SSRF and local file disclosure via unvalidated URLs

Applications that pass attacker-controlled URLs to webpage versions before 2.1.0 may be vulnerable to server-side request forgery SSRF or local file disclosure. HTTP::fetch and Webpage::fromurl passed URLs to libcurl without restricting the URL scheme or validating the resolved destination IP...

RUSTSEC-2026-0407 SSRF and local file disclosure via unvalidated URLs

Applications that pass attacker-controlled URLs to webpage versions before 2.1.0 may be vulnerable to server-side request forgery SSRF or local file disclosure. HTTP::fetch and Webpage::fromurl passed URLs to libcurl without restricting the URL scheme or validating the resolved destination IP...

DEBIAN-CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

AZL-112121 CVE-2026-115207 affecting package patch 2.7.6-10

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

CVE-2026-112832

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6...

CVE-2026-112820

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1...

CVE-2022-51025

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=dbbackup and ../ sequences in name to read files like...

CVE-2022-51022

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory...

CVE-2017-20289

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

CVE-2018-25438

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...

CVE-2019-25779

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...

CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

CVE-2026-112832 WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6...

CVE-2026-112832 WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6...

CVE-2026-112832

The CozyThemes Rootblox WordPress plugin (versions ≤ 1.0.6 ) is vulnerable to a PHP Local File Inclusion (LFI) flaw caused by Improper Control of Filename for Include/Require Statement in PHP Program (CWE-98). This vulnerability allows an attacker to include files from the local filesystem. Explo...

EUVD-2026-108139

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6...

CVE-2026-114665 Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read...

CVE-2026-114665

Goploy versions 1.18.0 before 1.18.1 are vulnerable to a link following vulnerability within the /deploy/fileDiff and /deploy/fileCompare endpoints. This flaw allows authenticated members to perform arbitrary file reads . Specifically, an attacker with repository write access can commit a symlink...

CVE-2026-114665 Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read...