167 matches found
CVE-2026-84365
Hono (a JavaScript web framework) has an incomplete fix for CVE-2026-39408 in its toSSG() static site generation method, affecting versions from 4.12.12 and fixed in 4.13.5 . The path normalization routine used to verify output paths does not fully collapse runs of consecutive parent-directory se...
EUVD-2026-69288
appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the writefile and writefilesbatch tools, allowing attackers to write files outside the intended PROJECTROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite...
CABTrap_OneNote2007
CABTrapOneNote2007 Microsoft Office OneNote 2007 CVE-2014-2815: Schwachstelle in ".ONEPKG"-Dateien durch Directory Traversal führt zur Ausführung beliebigen Codes Microsoft Office OneNote 2007 CVE-2014-2815: Schwachstelle in ".ONEPKG"-Dateien durch Directory Traversal führt zur Ausführung...
EUVD-2026-42399
asyncssh has SCP Path Traversal to Arbitrary File Write...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
PT-2026-82113
Name of the Vulnerable Software and Affected Versions IzPack versions 5.2.6 and earlier Description IzPack is a tool for packaging Java applications as cross-platform installers. The unpack function within the UnpackerBase class fails to properly validate the targetPath of pack-file entries...
AZL-96665 CVE-2026-56860 affecting package golang 1.26.5-2
Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...
CVE-2026-71309 rclone: Incomplete path validation allows backend root escape in serve restic
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...
CVE-2026-8384
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...
MAL-2026-10214 Malicious code in babel-preset-lib-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4274de0136aa69f8b0f4eba03412c7809a1b8c2446bb3ed7f6de1333475aa4c4 index.js, the package main, runs a load-time IIFE that collects OS platform and architecture, hostname, username, private and public IP via...
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.
...
SUSE CVE-2026-59996
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...
AZL-92039 CVE-2026-59996 affecting package openssh for versions less than 9.8p1-9
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...
CVE-2026-59996
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...
DEBIAN-CVE-2026-59996
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...
UBUNTU-CVE-2026-59996
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...
CVE-2026-59996
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...
CVE-2026-59996
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...