EUVD-2026-84956

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to read arbitrary files due to improper path canonicalization...

CVE-2026-18114

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to read arbitrary files due to improper path canonicalization...

CVE-2026-18114 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to read arbitrary files due to improper path canonicalization...

CVE-2026-18114

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a flaw that could allow a remote attacker to read arbitrary files . The root cause is identified as improper path canonicalization . While the vulnerability impacts confidentiality, no specific exploit information or re...

CVE-2026-55775

A flaw was found in OpenBao, an identity-based secrets management system. An authenticated user with specific permissions on /sys/namespaces/root within a non-root namespace could exploit a vulnerability in the namespace path canonicalization process. This flaw allows the user to perform...

EUVD-2026-78680

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a free remote desktop protocol library and client. Affected versions of FreeRDP lack path canonicalization and base path checks for the drive channel. A malicious server can trick a FreeRDP-based client into reading files outside of the shared directory. This issue has been addressed i...

CVE-2026-89009

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...

CVE-2026-89009 WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...

CVE-2026-89009

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 are affected by an unauthenticated arbitrary file write vulnerability in the sync_server daemon listening on TCP port 13136 . The daemon runs as root without authentication and accepts a 100-byte filename field in its pro...

CVE-2026-89009 WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...

PT-2026-89893

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1 V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync server daemon on TCP port 13136. The daemon, which ru...

GHSA-X8WG-4XGC-VR54 Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Summary DirectoryPromptRegistry.set interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory. Details...

NPM: chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

NPM: chrome-devtools-mcp: validatePath does not canonicalize symlinks before enforcing roots vulnerability discovered by ? in WordPress Npm chrome-devtools-mcp versions = 0.24.0, = 1.0.1...

GHSA-8QF9-62X2-82PP chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an...

CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-72835

CVE-2026-72835 affects filebrowser before v2.63.21. The issue is that the application fails to canonicalize paths before evaluating access rules, allowing an authenticated user to bypass administrator-defined deny rules by using case-variant or backslash-separated paths. Attackers can request fil...

CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-18427

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegatin...

CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegatin...