CVE-2026-57233 Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...

CVE-2026-57233 Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...

CVE-2026-57233

In Notepad++ prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to the extraction destination without canonical containment validation, enabling a Zip Slip attack. A crafted entry like ../mimeTools/mimeTools.dll overwrites a sibling plugin DLL, achieving arbitrary code...

EUVD-2026-60375

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...

CVE-2026-52886

Notepad++ versions before 8.9.7 use std::wstring::starts_with to validate the backupFilePath attribute in session.xml during snapshot-mode restoration without path normalization, allowing .. sequences to read arbitrary user-readable files outside the backup directory into an editor tab. CVSS 5.1 ...

CVE-2026-52886

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

EUVD-2026-60374

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-63667

ApostropheCMS versions before 3.6.2 are vulnerable to arbitrary file read via path traversal in the import-export module. The file packages/import-export/lib/formats/gzip.js builds an attachment source path using attacker-controlled _id, name, and extension fields from aposAttachments.json withou...

CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-63667

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

Security update for rsync

This update for rsync fixes the following issues: CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. CVE-2026-53785: --relative implied-parent creation...

SUSE-SU-2026:3634-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' bsc1269042. - CVE-2026-53785: --relative implied-parent...

CVE-2026-45698

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for pat...

CVE-2026-73424

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts xastropath for the public /isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

CVE-2026-46345

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...