CVE-2026-24486

A flaw was found in Python-Multipart, a tool for parsing multipart form data in Python applications. This vulnerability, known as path traversal, allows a remote attacker to write uploaded files to any location on the server's file system. This exploitation occurs when specific non-default...

SUSE CVE-2026-22786

Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin = v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpointcontinue.go file, the MakeFile function accepts a fileName...

CVE-2026-24478

CVE-2026-24478 — AnythingLLM is affected by a prior to 1.10.0 path traversal in the DrupalWiki integration that allows a malicious admin (or an attacker tricking an admin) to write arbitrary server files, enabling Remote Code Execution (RCE) by overwriting configuration files or adding scripts. M...

CVE-2026-24478 AnythingLLM vulnerable to Path Traversal

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.10.0, a critical Path Traversal vulnerability in the DrupalWiki integration allows a malicious admin or an attacker who can convince an admin to configure...

EUVD-2026-4733

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.10.0, a critical Path Traversal vulnerability in the DrupalWiki integration allows a malicious admin or an attacker who can convince an admin to configure...

CVE-2026-23888 pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside the intended extraction directory. The vulnerability has two attack vectors: 1 Malicious ZIP entries containing ../ or absolute paths that...

Relative Path Traversal

Overview @pnpm/package-bins is a that returns bins of a package. Affected versions of this package are vulnerable to Relative Path Traversal via the commandsFromBin function when performing bin name validation and normalization. An attacker can create or overwrite arbitrary files outside the...

PT-2026-4841

Name of the Vulnerable Software and Affected Versions Python-Multipart versions prior to 0.0.22 Description Python-Multipart is a streaming multipart parser for Python. A Path Traversal issue exists when using non-default configuration options UPLOAD DIR and UPLOAD KEEP FILENAME=True. An attacker...

CVE-2026-24137 sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client pkg/tuf/client.go supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from...

CVE-2026-24137

CVE-2026-24137 affects the sigstore framework (Go library used by sigstore services/clients). In versions ≤ 1.10.3, the legacy TUF client stores cached target files on disk by constructing a filesystem path from a cache base directory and a name from signed target metadata, without ensuring the p...

GHSA-FCV2-XGW5-PQXF sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

Summary The legacy TUF client pkg/tuf/client.go, which supports caching target files to disk, constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata, but it does not validate that the resulting path stays within the cache base...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the joinCleanPath function. An attacker can access sensitive information by supplying crafted input that causes traversal outside of intended directories. Details A Directory Traversal attack also known as path...

OPENSUSE-SU-2026:20080-1 Security update for buildah

This update for buildah fixes the following issues: - CVE-2025-47914: golang.org/x/crypto/ssh/agent: Fixed non validated message size causing a panic due to an out of bounds read bsc1254054 - CVE-2025-47913: golang.org/x/crypto/ssh/agent: Fixed client process termination when receiving an...

EUVD-2026-3595

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS...

EUVD-2026-3402

esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages...

CVE-2026-23949

A flaw was found in jaraco.context. The jaraco.context.tarball function is vulnerable to a Zip Slip path traversal when processing malicious tar archives. A remote attacker can exploit this by crafting a specially designed tar file, which, when extracted, allows files to be written outside the...

CVE-2026-23950

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the path-reservations system. On case-insensitive or normalization-insensitive filesystems such as macOS APFS, In which it has...

CVE-2026-23950 node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the path-reservations system. On case-insensitive or normalization-insensitive filesystems such as macOS APFS, In which it has...

MiracleLinux 8 : git-2.43.7-1.el8_10 (AXSA:2025-10623:09)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10623:09 advisory. git: Git does not sanitize URLs when asking for credentials interactively CVE-2024-50349 git: Newline confusion in credential helpers can lead to...

MiracleLinux 8 : rsync-3.1.3-14.el8.3 (AXSA:2022-3734:04)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3734:04 advisory. rsync: remote arbitrary files write inside the directories of connecting peers CVE-2022-29154 Tenable has extracted the preceding description block directly...