240 matches found
CVE-2023-38831-POC
描述 名称 : CVE-2023-38831 CVSS 评分 : 7.8 受影响版本 : Winrar 6.23 CVE-2023-38831 是一个零日漏洞，影响所有低于 6.23 版本的 WinRAR。 问题出在 ZIP 格式的处理上，攻击者可以利用受影响的压缩包来分发恶意软件。恶意行为者可以在 ZIP 压缩包内将恶意文件伪装成与合法文件相似的名字，诱骗用户打开似乎安全的文件，从而执行有害内容。此漏洞自 2023 年 4 月以来已被积极利用，尤其针对金融行业，给打开不受信任压缩文件的用户带来重大风险。升级到 WinRAR 6.23 或更高版本可通过改进提取过程中的文件名清理来缓解此漏...
POC-CVE-2026-19679
CVE-2026-19679 — insufficient sanitization of uploaded filenames input validation Status: CONFIRMED on a 6.7.2-14.el9 lab 2026-08-20. POST /rest/auditFile with tailoringOriginalFilename = "poc;touch$IFSpoc19679;me.xml" returned HTTP 200 and registered AuditFile 1000002 — the shell-metachar filena...
CVE-2026-48813-POC
Flawfinder-ANSI-Exploit-POC 在 Flawfinder 2.0.19 版本中，解析可能恶意的文件名时未进行文件名清理。已知受影响的终端基于 libvte，以下示例展示了一个 mate-terminal。 此漏洞已于 2026年5月17日 由 David Wheeler 和我在 2.0.20 版本中修复。 本仓库包含一个示例 POC bash 脚本以及关于该漏洞工作原理的一些信息。 漏洞利用演练 在示例目录中，可以包含任意数量的文件，如下所示： 这些文件都包含相同的 C 代码： root@kitploit: include void fchar s char...
CVE-2026-35585-poc
CVE-2026-35585: File Browser OS命令注入 PoC English version 概述 此仓库是 File Browser （版本 2.0.0 至 2.33.1）中发现的一个严重 OS 命令注入漏洞 CVE-2026-35585 的概念验证（PoC）。 该漏洞存在于“自定义命令钩子”功能中。由于在 shell 执行时，诸如 $FILE 或 $USERNAME 等环境变量未能得到充分清理，拥有文件上传权限的已认证用户可能利用恶意文件名在主机系统上执行任意命令。 发现者: saku0512 https://github.com/Saku0512 ⚠️ 免责声明...
PYSEC-2026-3808 asyncssh has SCP Path Traversal to Arbitrary File Write
| | | |---|---| | Product | asyncssh all versions through 2.23.0 | | Related | CVE-2019-6111 same class in OpenSSH | | Fix | AsyncSSH 2.23.1 | A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP...
Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : SPICE vdagent vulnerabilities (USN-8723-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8723-1 advisory. It was discovered that SPICE vdagent had an integer overflow in the buffer size...
CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...
EUVD-2026-71133
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...
CVE-2026-82521
parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes...
CVE-2026-82521 parsedmarc 9.0.6 < 11.0.1 Path Traversal via Forensic Report Subject
parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes...
USN-8723-1 spice-vdagent vulnerabilities
It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, resulting in a denial of service. CVE-2026-57965 It was discover...
USN-8723-1: SPICE vdagent vulnerabilities
It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, resulting in a denial of service. CVE-2026-57965 It was discover...
Unity Linux 20.1070e Security Update: spice-vdagent (UTSA-2026-104950)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104950 advisory. A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the gue...
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it ...
CVE-2026-81694 verify-usb before 1.4.9 Output Injection via Unsanitized Filenames
openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...
PT-2026-82595
Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description The software fails to sanitize filenames read from untrusted drive data located outside the AES-GCM authenticated manifest before displaying them in the output of the verify-usb command. An...
SUSE CVE-2026-79992
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...
EUVD-2026-65616
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...
WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass vulnerability
Unauthenticated RCE via Control Character Filename Bypass vulnerability discovered by Jakub Herman in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions 1.3.9.9...
