CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...

EUVD-2026-61101

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...

CVE-2026-69160

In server/handles/sharing.go, strings.HasPrefix(requested_path, user.BasePath) fails to enforce a directory separator boundary. An authenticated user with CanShare permission and a BasePath like /base can create a share for a sibling path like /base2/secret.txt, then use the public share download...

CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...

GHSA-8J49-MMCX-4MP5 MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

Summary The findiconpathzip function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path. An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitra...

MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

Summary The findiconpathzip function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path. An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitra...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the manager.go file. An attacker can write files to arbitrary user-writable locations by convincing a user to install or execute a malicious plugin. Note: This is only exploitable if the plugin is not sourced fro...

CVE-2026-50143 Actor MCP path authority injection leaks Apify token

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

CVE-2026-50143

In @apify/actors-mcp-server versions before 0.10.11, getActorMCPServerURL() in src/mcp/actors.ts:44 naively concatenates a trusted base URL with an attacker-controlled webServerMcpPath, allowing an @ character to inject an arbitrary hostname. Node.js's WHATWG URL parser treats the prefix as useri...

CVE-2026-50143 Actor MCP path authority injection leaks Apify token

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads

MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...

CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads

MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...

CVE-2026-68922

In MobSF versions before 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py constructs paths from the manifest android:icon value without sanitizing traversal or verifying containment. An authenticated user can upload a crafted ZIP/APK to read server files matching A...

EUVD-2026-61132

MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...

CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads

MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...

OPENSUSE-SU-2026:21606-1 Security update for python-unearth

This update for python-unearth fixes the following issues: Changes in python-unearth: - CVE-2026-73030: iswithindirectory function fails to normalize paths before validation and allows ../ sequences to bypass directory containment checks bsc1275440...

CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...

CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...

CVE-2026-74044

Wazuh versions 4.0.0 through 4.14.5 are vulnerable: an authenticated cluster peer with a valid Fernet key can supply a path-traversal-shaped node name in the cluster hello payload; on disconnect, the master's peer cleanup routine deletes arbitrary directory contents within the wazuh user's writab...

EUVD-2026-61076

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...