CVE-2026-69355

CVE-2026-69355 is a Remote Code Execution vulnerability in Microsoft Exchange Server caused by external control of a file name or path . An authorized attacker with low privileges can exploit this over the network without user interaction, leading to high impact on confidentiality, integrity, and...

Skype for Business Remote Code Execution Vulnerability

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network...

CVE-2026-62804: External Control of File Name or Path

External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally...

CVE-2026-78620: External Control of File Name or Path

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...

CVE-2026-69805: External Control of File Name or Path

External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69355: External Control of File Name or Path

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network...

PT-2026-88281

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network...

PT-2026-87395

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description External control of a file name or path allows an authorized attacker to execute arbitrary code over a network, which can affect the system. Recommendations At the moment,...

PT-2026-87210

External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally...

CVE-2026-69383: External Control of File Name or Path

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...

PT-2026-85398

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument file name leads to path traversal. The attack may be performed from remote. The...

PT-2026-85421

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

ROS-20260901-73-0032

The vulnerability in the incus is related to incorrect external management of the name or file. Exploiting this vulnerability can allow an attacker to increase their privileges...

PT-2026-83997

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE NAME value used by set file name and load meta data in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILE NAME value with the settings...

Linux Distros Unpatched Vulnerability : CVE-2026-59314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file...

EUVD-2026-67850

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

Microsoft Edge (Chromium-based) Spoofing Vulnerability

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-66324: External Control of File Name or Path

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

DEBIAN-CVE-2026-59314

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

CVE-2026-59314

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...