CVE-2026-80104

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

EUVD-2026-66108

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

CVE-2026-80104 DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

CVE-2026-80104 DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

CVE-2026-80104

DB-GPT 0.8.0 is affected by a path traversal vulnerability in the skill_upload endpoint (in agentic_data_api.py). The function constructs the destination path using the multipart filename directly via the / operator without canonicalization or a containment check under the upload directory. An ab...

CVE-2026-80104 DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

CVE-2026-66152

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

CVE-2026-66152

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

CVE-2026-66152

A Path traversal vulnerability exists in the SonicWall NetExtender Linux client file extractor component, specifically within the OPSWAT tarball . This flaw allows an attacker to write arbitrary files with root privileges by using special characters like ../ to access directories outside the inte...

EUVD-2026-65747

A Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an attacker to write arbitrary file as root...

CVE-2026-66152

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

GO-2026-6284 3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation in github.com/mhsanaei/3x-ui

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation in github.com/mhsanaei/3x-ui...

GO-2026-6253 moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive...

GHSA-XC9G-J69Q-37XW consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

Impact An arbitrary file write vulnerability CWE-73, External Control of File Name or Path exists in the consciousness-explorer component of sublinear-time-solver. The MCP exportstate and importstate tool accepted a user-supplied filepath argument and passed it directly to fs.writeFileSync /...

consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

Impact An arbitrary file write vulnerability CWE-73, External Control of File Name or Path exists in the consciousness-explorer component of sublinear-time-solver. The MCP exportstate and importstate tool accepted a user-supplied filepath argument and passed it directly to fs.writeFileSync /...

NPM: consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

NPM: consciousness-explorer / sublinear-time-solver MCP exportstate has an arbitrary file write vulnerability discovered by ? in WordPress Npm consciousness-explorer versions 1.1.2...

NPM: consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

NPM: consciousness-explorer / sublinear-time-solver MCP exportstate has an arbitrary file write vulnerability discovered by ? in WordPress Npm sublinear-time-solver versions 1.6.0...

CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. The vulnerability is a path traversal in the MCP server tools: export_state and import_state (in src/consciousness-explorer/mcp/server.js) and saveVectorToFile / loadVecto...

CVE-2026-55609 sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

EUVD-2026-65706

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...