14100 matches found
CVE-2026-41861 Arbitrary Root File Write via Path Traversal in BOSH agent
Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu. Affected versions: BOSH...
CVE-2026-41861 Arbitrary Root File Write via Path Traversal in BOSH agent
Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to any path ending in .network, and create any missing parent directories with mode 0777 via network Alias on Ubuntu. Affected versions: BOSH...
CVE-2026-3418 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...
File Inclusion rollup Dependency in Jira Service Management Data Center
This High severity File Inclusion vulnerability was introduced in versions 11.3.8 of Jira Service Management Data Center. This File Inclusion vulnerability, with a CVSS Score of 8.8 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P allows an unauthenticated...
WordPress Instant Appointment RCE (CVE-2026-15282)
Exploits CVE-2026-15282 in Instant Appointment = 1.2: unauthenticated addservicefront AJAX passes imageurl/imagename to filegetcontents and fileputcontents. Delivers the configured framework PHP payload via data:// base64 primary or a local HTTP server fallback, writes under wp-content/uploads/,...
Malicious code in agenthub-multiagent-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a agenthub-multiagent-mcp ships a worker dist/worker.js that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/ and, fo...
Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.
Summary All versions of sevenz-rust fail to validate file paths when extracting in decompressimpl the underlying function used in the exposed decompress api functions. This oversight allows a maliciously crafted archive to extract outside the extraction directory, from both relative paths such as...
RUSTSEC-2026-0245 Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.
Summary All versions of sevenz-rust fail to validate file paths when extracting in decompressimpl the underlying function used in the exposed decompress api functions. This oversight allows a maliciously crafted archive to extract outside the extraction directory, from both relative paths such as...
PT-2026-68782
Name of the Vulnerable Software and Affected Versions Dinky version 1.2.5 Description The POST '/download/uploadFromRsByLocal' endpoint fails to validate the path parameter, which is passed directly to the new Filepath and file.transferTodest functions. This allows an attacker to write arbitrary...
PT-2026-68724
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The System REST API fails to properly validate file types or destinations during user-supplied file uploads. This allows an authenticated user with administrativ...
CVE-2026-41862 - Arbitrary Root File Write via Path Traversal in BOSH agent | Cloud Foundry
Low CVSSv4: Low 2.3 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSSv3: Medium 4.2 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Vendor CloudFoundry Foundation Versions Affected Severity is Medium unless otherwise noted. BOSH – All bosh agent versions v2.847.0 jammy = v1.1202, ...
CVE-2026-70558: Unrestricted Upload of File with Dangerous Type
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...
CVE-2026-3418: Unrestricted Upload of File with Dangerous Type
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...
CVE-2026-41861 - Arbitrary Root File Write via Path Traversal in BOSH agent | Cloud Foundry
Severity Low CVSSv4: Low 2.3 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSSv3: Medium 4.2 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Vendor CloudFoundry Foundation Versions Affected Severity is Medium unless otherwise noted. BOSH – All bosh agent versions v2.847.0 jammy =...
IBM Langflow OSS path traversal vulnerability
IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a path traversal vulnerability. This vulnerability arises from the use of user-provided knowledge base names directly for creating file paths. Without proper cleaning or check...
Exploit for Path Traversal in Gogs
CVE-2025-8110 – Gogs ≤ 0.13.3 RCE PoC Proof-of-Concept for...
rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
Summary With -l/--links, rclone serializes symlinks as .rclonelink text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with os.Symlink, and performs NO validation of the target. If the source is attacker-controlled, the...
GHSA-CF44-9PGV-M4XC rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
Summary With -l/--links, rclone serializes symlinks as .rclonelink text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with os.Symlink, and performs NO validation of the target. If the source is attacker-controlled, the...
CVE-2026-66881
Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare fileentries metadata, each entry carrying a name. Every path that creates a file entry through...
CVE-2026-66881 Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download
Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare fileentries metadata, each entry carrying a name. Every path that creates a file entry through...