asyncssh has SCP Path Traversal to Arbitrary File Write

| | ||---|---|| Product | asyncssh all versions through 2.23.0 || Related | CVE-2019-6111 same class in OpenSSH || Fix | AsyncSSH 2.23.1 |A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP recei...

PYSEC-2026-3808 asyncssh has SCP Path Traversal to Arbitrary File Write

| | | |---|---| | Product | asyncssh all versions through 2.23.0 | | Related | CVE-2019-6111 same class in OpenSSH | | Fix | AsyncSSH 2.23.1 | A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP...

praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

Summarypraisonaiagents/memory/filememory.py::FileMemory.init constructs allmemory file paths by directly joining the userid parameter to a base path:pythonself.userpath = self.basepath / userid LINE 145 — no sanitizationNo validation or normalization is applied to userid before the path join.An...

PYSEC-2026-3902 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

Summary praisonaiagents/memory/filememory.py::FileMemory.init constructs all memory file paths by directly joining the userid parameter to a base path: python self.userpath = self.basepath / userid LINE 145 — no sanitization No validation or normalization is applied to userid before the path join...

praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

Target: PraisonAI MervinPraison/PraisonAIAffected component: praisonaiagents/tools/astgreptool.py — astgreprewriteAffected versions: master at ce97667156a116c50b4a3d1aa21e09f048903fda; reproduced against the current praisonaiagents PyPI release praisonaiagents = 1.6.52. SummaryTools in...

Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

A vulnerability in huggingface/transformers versions 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

ONNX: TOCTOU arbitrary file read/write in save_external_dat

SummaryThe saveexternaldata method seems to include multiple issues introducing a local TOCTOU vulnerability, an arbitrary file read/write on any system. It potentially includes a path validation bypass on Windows systems.Regarding the TOCTOU, an attacker seems to be able to overwrite victim's...

CVE-2026-88265 Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

CVE-2026-88265 Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

PT-2026-89634

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A path traversal issue allows a remote authenticated attacker to arbitrarily write to or delete files on shared storage. Path traversal is a flaw that allows an attacker to access...

CVE-2026-49836: Improper Limitation of a Pathname to a Restricted Directory

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

PT-2026-89725

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with pat...

PT-2026-89721

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/upload file/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

PT-2026-89494

Warning: A critical path traversal vulnerability in Plesk Backup Manager allows arbitrary root file writes by authenticated customers. CVE-2026-68487 CVSS3.0: 9.9. Read the advisory https://t.co/GniZ2f5Oox and Patch Patch Patch...

PT-2026-89599

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description An authenticated user can send a specially crafted request to write arbitrary files on the system. Recommendations At the moment, there is no information...

CVE-2026-86087: Improper Limitation of a Pathname to a Restricted Directory

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system...

PT-2026-89478

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal...

CVE-2026-88937: Improper Limitation of a Pathname to a Restricted Directory

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal...

CVE-2026-68487: Absolute Path Traversal

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...

CVE-2026-76652: Improper Limitation of a Pathname to a Restricted Directory

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality cou...