Python Gradio blocked_path() Unauthenticated Access

The vulnerability of the blockedpath function in the Python package for creating Gradio applications relates to incorrect restrictions on the path name of the restricted directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CVE-2026-24053

Claude Code (Anthropic) is vulnerable to a path restriction bypass prior to version 2.0.74 due to a Bash command validation flaw when parsing ZSH clobber syntax. This allows an attacker using ZSH and injecting untrusted content into a Claude Code context window to bypass directory restrictions an...

npm Path Traversal

The vulnerability of the npm package manager is related to incorrect restrictions on path names in restricted access catalogs. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

Incus Path Traversal Command Execution

The vulnerability of the container management system and the virtual machine manager Incus is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

API Team Manager cPanel Upload Privilege Escalation

The API Team Manager web hosting control panel has a vulnerability due to incorrect path name restrictions for the restricted directory. Exploiting this vulnerability allows an attacker to write arbitrary files and elevate their privileges to the root level...

GNU Wget2 Path Traversal

The vulnerability of the GNU Wget2 download manager is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information and compromise the system...

WordPress plugin HDForms has a path traversal vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

GNU Tar Path Traversal

The vulnerability of the GNU Tar archive editor is related to an incorrect limitation on the path name to the restricted-access directory. Exploiting this vulnerability could allow a attacker to bypass existing security restrictions and gain access to the files for overwriting...

Directory Traversal

Overview fast-filesystem-mcp is a Fast Filesystem MCP Server - Advanced file operations with Auto-Chunking, Sequential Reading, complex file operations copy, move, delete, batch, compress, optimized for Claude Desktop Affected versions of this package are vulnerable to Directory Traversal via the...

DotNetZip Path Traversal

The vulnerability of the DotNetZip library for working with zip files is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

AdonisJS bodyparser Heap Buffer Overflow DoS

The vulnerability of the MultipartFile.move function in the bodyparser package of the AdonisJS web application framework is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending...

Multi-Functional Export/Import Excel Path Traversal

The vulnerability of the “Multi-Functional Export/Import in Excel” plugin is related to incorrect restrictions on the path name to the catalog. Exploitation of this vulnerability may allow an attacker operating remotely to gain unauthorized access to protected information...

Import from Excel Plugin Path Traversal

The vulnerability of the “Import from Excel” plugin is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Export/Import Goods to Excel Path Traversal

The vulnerability of the “Export/Import Goods to Excel” plugin is related to incorrect restrictions on the path name to the catalog. Exploitation of this vulnerability may allow an attacker operating remotely to gain unauthorized access to protected information...

SAP S/4HANA Resource Planning Path Restriction Unauthorized Access

The vulnerability of the SAP S/4HANA resource planning system relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

WordPress plugin Tuturn has a path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A path travers...

HBS 3 Backup Disaster Recovery Unauthorized Access

The vulnerability of the HBS 3 Hybrid Backup Sync software for backup and disaster recovery functions regarding QNAP network devices is related to an incorrect limitation on the path name to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to gain...

Redpen Plugin Path Traversal

The vulnerability of the Redpen plugin – Pipeline Reporter for Jira Jenkins server automation tools – involves improper restrictions on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected...

CVE-2025-65806

The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a nested ZIP a ZIP containing another ZIP where the inner archive contains an executable file e.g. webshell.php. When the application extracts the uploaded archives, the executabl...

Improper Access Control

flowise is vulnerable to improper access control.The vulnerability is due to insufficient file path restrictions in the WriteFileTool and ReadFileTool, which allows an attacker to read or write arbitrary files and potentially achieve remote command execution...