CVE-2025-63589

CVE-2025-63589 Reflected XSS in CMSimpleXH index.php path handling Discovered: October 6, 2025 Products: CMSimpleXH open-source flat-file CMS Affected versions: 1.8 CVEs: CVE-2025-63589 Authentication required: None unauthenticated Attack type: Reflected Cross-Site Scripting XSS Estimated CVSS...

CVE-2026-100706

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-100706 kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-100706 kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-100706

Kyverno versions before 1.19.1 are vulnerable to privilege escalation due to improper validation of URL-encoded path segments in the Policy apiCall urlPath. This flaw allows namespace tenants to bypass per-namespace clamps and perform actions as the admission-controller ServiceAccount . By using ...

CVE-2026-93712

The Dancer2 framework (versions 2.1.0 before 2.2.0 ) for Perl is vulnerable to a directory traversal flaw in the File route handler . The handler fails to collapse relative path segments, allowing an unauthenticated request to escape the public_dir using sequences like /../outside.txt or percent-...

CVE-2026-93712 Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

PT-2026-96326

Name of the Vulnerable Software and Affected Versions Dancer2 versions 2.1.0 through 2.1.x Description The File route handler allows the serving of files from outside the public dir directory through the use of relative path segments. This occurs because the handler joins the request path to the...

CVE-2026-92919: Improper Limitation of a Pathname to a Restricted Directory

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

Directory Traversal

Overview @fastify/static is a Plugin for serving static files as fast as possible. Affected versions of this package are vulnerable to Directory Traversal via the static file handler process. An attacker can access protected files by submitting requests with non-canonical path segments, such as d...

CVE-2026-62999

Copier (library and CLI for rendering project templates) is affected from version 9.5.0 through 9.16.0. Percent-encoded parent-directory segments or encoded path separators in a template URL could match a configured trusted repository prefix before HTTP server or Git transport decoding, enabling ...

CVE-2026-59946

A flaw was found in Composer, a dependency manager for PHP. A malicious package can exploit a vulnerability in Composer's binary installation process by using specially crafted path segments. This allows an existing file on the host system to have its permissions changed to be world-readable and...

CVE-2026-45325

Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed...

CVE-2026-45325 Gestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPath

Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed...

canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

Summary In affected versions, Request::buildRequestUrl inserts path variables into the request URL without URL encoding implode'/', $pathVariables. All request classes implementing getPathVariables are affected, e.g. GetContentDetailsRequest scheme, contentId. If a consuming application passes...

GHSA-9QFV-WGH2-M6P8 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

Summary In affected versions, Request::buildRequestUrl inserts path variables into the request URL without URL encoding implode'/', $pathVariables. All request classes implementing getPathVariables are affected, e.g. GetContentDetailsRequest scheme, contentId. If a consuming application passes...

CVE-2026-53436

A flaw was found in Jenkins. The system improperly validates redirect URLs after login, specifically when they contain relative path segments such as ./ or ../. This vulnerability allows attackers to craft malicious URLs that appear legitimate, leading to successful phishing attacks against users...

Prototype Pollution

Overview org.webjars.npm:jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser Affected versions of this package are vulnerable to Prototype Pollution via the Jodit.modules.Helpers.set function. An attacker can inject unexpected properties into Object.prototype by supplying a...

Authorization Bypass

Spring Data REST is vulnerable to Authorization Bypass. The vulnerability is due to improper enforcement of write-access restrictions in the JSON Patch application/json-patch+json implementation, where intermediate path segments in multi-segment JSON Pointer expressions are not subjected to...

CVE-2026-45390: Improper Limitation of a Pathname to a Restricted Directory

In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. This is not desired behavior, and tar1 rejects such extractions, but ocaml-tar decompresses it anyway. The impact is that it allows arbitrary file writes outside of the...