64659 matches found
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
On September 22, 2026, the WordPress Security Team released WordPress 7.1.2, as well as security backports for every branch back to WordPress 4.7 to address a critical unauthenticated path traversal vulnerability. The issue is tracked as CVE-2026-87902 and has a CVSS v4.0 score of 9.2 Critical. T...
CVE-2026-18133
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...
cve-2026-87902-poc
CVE-2026-87902 — WordPress Core: ページテンプレート解決における未認証パストラバーサル WordPress Core における未認証のローカル PHP ファイルインクルード。二重エンコードされた pagename 値を通じて発生し、特定のデプロイ条件下では Web サーバーアカウントの権限で PHP コードが実行される。...
CVE-2026-18133 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...
CVE-2026-18133
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a path traversal flaw (CWE-22 ). This vulnerability could allow a remote authenticated attacker to modify server files. The affected versions include 4.0.6.0 through 4.0.10.0 (specifically 4.0.6.0 iFix6, 4.0.6.0 iFix6 R...
Exploit for CVE-2026-87902
CVE-2026-87902 — PoC Unauthenticated remote code execution...
CVE-2021-33558
CVE-2021-33558 Referencia: https://www.cvedetails.com/cve/CVE-2021-33558 Dork de Shodan: product:"Boa Web Server" 0.94.13 Payload: root@kitploit: /backup.html /preview.html /js/log.js /log.html /email.html /online-users.html /config.js POC:...
CVE-2023-2825-Gitlab
CVE-2023-2825 El 23 de mayo de 2023 GitLab lanzó la versión 16.0.1 que corrigió una vulnerabilidad crítica, CVE-2023-2825, que afecta a la Community Edition CE y Enterprise Edition EE versión 16.0.0. La vulnerabilidad permite a usuarios no autenticados leer archivos arbitrarios a través de un fal...
EUVD-2026-84005
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join...
GHSA-9VM9-PQXX-X83V KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
Description KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components,...
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
Description KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components,...
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)
Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)
Summary mcp-atlassian exposes an MCP tool confluenceuploadattachment whose filepath argument is passed directly to openfilepath, "rb" without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart uploa...
MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
Summary The upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The uploadattachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validatesafepath...
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call
Summary The uploadattachment functions in both the Jira and Confluence modules accept a user-controlled filepath parameter and open the specified file for reading without calling validatesafepath. An authenticated MCP client can supply an arbitrary path such as /etc/passwd or /proc/self/environ,...
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)
Summary The confluenceuploadattachment and confluenceuploadattachments MCP tools accept a filepath parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process S...
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
Summary The mcp-atlassian server exposes an MCP tool confluenceuploadattachment and the Jira attachment variant that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode streamable-http or sse, a remote,...
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. Patches This issue is addressed in MPXJ version 16.5.0. Workarounds Do not read PRX or STX files from untrusted sources...
cve-2018-19052
cve-2022-19052 modalias seguridad: posible path traversal con configuraciones específicas Seguridad: posible path traversal de un solo directorio por encima del alias destino con una configuración específica de modalias donde el alias que coincide no termina en /, pero la ruta del sistema de...