Echo Has A Static Middleware Double-Unescape Path Traversal

Summary Commit a9ede66a PR 3006, issue 2599 silently fixed a path traversal vulnerability in the Echo web framework's static file middleware. Vulnerability The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally...

EUVD-2026-112500

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

EUVD-2026-112494

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::createimagefromxml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or / filename and no data, so saving embeds...

CVE-2026-113957

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a...

EUVD-2026-112561

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a...

CVE-2026-113957

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a...

CVE-2026-113957

The containerization software (specifically container and containerization versions prior to 1.6.0 and 0.52.1) is vulnerable to a security flaw where an attacker controlling a registry, mirror, or network path can serve arbitrary image content during a pull by digest. This allows a user to run an...

PT-2026-132295

Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. This issue was fixed in version 2.0 build 708...

PT-2026-132239

Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access...

PT-2026-132167

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm lms step parameter passed to the stm lms import sample data AJAX...

EUVD-2026-113261

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path...

CVE-2026-90866: Progress Software WS_FTP Server: A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…

A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...

PT-2026-132476

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, o...

CVE-2026-61576: lightdash: Lightdash is an open source business intelligence platform

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

Agent Zero security vulnerability

Versions 1.7, 1.8, 1.9, and 1.10 of Agent Zero contain a security vulnerability. This vulnerability arises because the FileBrowser.savetextfile method accepts user-supplied file paths without any normalization or validation, potentially enabling path traversal attacks...

Progress Software WS_FTP Server path traversal vulnerability

Security vulnerabilities exist in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4. These vulnerabilities stem from improper restrictions on pathnames used for restricted directories, potentially allowing unauthenticated attackers to access files outside the intended directo...

CVE-2026-107048: n/a: An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to…

An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request...

EUVD-2026-113265

An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request...

CVE-2026-119130: bytecodealliance wasmtime: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values…

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can...

Apache Ambari 3.0.0 MpackManager Path Traversal

Apache Ambari version 3.0.0 MpackManager contains a path traversal vulnerability that allows an authenticated administrator to write arbitrary files outside the management-pack staging directory. !/usr/bin/env python Apache Ambari 3.0.0 MpackManager Path Traversal Arbitrary File Write Vendor: The...