CVE-2026-77266

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a path traversal vulnerability within the upload_attachment function. The flaw occurs because the application accepts absolute paths and traversal sequences without restricting the resolved path to the server wor...

EUVD-2026-84747

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, uploadattachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen...

CVE-2026-77262 MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment accepts an attacker-controlled filepath and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside...

EUVD-2026-84744

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment accepts an attacker-controlled filepath and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside...

CVE-2026-77262 MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment accepts an attacker-controlled filepath and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside...

CVE-2026-77262

The MCP Atlassian (sooperset/mcp-atlassian) server is vulnerable to a Path Traversal vulnerability in the confluence_upload_attachment tool prior to version 0.22.0 . The root cause is the lack of path validation on the file_path argument, which is passed directly to the open() function. This allo...

CVE-2024-6648

CVE-2024-6648 Plantilla de Nuclei para CVE-2024-6648, traversal de ruta absoluta en el plugin ApPage Builder de Prestashop. Uso: root@kitploit: nuclei -u https://vulnerable.site.com -t CVE-2024-6648.yaml...

CVE-2019-14530

CVE-2019-14530 Vulnerabilidad de path traversal y DoS en el proyecto OpenEMR Función vulnerable en el archivo: /openemr/custom/ajaxdownload.php Condiciones: 1. cualquier usuario autorizado 2. para el caso de DoS: debe existir el directorio "/sites/default/documents/cqmqrda/" en el servidor Debido...

CVE-2026-77271 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...

npm-tar-path-traversal-scanner

CVE-2026-31802 — Escáner de Path Traversal en npm tar Detecta paquetes npm vulnerables a CVE-2026-31802 , una vulnerabilidad de path traversal en el paquete npm tar que permite la escritura arbitraria de archivos durante la extracción de archivos. Características Escanea package-lock.json en busc...

CVE-2007-4559

demonstration of CVE-2007-4559 what is this? This is a demonstration of how python's default handling of tar file extraction prior to python v3.11.4 is vulnerable to a simple symlink attack. The instructions below describe how to craft a malicious payload. The script untar.py demonstrates how and...

CVE-2020-13424

Título del exploit: Joomla! Plugin XCloner Backup 3.5.3 - Inclusión de archivo local Autenticado Fecha: 2020-05-10 Autor del exploit: Mehmet Kelepçe / Gais Cyber Security ID de autor en Exploit-Db: 8763 Referencia:...

CVE-2021-41773

Exploit de Path Traversal y RCE en Apache CVE-2021-41773 & CVE-2021-42013 Estas son vulnerabilidades críticas de path traversal que afectan a Apache HTTP Server 2.4.49 y 2.4.50. Permiten a los atacantes: Acceder a archivos fuera de la raíz web LFI Lograr ejecución remota de código RCE si CGI está...

OnlyOffice-path-traversal

Explotación de Path Traversal en ONLYOFFICE CVE-2023-46988 📌 Resumen Este script explota una vulnerabilidad de path traversal en ONLYOFFICE Document Server CVE-2023-46988 que permite a usuarios no autorizados copiar archivos arbitrarios del servidor. La vulnerabilidad existe en el endpoint...

cve-2021-42013.get

Apache 2.4.50 - Path Traversal o Ejecución Remota de Código cve-2021-42013.py es un script de Python que ayuda a encontrar la vulnerabilidad de Path Traversal o Ejecución Remota de Código en Apache 2.4.50. Se proporciona una instancia vulnerable de Docker para practicar con CVE-2021-42013 Si...

cve-2021-42013L

cve-2021-42013 Apache 2.4.50 Vulnerabilidad de recorrido de rutas Síguenos Youtube Twitter Telegram Vulnmachines.com...

cve-2021-42013

Apache 2.4.50 - Path Traversal o Ejecución Remota de Código cve-2021-42013.py es un script de Python que ayuda a encontrar la vulnerabilidad de Path Traversal o Ejecución Remota de Código en Apache 2.4.50. Se proporciona una instancia vulnerable de Docker para poner manos a la obra con...

CVE-2026-42048

CVE-2026-42048 PoC de CVE-2026-42048 Langflow Path Traversal / Eliminación Arbitraria de Directorios https://github.com/user-attachments/assets/6e5481ff-e953-47a5-8870-70b30c6550de Descripción CVE-2026-42048: Vulnerabilidad de Eliminación Arbitraria de Directorios en Langflow Descripción: una...

day04-nexus-4956

Día 4 – Nexus Repository 3 Path Traversal CVE-2024-4956 Qué: El path traversal sin autenticación permite a cualquiera descargar archivos arbitrarios con una URL manipulada. Vuln: Afecta a versiones de Nexus Repo 3 ≤ 3.68.0. Corregido en 3.68.1. Fuente: Aviso de Sonatype + NVD. Seguridad: El...

CVE-2026-93751

A flaw was found in uri-js. This improper UTF-8 Unicode Transformation Format - 8-bit decoding vulnerability in the pctDecChars function allows a remote attacker to craft specially encoded payloads. These payloads can bypass platform decoder validation, leading to the injection of path traversal ...