63425 matches found
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
On September 22, 2026, the WordPress Security Team released WordPress 7.1.2, as well as security backports for every branch back to WordPress 4.7 to address a critical unauthenticated path traversal vulnerability. The issue is tracked as CVE-2026-87902 and has a CVSS v4.0 score of 9.2 Critical. T...
CVE-2026-18133
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...
cve-2026-87902-poc
CVE-2026-87902 — WordPress Core: ページテンプレート解決における未認証パストラバーサル WordPress Core における未認証のローカル PHP ファイルインクルード。二重エンコードされた pagename 値を通じて発生し、特定のデプロイ条件下では Web サーバーアカウントの権限で PHP コードが実行される。...
CVE-2026-18133 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...
CVE-2026-18133
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a path traversal flaw (CWE-22 ). This vulnerability could allow a remote authenticated attacker to modify server files. The affected versions include 4.0.6.0 through 4.0.10.0 (specifically 4.0.6.0 iFix6, 4.0.6.0 iFix6 R...
Exploit for CVE-2026-87902
CVE-2026-87902 — PoC Unauthenticated remote code execution...
CVE-2021-33558
CVE-2021-33558 参照: https://www.cvedetails.com/cve/CVE-2021-33558 Shodan dork: product:"Boa Web Server" 0.94.13 ペイロード: root@kitploit: /backup.html /preview.html /js/log.js /log.html /email.html /online-users.html /config.js POC:...
CVE-2023-2825-Gitlab
CVE-2023-2825 2023年5月23日，GitLab 发布了版本 16.0.1，修复了一个影响社区版 CE 和企业版 EE 16.0.0 的严重漏洞 CVE-2023-2825。该漏洞允许未经身份验证的用户通过路径遍历缺陷读取任意文件。该漏洞由 pwnie 通过 HackerOne 的漏洞赏金计划发现。 截至撰写本文时，尚无公开的概念验证可用。 GitLab 安全公告...
GHSA-9VM9-PQXX-X83V KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
Description KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components,...
EUVD-2026-84005
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join...
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
Description KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components,...
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)
Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)
Summary mcp-atlassian exposes an MCP tool confluenceuploadattachment whose filepath argument is passed directly to openfilepath, "rb" without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart uploa...
MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
Summary The upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The uploadattachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validatesafepath...
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call
Summary The uploadattachment functions in both the Jira and Confluence modules accept a user-controlled filepath parameter and open the specified file for reading without calling validatesafepath. An authenticated MCP client can supply an arbitrary path such as /etc/passwd or /proc/self/environ,...
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)
Summary The confluenceuploadattachment and confluenceuploadattachments MCP tools accept a filepath parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process S...
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
Summary The mcp-atlassian server exposes an MCP tool confluenceuploadattachment and the Jira attachment variant that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode streamable-http or sse, a remote,...
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. Patches This issue is addressed in MPXJ version 16.5.0. Workarounds Do not read PRX or STX files from untrusted sources...
cve-2018-19052
cve-2022-19052 modalias セキュリティ: 特定の設定で潜在的なパストラバーサル セキュリティ: エイリアスの1つ上のディレクトリへの潜在的なパストラバーサル。 特定のmodalias設定において、一致したエイリアスが/で終わらず、かつエイリアス先のファイルシステムパスが/で終わる場合。 root@kitploit: e.g. server.docroot = "/srv/www/host/HOSTNAME/docroot" alias.url = "/img" = "/srv/www/hosts/HOSTNAME/images/"...