CVE-2026-57966: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized...

CVE-2026-57966: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized...

PT-2026-53627

A Path Traversal vulnerability in the partition msg function allows an attacker to write or overwrite arbitrary files on the filesystem when processing malicious MSG files with attachments. Impact An attacker can craft a malicious .msg file with attachment filenames containing path traversal...

PT-2026-53442

A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the /3/Parse endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the...

PT-2026-53388

Summary bbot's gitdumper.py insufficiently sanitises a .git/config file, leading to Remote Code Execution RCE. bbot's gitdumper.py can be made to consume a malicious .git/index file, leading to arbitrary file write which can be used to achieve Remote Code Execution RCE. Impact A user who uses bbo...

PT-2026-53546

| Field | Value | |---|---| | Severity | Critical | | Type | Path traversal -- arbitrary file write via tar.extract without member validation | | Affected | src/praisonai/praisonai/cli/features/recipe.py:1170-1172 | Summary cmd unpack in the recipe CLI extracts .praison tar archives using raw...

PT-2026-53551

The Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker or compromised agent to write to arbitrary files outside of the configured workspace directory. By supplying relative path segments ../ in the target path, malicious actions can overwrite sensitive...

PT-2026-53416

eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises...

PT-2026-53600

Impact What kind of vulnerability is it? Who is impacted? An Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin. Developers who have built applications which include Microsoft's Semantic Kernel .NET SDK and...

PT-2026-53362

Summary The Binary Stream Capture BSC component exposes an unauthenticated HTTP API for dynamically creating packet capture “handlers.” Because the code blindly trusts path‑related form fields, a remote client can: - Bypass the configured log root and direct BSC to log to arbitrary filesystem...

pheditor-file-write-rce-cve

CVE-2026-XXXXX Arbitrary File Write Leading to Remote Code...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the ServeCreateOrUpdatePlaylist process. An attacker can overwrite or create arbitrary files on the host system by supplying a crafted playlist ID that resolves to an...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the ServeCreateOrUpdatePlaylist process. An attacker can overwrite or create arbitrary files on the host system by supplying a crafted playlist ID that resolves to an...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the ServeCreateOrUpdatePlaylist process. An attacker can overwrite or create arbitrary files on the host system by supplying a crafted playlist ID that resolves to an...

NPM: pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

NPM: pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File Path Traversal vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.0...

GHSA-RXHJ-4M44-96R4 pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

Summary pnpm's patch application pipeline @pnpm/patch-package performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pn...

Directory Traversal

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to Directory Traversal via the patch application process. An attacker can overwrite or delete arbitrary files on the filesystem by submitting a malicious .patch file containing crafted...

pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

Summary pnpm's patch application pipeline @pnpm/patch-package performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pn...

EUVD-2026-39492

pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File Path Traversal...

Directory Traversal

Overview patool is a portable archive file manager Affected versions of this package are vulnerable to Directory Traversal in the safeextract function in patoolib/programs/pytarfile.py when running on Python versions before 3.12, due to the use of os.path.commonprefix for character-level string...