PT-2026-59393

Cross-User File Access via Unchecked file id in Folder Knowledge and Knowledge-Base Attach Endpoints Summary Multiple endpoints accept a user-supplied file id and attach the referenced file to a resource the caller controls folder knowledge, knowledge-base contents without verifying that the call...

CVE-2026-14906: Unrestricted Upload of File with Dangerous Type

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4...

CVE-2026-13014: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in Thales CERT "Suspicious" application = 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent...

PT-2026-59433

Impact The save report tool in openchatbi/tool/save report.py suffers from a critical path traversal vulnerability due to insufficient input sanitization of the file format parameter. The function only removes leading dots of file format using file format.lstrip"." but allows path traversal...

PT-2026-59384

Summary Any authenticated user can overwrite any file's content by ID through the POST /api/v1/retrieval/process/files/batch endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via GET /api/v1/knowledge/id/files a...

PT-2026-59531

Summary This vulnerability has been fixed in https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00. The save generated slides MCP tool accepts a pptx path argument and writes the generated PPTX file to that path without any workspace restriction or path validation:...

PT-2026-67303

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.51 Description GitPython fails to properly sanitize arguments passed to several public APIs, allowing for command injection and arbitrary file manipulation. The issue occurs because the software does not enforce...

wasmtime: Wasmtime: Overwrite host files via insufficient permission checks in wasmtime-wasi

A flaw was found in Wasmtime, a runtime for WebAssembly. A WebAssembly System Interface WASI guest with a read-only source file capability can exploit this vulnerability. During hard-link creation and renaming operations, the system checks directory permissions but fails to match file permissions...

CVE-2026-53449

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

CVE-2026-53449

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

UBUNTU-CVE-2026-53449

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

CVE-2026-53449

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

CVE-2026-53449

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

EUVD-2026-42768

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...

Symlink Attack

Overview org.webjars.npm:decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Symlink Attack via the fs.link process. An attacker can gain unauthorized access to sensitive files or corrupt file contents by crafting an archive...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +28599 more potentially affected by CVE-2026-39245 via decompress (>=0.1.6, <=4.2.1)

decompress NPM version =0.1.6, =1.0.0, =0.0.1, =0.0.4 - 1095h-cli 1.0.1 - 10secondsofcode-custom 1.0.0 and more Source cves: CVE-2026-39245 Source advisory: SNYK:JS-DECOMPRESS-17937347...

PT-2026-93848

Name of the Vulnerable Software and Affected Versions oras-go versions prior to 2.6.2 Description An issue in the content/file.Store component of the oras-go library allows for arbitrary file creation or overwrite outside the intended working directory. This occurs when extracting OCI layers mark...

CVE-2026-60089: Improper Limitation of a Pathname to a Restricted Directory

PraisonAI pip package praisonaiagents before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate the defaults.output.outputfile path. A repository-controlled config file can set outputfile to an absolute or '..' travers...

CVE-2026-53449: External Control of File Name or Path

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

CVE-2026-15302: Absolute Path Traversal

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files e.g., CSS to directories outside the...