CVE-2026-71284 Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

CVE-2026-71284 Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

CVE-2026-71284 Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

CVE-2026-71267

CVE-2026-71267 affects microtar. The mtar_write_file_header() and mtar_write_dir_header() functions copy a caller-supplied entry name into a 100-byte name field of a stack-allocated mtar_header_t using strcpy without validating length, allowing a stack buffer overflow if the filename is longer th...

CVE-2026-71267 microtar Stack Buffer Overflow in mtar_write_file_header() and mtar_write_dir_header()

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy...

Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060 On require of the package, index.js invokes setup in helpers.js which downloads a platform-specific native binary from split-string-obfuscated...

CVE-2026-18907

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

CVE-2026-18856

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

CVE-2026-18856

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

CVE-2026-70592 Ghost: Database Backup Path Traversal

Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...

EUVD-2026-52506

A stack-based buffer overflow vulnerability exists in the cmdedl function of OreSat Firmware v1.0. The vulnerability is triggered when processing the edl fwflash command, where the argument is copied to a 64-byte stack buffer via memcpy without proper length validation. An attacker with physical...

CVE-2026-18601

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.checkconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack ...

EUVD-2026-52271

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.checkconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack ...

CVE-2026-67673

CVE-2026-67673 affects OreSat Firmware v1.0. The vulnerability resides in the cmd_edl function, triggered by the edl fw_flash command. The argument is copied to a 64-byte stack buffer via memcpy without proper length validation, enabling a stack-based buffer overflow. An attacker with physical a...

CVE-2026-67673

A stack-based buffer overflow vulnerability exists in the cmdedl function of OreSat Firmware v1.0. The vulnerability is triggered when processing the edl fwflash command, where the argument is copied to a 64-byte stack buffer via memcpy without proper length validation. An attacker with physical...

GHSA-98PP-VCCM-QM25 Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Summary rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example shell.php.any.jpg. The check only catches the blocked extension when it appears at the en...

EUVD-2026-51626

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with mediaupload permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with...

CVE-2026-63223

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-56671

The CVE-2026-56671 affects ComfyUI prior to 0.28.0. Root cause: get_model_preview in app/model_manager.py constructs a path using os.path.join(folder, filename) with an unrestricted {filename} capture, allowing path traversal via literals like ../, encoded traversal, absolute paths, or an unbound...

CVE-2026-63223 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...