516 matches found
rclone: Path traversal in serve s3 allows reading and overwriting root-level files
Summary rclone serve s3 allows a client to read and write files at the root of the remote which would normally be inaccessible by using dot-dot path segments in the object key. It does not allow reading files outside of the root. A request such as GET /bucket/../root-secret.txt is handled as an...
EUVD-2026-53381
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...
EUVD-2026-53316
The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...
CVE-2026-71243
The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...
CVE-2026-71243 backmeup (npm) - OS Command Injection via Backup Option Values
The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...
Use of Non-Canonical URL Paths for Authorization Decisions
Overview org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the PathMatcher class in...
PT-2026-75954
Summary rclone serve s3 allows a client to read and write files at the root of the remote which would normally be inaccessible by using dot-dot path segments in the object key. It does not allow reading files outside of the root. A request such as GET /bucket/../root-secret.txt is handled as an...
CVE-2025-71399 Better Auth before 1.4.5 Path Normalization Bypass via rou3
Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 which bundles the fixed rou3, this can allow...
CVE-2025-71399 Better Auth before 1.4.5 Path Normalization Bypass via rou3
Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 which bundles the fixed rou3, this can allow...
CVE-2025-71399
CVE-2025-71399 affects Better Auth prior to version 1.4.5, which ships a vulnerable rou3 router. In rou3, path normalization removes empty segments, causing /path, //path, and ///path to resolve to the same route. This enables an attacker to bypass disabledPaths configuration and path-based rate ...
CVE-2025-71399 Better Auth before 1.4.5 Path Normalization Bypass via rou3
Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 which bundles the fixed rou3, this can allow...
CVE-2025-71399: Improper Input Validation
Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 which bundles the fixed rou3, this can allow...
CVE-2026-6540
Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...
CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching
Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...
CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching
Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...
CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching
Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...
EUVD-2026-51153
Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...
PT-2026-66493
Name of the Vulnerable Software and Affected Versions Calico affected versions not specified Description The Application Layer Policy, which uses Dikastes to enforce HTTP rules, does not perform URL path normalization. This allows HTTP requests containing repeated slashes, encoded slashes, or...
GHSA-QCXP-GM7M-4J5V Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons %3B to smuggle matrix parameters past the security layer, and using encoded slashes %2F or backslashes %5C to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed on...
