CVE-2026-77815

toabspath in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by ispathtrusted in scripts/iib/api.py while...

CVE-2026-77814

ispathtrusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparentpath, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed ...

EUVD-2026-63993

toabspath in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by ispathtrusted in scripts/iib/api.py while...

CVE-2026-77815

Infinite Image Browsing (a Stable Diffusion WebUI extension) is vulnerable to a symlink-based path traversal in to_abs_path (scripts/iib/tool.py). The function uses os.path.normpath, which collapses dot segments but does not resolve symbolic links. An attacker who can place a symlink inside a sca...

CVE-2026-77814

Infinite Image Browsing , a Stable Diffusion WebUI extension, contains a path traversal flaw in is_path_trusted (scripts/iib/api.py). The function uses path.startswith(parent_path) without appending a path separator, so a directory whose name merely begins with an allowed path (e.g., /data/images...

EUVD-2026-63992

ispathtrusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparentpath, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed ...

PT-2026-79392

is path trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparent path, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allow...

CVE-2026-77815: Improper Link Resolution Before File Access

toabspath in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by ispathtrusted in scripts/iib/api.py while...

PT-2026-79393

to abs path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is path trusted in scripts/iib/api.py...

CVE-2026-77814: Improper Limitation of a Pathname to a Restricted Directory

ispathtrusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparentpath, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed ...

EUVD-2025-136957

Malicious code in imuay-agg-iib npm...

Malicious code in oscar-iib-project (npm)

The package oscar-iib-project was found to contain malicious code...

MAL-2025-28540 Malicious code in oscar-iib-project (npm)

The package oscar-iib-project was found to contain malicious code...

CVE-2025-36014

IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.5 is vulnerable to code injection by a privileged user with access to the IIB install directory...

CVE-2023-45176

CVE-2023-45176 affects IBM App Connect Enterprise 11.0.0.1–11.0.0.23, 12.0.1.0–12.0.10.0, and IBM Integration Bus 10.1–10.1.0.1. The issue is a denial of service for Windows integration nodes caused by insufficient input validation. Impact is availability (as stated in sources). Remediation: inte...

Unfixed XSS vulnerability at www.iib.org.tr

Security researcher cyber, has submitted on 31/03/2007 a cross-site-scripting XSS vulnerability affecting www.iib.org.tr, which at the time of submission ranked 537043 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 31/03/2007. It is currently...