CVE-2025-9345

Proof of Concept Path Traversal in File Manager, Code Editor, and Backup by Managefy Vulnerability Type: Path Traversal Arbitrary File Download Affected Function: ajaxdownloadfile Impact: Authenticated users with low privilege Subscriber+ can download arbitrary files from the server, including...

PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core

On September 22, 2026, the WordPress Security Team released WordPress 7.1.2, as well as security backports for every branch back to WordPress 4.7 to address a critical unauthenticated path traversal vulnerability. The issue is tracked as CVE-2026-87902 and has a CVSS v4.0 score of 9.2 Critical. T...

CVE-2026-18133

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: ページテンプレート解決における未認証パストラバーサル WordPress Core における未認証のローカル PHP ファイルインクルード。二重エンコードされた pagename 値を通じて発生し、特定のデプロイ条件下では Web サーバーアカウントの権限で PHP コードが実行される。...

CVE-2026-18133 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

CVE-2026-18133

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a path traversal flaw (CWE-22 ). This vulnerability could allow a remote authenticated attacker to modify server files. The affected versions include 4.0.6.0 through 4.0.10.0 (specifically 4.0.6.0 iFix6, 4.0.6.0 iFix6 R...

Exploit for CVE-2026-87902

CVE-2026-87902 — PoC Unauthenticated remote code execution...

CVE-2021-33558

CVE-2021-33558 Reference: https://www.cvedetails.com/cve/CVE-2021-33558 Shodan dork: product:"Boa Web Server" 0.94.13 Payload: root@kitploit: /backup.html /preview.html /js/log.js /log.html /email.html /online-users.html /config.js POC:...

CVE-2023-2825-Gitlab

CVE-2023-2825 On May 23, 2023 GitLab released version 16.0.1 which fixed a critical vulnerability, CVE-2023-2825, affecting the Community Edition CE and Enterprise Edition EE version 16.0.0. The vulnerability allows unauthenticated users to read arbitrary files through a path traversal bug. It wa...

EUVD-2026-84005

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join...

GHSA-9VM9-PQXX-X83V KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

Description KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components,...

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

Description KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components,...

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...

MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)

Summary mcp-atlassian exposes an MCP tool confluenceuploadattachment whose filepath argument is passed directly to openfilepath, "rb" without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart uploa...

MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

Summary The upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The uploadattachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validatesafepath...

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

Summary The uploadattachment functions in both the Jira and Confluence modules accept a user-controlled filepath parameter and open the specified file for reading without calling validatesafepath. An authenticated MCP client can supply an arbitrary path such as /etc/passwd or /proc/self/environ,...

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

Summary The confluenceuploadattachment and confluenceuploadattachments MCP tools accept a filepath parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process S...

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

Summary The mcp-atlassian server exposes an MCP tool confluenceuploadattachment and the Jira attachment variant that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode streamable-http or sse, a remote,...

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. Patches This issue is addressed in MPXJ version 16.5.0. Workarounds Do not read PRX or STX files from untrusted sources...

cve-2018-19052

cve-2022-19052 modalias security: potential path traversal with specific configs Security: potential path traversal of a single directory above the alias target with a specific modalias config where the alias which is matched does not end in /, but alias target filesystem path does end in /...