Rejetto HTTP File Server 2.4.x - Template Injection

Rejetto HTTP File Server HFS 2.4.x inserts the multipart upload filename into the server-side template symbol map as %item-resource% without escaping. A filename containing the literal %item-resource% is substituted a second time by the sequential global replacement in xtpl, allowing a : sequence...

CVE-2026-52680_exploit

CVE-2026-52680 — Apache Kyuubi REST Batch Path-Traversal Arbitrary File Write Unauthenticated arbitrary file write in Apache Kyuubi's REST API via the multipart batch-submission endpoint. POST /api/v1/batches multipart/form-data writes the resourceFile part to $KYUUBIHOME/work/upload// using the...

multiparty-CVE-2026-8161

CVE-2026-8161 Proof of concept of CVE-2026-8161 Multiparty Description [email protected] and earlier are vulnerable to denial of service through an uncaught exception. The parser stores uploaded fields and files in plain JavaScript objects and does not safely distinguish parser owned keys fr...

Ashwesker-CVE-2026-21440

🚨 CVE-2026-21440 — Critical Security Vulnerability 🧩 Summary CVE-2026-21440 is a critical path traversal vulnerability affecting the AdonisJS framework, specifically its multipart file upload handling. ⚠️ If exploited, attackers can write files anywhere on the server , potentially leading to remot...

Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

Summary In multi-user mode, the Kubeflow Pipelines API server's HTTP multipart upload endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/uploadversion perform no authorization when the target namespace is empty. The authorization helper canUploadVersionedPipeline retur...

GHSA-RJR3-43J3-4Q8G Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

Summary In multi-user mode, the Kubeflow Pipelines API server's HTTP multipart upload endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/uploadversion perform no authorization when the target namespace is empty. The authorization helper canUploadVersionedPipeline retur...

CVE-2026-116188

A flaw was found in rclone's S3 service. A remote attacker can trigger a Denial of Service DoS by sending concurrent multipart upload requests with excessively large lengths. This causes an integer overflow in the memory-accounting mechanism, bypassing configured buffer limits and retaining...

CVE-2026-83542

Improper Control of Generation of Code 'Code Injection' in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a...

CVE-2026-83542 Apache OFBiz: Unauthenticated RCE via login-page widget injection

Improper Control of Generation of Code 'Code Injection' in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a...

CVE-2026-83542 Apache OFBiz: Unauthenticated RCE via login-page widget injection

Improper Control of Generation of Code 'Code Injection' in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a...

CVE-2026-83542

Apache OFBiz versions before 24.09.08 on all platforms are vulnerable to a Code Injection vulnerability (CWE-94). A remote unauthenticated attacker can execute arbitrary code by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation via an anonymous JSON request...

CVE-2026-83542 Apache OFBiz: Unauthenticated RCE via login-page widget injection

Improper Control of Generation of Code 'Code Injection' in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a...

EUVD-2026-117470

Improper Control of Generation of Code 'Code Injection' in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a...

PT-2026-137511

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07 Description Improper Control of Generation of Code allows a remote unauthenticated attacker to execute arbitrary code on the server. The issue occurs when an attacker stages crafted widget XML via a...

Allocation of Resources Without Limits or Throttling

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

CVE-2026-117500

A flaw was found in HTTP::Body. A remote attacker could cause a Denial of Service DoS by submitting a specially crafted multipart upload request with a malformed filename. Inefficient regular expression processing causes excessive backtracking when parsing the filename, which exhausts CPU resourc...

CVE-2026-116132

A flaw was found in HTTP::Body. A remote attacker could cause a Denial of Service DoS by sending repeated incomplete multipart upload requests. The multipart parser creates a temporary file when a file part begins but fails to track or clean it up if the upload terminates prematurely, allowing an...

SUSE CVE-2026-116132

HTTP::Body versions before 1.2301 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by...

SUSE CVE-2026-117500

HTTP::Body versions before 1.2401 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basenameregexp, qr/^.+.^\/+$/, against the whole basename. A...

CVE-2026-117500

HTTP::Body versions before 1.2401 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basenameregexp, qr/^.+.^\/+$/, against the whole basename. A...