CVE-2026-126949

Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database...

EUVD-2026-125051

The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen"wb", which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite...

CVE-2026-124744

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...

CVE-2026-67449

Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler app/api/tus/hooks/route.ts allowed an unauthenticated attacker to...

DRUPAL-CONTRIB-2026-337

The S3 File System CORS Upload module lets users upload files straight from the browser to Amazon S3 or an S3-compatible service, using a file widget on entity forms. The module doesn't sufficiently restrict the upload permission it gives the browser. A user who can upload through the widget can...

CVE-2026-67449: portabase: Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB,…

Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler app/api/tus/hooks/route.ts allowed an unauthenticated attacker to...

PT-2026-145661

The S3 File System CORS Upload module lets users upload files straight from the browser to Amazon S3 or an S3-compatible service, using a file widget on entity forms. The module doesn't sufficiently restrict the upload permission it gives the browser. A user who can upload through the widget can...

CVE-2026-125330

HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessabl...

PT-2026-144405

HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessabl...

CVE-2026-124034 Path traversal in Amazon Braket SDK local hybrid job input data download

Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3...

CVE-2026-124034

A relative path traversal vulnerability exists in the Amazon Braket SDK (versions before 1.127.7 ) during the local hybrid job input data download process. A remote authenticated user with S3 write access to a hybrid job's input data location can use crafted S3 object keys to overwrite arbitrary ...

EUVD-2026-120499

Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3...

EUVD-2026-119381

Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like /.bashrc or install vean...

CVE-2026-68509 FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path componen...

CVE-2026-68509 FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path componen...

CVE-2026-68509 FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path componen...

CVE-2026-68509

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path componen...

CVE-2026-68509

The FairEmail Android application (prior to version 1.2325 ) is vulnerable to a path traversal flaw in its shared attachment handling. The application fails to adequately sanitize attacker-controlled filenames when constructing destination paths. This allows a local malicious app to supply path c...

CVE-2026-62268

borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction...

EUVD-2026-117654

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden ziptodir parameter, while cleanpath does not reject traversal sequences. An authenticated administrator can copy...