External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path through the Submodule.configparser path in git/objects/submodule/base.py. An attacker can disclose the first line of a readable...

CVE-2026-78680

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

DEBIAN-CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-72697

Grav CMS before 2.0.16 contains a path traversal vulnerability in the mediadirectory Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem...

CVE-2026-72695

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...

CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...

DEBIAN-CVE-2026-34967

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled conte...

CVE-2026-34967

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled conte...

DEBIAN-CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...

CVE-2026-16434

Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...

DEBIAN-CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db parameter to delete any files writable by the P...

DEBIAN-CVE-2026-16434

Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...

CVE-2026-78680 NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-78680

NLTK versions before 3.10.3 are vulnerable to arbitrary code execution via the Graphviz dot binary . The root cause is that dependencygraph.dot2img and AlignedSent._repr_svg_ invoke dot using a bare name rather than a validated absolute path. On Windows , an attacker can place a malicious dot bin...

CVE-2026-78680 NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-78680

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-78677 GitPython before 3.1.59 Path Traversal via separate-git-dir

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-78677

GitPython before 3.1.59 omits the --separate-git-dir option from its unsafe_git_clone_options list, enabling a path traversal attack. An attacker can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, r...

CVE-2026-78677 GitPython before 3.1.59 Path Traversal via separate-git-dir

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...