CVE-2025-8110

CVE-2025-8110 - Gogs symlink bypass - arbitrary file write as the Gogs process user Gogs //contents/. Gogs follows the symlink and writes attacker-controlled bytes to the link target with the privileges of the Gogs process. When Gogs runs as root this is an arbitrary root file write - e.g. drop a...

GL.iNet <= 4.3.7 - Arbitrary File Write

GL.iNet = 4.3.7 is vulnerable to an arbitrary file write exploit, allowing an attacker to overwrite arbitrary system files. id: CVE-2023-46455 info: name: GL.iNet = 4.3.7 - Arbitrary File Write author: Zierax severity: high description: | GL.iNet = 4.3.7 is vulnerable to an arbitrary file write...

Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite

A vulnerability in the backuprun function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the runhash and repo.path parameters, which can be manipulated to create an...

Adobe ColdFusion - RDS Arbitrary File Write

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated...

CVE-2026-27876

CVE-2026-27876: Grafana SQL Expressions Arbitrary File Write to RCE CVSS 9.1 Critical | Arbitrary File Write | Remote Code Execution Demo https://github.com/user-attachments/assets/c84a4b63-7928-4dba-a069-3bafa036ce56 Summary Grafana's SQL Expressions feature sqlExpressions toggle uses an...

CVE-2024-25641-Exploit-for-Cacti-1.2.26

CVE-2024-25641 Exploit for Cacti 1.2.26 Exploiting CVE-2024-25641 on Cacti 1.2.26. When a user is authenticated, an arbitrary file write vulnerability allows Remote Code Execution RCE. Overview This script automates the process of exploiting CVE-2024-25641 in Cacti 1.2.26. The vulnerability allow...

CVE-2024-44258

CVE-2024-44258: Symlink Vulnerability in ManagedConfiguration Framework Summary CVE-2024-44258 highlights a symlink vulnerability within the ManagedConfiguration framework and the profiled daemon in Apple devices. When restoring a crafted backup, the migration process fails to validate whether th...

EUVD-2026-108515

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a...

CVE-2026-115391

A flaw was found in Wasmtime. A malicious guest can cause a Denial of Service DoS on the host by submitting excessively large data buffers to file or HTTP write streams within the WebAssembly System Interface WASI. Because incoming guest writes are buffered in host memory without size limits, thi...

Linux Distros Unpatched Vulnerability : CVE-2026-114098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop that allows attackers to write arbitrary files outside the worktree...

Linux Distros Unpatched Vulnerability : CVE-2026-114096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by...

Linux Distros Unpatched Vulnerability : CVE-2026-114140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocess...

PT-2026-122101

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm:: execute subsequently applies rawurldecode to fullpath before...

Exch-CVE-2021-26855

Exch-CVE-2021-26855 ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability...

CVE-2021-26855

CVE-2021-26855 PoC of proxylogon chain SSRFCVE-2021-26855 to write file by testanull, censored by github Why does github remove this exploit because it is against the acceptable use policy - but tons of other proof of concept exploits and frameworks are OK?...

SUSE CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

CVE-2026-Pending-Flask-Uploads-Path-Traversal-PoC

CVE-2026-XXXXX Pending: Path Traversal in Flask-Uploads Vulnerability Information Product : Flask-Uploads Version : 0.2.1 and potentially older versions Vulnerability Type : Path Traversal Directory Traversal CWE-ID : CWE-22 Severity : HIGH CVSS 7.5 Impact : Arbitrary File Write, Remote Code...

POC-CopyEscape-CVE-2026-17106

CopyEscape — PoC for CVE-2026-17106 Educational Proof of Concept of CopyEscape CVE-2026-17106, a TOCTOU race condition vulnerability in docker cp that allows a malicious container to write arbitrary files on the Docker host. Inspired by the original work of masasron , who discovered and documente...

CVE-2026-73034-PoC

CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal → Arbitrary File Write CVSS 9.8 Critical · CWE-22 · GHSA/Issue 3104 Summary POST /api/v1/python/file/upload in DB-GPT v0.8.1 takes the user-id HTTP header and uses it raw as a path component : uploaddir = os.path.joinbasedir,...

CVE-2026-5027

This post is a research article published by EQSTLab. Thanks toYahia Hamza, who reported and analyzed this vulnerability. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Description CVE-2026-5027 : Langflow Arbitrary File Write Vulnerability description: A path...