Unrestricted Upload of File with Dangerous Type

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions, including email handlers that may include uploaded files as attachments. In affected configuration...

PT-2026-97267

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Authenticated users can upload files to the server without restrictions due to a lack of proper validation in upload forms. This flaw allows for arbitrary file...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files. The module does not sufficiently force certain uploaded file types to download when served. Under certain site...

CVE-2026-93352: Unrestricted Upload of File with Dangerous Type

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbiddenextensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via...

PT-2026-97400

Name of the Vulnerable Software and Affected Versions Neethuharii CafeManagement affected versions not specified Description A security flaw allows remote attackers to perform unrestricted file uploads. This occurs due to improper processing of the image argument within the 'AddProductCode.php'...

PT-2026-97658

Name of the Vulnerable Software and Affected Versions Drupal Webform affected versions not specified Description Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they ar...

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

Summary The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment. In local stdio deployments, this can expose files readable by the user's MCP...

GHSA-F6PJ-QV47-G96W MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

Summary The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment. In local stdio deployments, this can expose files readable by the user's MCP...

CVE-2026-88419

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...

CVE-2026-77262

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment accepts an attacker-controlled filepath and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside...

CVE-2026-77269

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A caller can provide an absolute or traversal filepat...

CVE-2026-77248

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...

CVE-2026-77246

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, an HTTP transport deployment with READONLYMODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including...

EUVD-2026-84763

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...

CVE-2026-77247 MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user...

CVE-2026-77247

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) is vulnerable to an arbitrary server-local file upload on Jira and Confluence. The root cause is the interpretation of caller-controlled path arguments within the file_path and file_paths parameters. Specifically, the too...

CVE-2026-77247 MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user...