CVE-2026-13716

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

CVE-2026-13716

Crafty Controller is affected by CVE-2026-13716, which exposes a path traversal vulnerability in server import and admin file upload. The issue allows a remote, authenticated attacker to upload files to arbitrary paths that the Crafty Controller application can access, enabling remote code execut...

EUVD-2026-55949

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

CVE-2026-13716

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

GHSA-FG7F-2386-8897 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-58248

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

EUVD-2026-55877

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

PT-2026-70890

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user id HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

PT-2026-70924

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

PT-2026-70903

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

PT-2026-70132

Name of the Vulnerable Software and Affected Versions Cockpit CMS version 2.6.0 Description An unrestricted file upload issue allows authenticated users to upload files with any extension, including PHP scripts, through the asset upload endpoint. This occurs because the allowed uploads...

Podlove Podcast Publisher 4.5.1 Shell Upload

A proof of concept exploit for an unauthenticated arbitrary file upload vulnerability leading to remote code execution in Podlove Podcast Publisher version 4.5.1. The vulnerability uses inconsistent parsing of an attacker-controlled source URL, allowing a GIF/PHP polyglot to pass file-type...

Blocksy Companion 2.1.46 Shell Upload

Blocksy Companion version 2.1.46 suffers from an unauthenticated arbitrary file upload and double-extension bypass that allows for shell uploads. !/usr/bin/env python3 Exploit Title: Blocksy Companion 2.1.46 - RCE CVE: CVE-2026-58480 Date: 2026-07-13 Exploit Author: Mohammed Idrees Banyamer Autho...

CVE-2026-72592

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CVE-2026-72592 dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CVE-2026-72592

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CVE-2026-72592

CVE-2026-72592 affects dulldusk/phpfm up to version 1.8.0, where an unrestricted file upload is possible. The root cause is an empty upload extension filter and no authentication by default, enabling an unauthenticated remote attacker to upload a PHP webshell and execute it by accessing the uploa...

EUVD-2026-55214

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter = array and no authentication enabled by default authpass is empty string,...

CVE-2026-72583

CVE-2026-72583 affects fastschema up to v0.15.1. A stored XSS exists when uploading SVGs due to a MIME type bypass: the PutMultipart path validates the Content-Type header instead of inspecting file content, enabling an attacker (low-privileged, authenticated) to rename files to .jpg while declar...

CVE-2026-72583 fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...