CVE-2026-93988

QloApps versions through 1.7.0 contain a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. An authenticated back-office user can supply relative path sequences in the email parameter to bypass directory restrictions and read arbitrary files , including database credential...

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-85706

CVE-2026-85706 GitLab CE および EE における未認証のパストラバーサル / 任意ファイル読み取り。 CVSS 10.0。ローカルラボの自己管理型 19.3.1 インスタンスに対して検証済み。 影響を受けるバージョン GitLab CE/EE: 18.7 から 19.1.7 まで 19.2.0 から 19.2.5 まで 19.3.0 から 19.3.1 まで 前提条件: インスタンスに少なくとも 1 つの公開プロジェクトが存在すること。任意の実在するプロジェクト id で動作する。アカウントやトークンは不要。 仕組み create-commit エンドポイント...

CVE-2024-27954

CVE-2024-27954 📝 CVE-2024-27954 - WP Automatic プラグインにおけるパストラバーサルおよびSSRF脆弱性 説明 WP Automatic プラグインには、パス名の制限されたディレクトリへの不適切な制限（パストラバーサル） の脆弱性が存在し、パストラバーサル および サーバーサイドリクエストフォージェリ SSRF 攻撃を許します。この問題は、WP Automatic バージョン 3.92.0 までに影響します。 🔍 検出クエリ 影響を受けるホストを特定するには、以下のクエリを使用できます。 FOFA:...

CVE-2026-93987

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

DEBIAN-CVE-2026-93987

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

DEBIAN-CVE-2026-93986

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

CVE-2026-93986

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

UBUNTU-CVE-2026-93987

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

CVE-2026-93986

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

UBUNTU-CVE-2026-93986

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

CVE-2026-93987

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

The tar-family extractors in decompress .tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal CWE-2...

RUSTSEC-2026-0328 `decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

The tar-family extractors in decompress .tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal CWE-2...

CVE-2026-93987

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. The newVolume() function in cmd/serve/docker/volume.go constructs a mountpoint via filepath.Join(drv.root, name) using the attacker-controlled name field from a Docker VolumeDriv...

CVE-2026-93987

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

EUVD-2026-83592

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

CVE-2026-93987 rclone serve docker Path Traversal via Volume Name

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

CVE-2026-93987 rclone serve docker Path Traversal via Volume Name

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...