541 matches found
PT-2026-86316
🚨 CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to...
The vulnerability of the ASHLAR encoder in the console-based graphic editor ImageMagic, related to incorrect restrictions on the path name to the directory, allows a intruder to gain unauthorized access to protected information.
The vulnerability of the ASHLAR encoder in the console-based ImageMagick graphics editor is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...
Directory Traversal
Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Directory Traversal through the HTTP request path handling in index.js, including fastifyHttpProxy and reply.fromParameters. An attacker can bypass rewritePrefix path restriction...
The vulnerability of the `update_master_files_in_worker()` function on the platform for security monitoring and threat detection by Wazuh allows a malicious user to elevate their privileges to root level and execute arbitrary code.
The vulnerability of the updatemasterfilesinworker function on the platform for security monitoring and threat detection by Wazuh is related to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to root an...
CVE-2026-82020
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...
EUVD-2026-67866
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...
CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...
CVE-2026-82020
Hermes Agent versions 0.16.0 through prior to 0.17.0 contain an improper path restriction vulnerability. Sensitive-path guards that should protect the credential store failed to exclude the auth.json file , allowing an attacker who can influence ingested message content to craft a malicious messa...
CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...
CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...
PT-2026-83283
Name of the Vulnerable Software and Affected Versions Hermes Agent version 0.16.0 Description An improper path restriction exists that allows attackers who can influence ingested message content to overwrite the credential store. This occurs by bypassing sensitive-path guards that failed to exclu...
CVE-2026-82020: Files or Directories Accessible to External Parties
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...
The vulnerability of the SQLite driver software used by Adminer for database management allows a hacker to gain access to delete any files they desire.
The vulnerability of the SQLite driver software used by Adminer for database management involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability allows a malicious actor to gain access and delete any files by sending a specially crafted POST request...
PT-2026-81963
The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: pcp (UTSA-2026-093148)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093148 advisory. A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUS...
The vulnerabilities of the `cluster.unmerge_info()` and `process_files_from_worker()` functions on the security monitoring and threat detection platform Wazuh allow attackers to execute arbitrary code.
The vulnerability of the cluster.unmergeinfo and processfilesfromworker functions of the security monitoring and threat detection platform Wazuh is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary cod...
The vulnerability of the Adobe Lightroom Classic graphic editor lies in the incorrect path name limitation, which allows a hacker to execute arbitrary code.
The vulnerability of the Adobe Lightroom Classic graphic editor is related to incorrect restrictions on the path name to the catalog. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
ROS-20260818-73-0022
A vulnerability in Mariadb 11.4 exists due to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...
SUSE-SU-2026:23223-1 Security update for open-iscsi
This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...