CVE-2026-100549 OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended...

CVE-2026-85082 Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command...

CVE-2026-85082

The Root Browser Classic 3.3.0 application is vulnerable to an OS command injection due to the improper handling of SQLite database paths. The application passes the file path of a selected database to an operating-system shell without ensuring the filename is safely separated from the command. T...

CVE-2024-25081_2025-47273

CVE-2024-25081 및 CVE-2025-47273 개념 증명 FontForge ≤ 20230101 버전 및 Setuptools 라이브러리 Font Forge를 사용하는 작업을 실행하는 사용자로 권한을 상승시키기 위한 개념 증명입니다. 두 번째 CVE는 민감한 디렉터리에 쓰기 권한이 있는 경우 루트로 권한을 상승시킵니다. 추가 정보: CVE ID| 취약점| 영향 ---|---|--- CVE-2024-25081| 셸로 전달하기 전에 파일 이름을 검증하지 않음| 소유자 사용자 권한으로 명령 주입 CVE-2025-47273|...

CVE-2026-29780

공식 예제 스크립트의 경로 탐색 취약점으로 인한 임의 파일 쓰기 요약 공식 예제 스크립트 examples/recursivelyextractattachments.py에는 의도된 출력 디렉터리 외부에 임의 파일을 쓸 수 있는 경로 탐색 취약점이 존재합니다. 파싱된 이메일에서 추출된 첨부 파일 이름이 어떠한 검증 없이 출력 파일 경로를 구성하는 데 직접 사용되어, 공격자가 제어하는 파일 이름이 대상 디렉터리를 벗어날 수 있습니다. 세부 사항 파일: examples/recursivelyextractattachments.py 줄:...

CVE-2026-91121 Discourse: Chat upload filenames rendered as raw HTML in excerpts

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

CVE-2026-91121

The Discourse open-source discussion platform is vulnerable to trusted-HTML injection in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . The root cause is that attacker-controlled upload filenames used in chat message excerpts are rendered as unescaped HTML . An attacker capable of...

CVE-2026-91121 Discourse: Chat upload filenames rendered as raw HTML in excerpts

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

CVE-2026-91121 Discourse: Chat upload filenames rendered as raw HTML in excerpts

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

EUVD-2026-86306

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

CVE-2026-91121: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

Summary The mediapool sync page sync.php renders filenames from the /media filesystem directory directly into HTML without applying rexescape i.e., htmlspecialchars. Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any...

GHSA-W998-QMW9-MF4M REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

Summary The mediapool sync page sync.php renders filenames from the /media filesystem directory directly into HTML without applying rexescape i.e., htmlspecialchars. Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rendering of unescaped filenames from the filesystem in the backend sync page. An attacker can execute arbitrary JavaScript in the browser of backend users by placing specially crafted files with malicio...

CVE-2026-63002 REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

EUVD-2026-85331

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

CVE-2026-63002 REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-090061)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090061 advisory. In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names coul...

CVE-2026-94106

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

CVE-2026-94106 getID3 before 1.9.26 OS Command Injection via Unescaped Filenames

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...