PT-2026-85573

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument...

Nodemailer SSRF

The vulnerability of the MailComposer.compile method in the Nodemailer email sending library is related to improper external manipulation of file names or file paths. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information and perform an SSRF attack...

EUVD-2026-68920

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the...

PT-2026-84073

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the...

NLTK Bypass Arbitrary File Read Write

The vulnerability of the application programming interface of the Natural Language Processing library NLTK is related to improper external management of file names or file paths. Exploiting this vulnerability can allow an attacker to bypass existing security mechanisms and gain read-write access ...

CVE-2026-82665

yaojingang GEOFlow (up to 2.1.0) contains a path traversal vulnerability in the Image Library Cleanup component. The flaw resides in the unlink function of app/Http/Controllers/Admin/ImageLibraryController.php, where an attacker who controls the file_path argument can delete files outside the int...

CVE-2026-53508: External Control of File Name or Path

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

CVE-2026-66324

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

Microsoft Edge (Chromium-based) Spoofing Vulnerability

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-67569

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...

SUSE CVE-2026-72218

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlmfile refcount leak on cached nlmdofopen failure The cached-file path in nlmlookupfile reaches the found: label unconditionally, even when nlmdofopen fails. At that label result and file-fcount are updated before th...

PT-2026-83262

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description External control of a file name or path allows an unauthorized attacker to perform spoofing over a network. Recommendations At the moment, there is no information about ...

Adminer Code Execution

The vulnerability of Adminer’s database management software lies in improper external manipulation of file names or file paths. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

NLTK Component Unauthorized Access

The vulnerability of the nltk.corpus.reader component in the NLTK library for symbolic and statistical processing of natural language is related to improper external management of file names or file paths. Exploiting this vulnerability may allow an attacker to gain unauthorized access to protecte...

GHSA-Q7M3-RHXG-7VXR n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

Affected versions 1.0.0 Patched version 1.0.0 Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to...

CVE-2026-79653

In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal. The...

CVE-2026-40526

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...

CVE-2026-81743 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-81743 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-81743

Flowintel versions >=3.3.0 allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this value, an attacker with high privileges can set LOG_...