402521 matches found
EUVD-2026-58087
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...
CVE-2026-73509 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...
CVE-2026-73509 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...
CVE-2026-73509
OpenList CVE-2026-73509 affects the batch_rename path: before 4.2.4, the /api/fs/batch_rename handler validates only the destination and a subset of the source directory, but does not validate attacker-controlled renameObject.SrcName. An authenticated user with rename permission can inject traver...
CVE-2026-73509 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...
atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read
The optional dashboard HTTP server atomicagents/dashboard/serve.py builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through io.saferesolveunder. Literal ../ segmen...
CVE-2026-66657
Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...
CVE-2026-66656
Unauthenticated Local File Inclusion in Foton Core = 1.1.1 versions...
CVE-2026-66653
Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...
CVE-2026-66450
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
CVE-2026-65582
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
CVE-2026-61980
Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...
CVE-2026-28189
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...
CVE-2026-28157
Subscriber Path Traversal in Do Lasso = 358 versions...
EUVD-2026-50562
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials...
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...
GHSA-H7P7-W5GC-XJ3W Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
Description src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts both compute their temporary working-file paths as: ts const randNum = Math.floorMath.random 0xFFFFFFFF; const srcFile = $os.tmpdir/etherpadexport$randNum.html; const destFile =...
OESA-2026-3355 gimp security update
The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing...