CVE-2024-53677

CVE-2024-53677 Proof of concept exploit for CVE-2024-53677 - Apache Struts file upload path traversal vulnerability leading to Remote Code Execution...

NodeJS-Tar-Symlink-Exploit-CVE-2026-29786

📦 CVE-2026-29786: Node.js Tar Symlink Vulnerability -yellow 📌 Executive Summary This repository documents research into CVE-2026-29786 , a high-severity vulnerability discovered in the popular Node.js tar package. The flaw allows an attacker to create a malicious tar archive that, when extracted,...

CVE-2026-38360

CVE-2026-38360: Path Traversal in dash-uploader Unauthenticated path traversal in fohrloop/dash-uploader Python, PyPI allowing arbitrary file write, leading to but not limited to Remote Code Execution RCE , application source code overwrite, stored XSS, and persistent backdoor installation. ⚠️ No...

ApostropheCMS: Path traversal in uploadfs

Summary The uploadfs library's local storage backend does not validate or sanitize user-supplied paths. The prefixPath helper only strips double slashes // and the backend performs direct string concatenation uploadsPath + path. An attacker can inject ../ sequences to escape the intended uploads...

GHSA-GMFX-5G6X-RR72 ApostropheCMS: Path traversal in uploadfs

Summary The uploadfs library's local storage backend does not validate or sanitize user-supplied paths. The prefixPath helper only strips double slashes // and the backend performs direct string concatenation uploadsPath + path. An attacker can inject ../ sequences to escape the intended uploads...

CVE-2026-106173

CVE-2026-106173: Fortinet FortiSIEM gRPC Path Traversal File Write RCE This repository contains a proof of concept for CVE-2026-106173, an unauthenticated remote code execution vulnerability in Fortinet FortiSIEM. Vulnerability Details The FortiSIEM gRPC QueryResultReq handler processes untrusted...

CVE-2026-105772

Path Traversal CWE-22 in FileArtifactService in Google ADK TypeScript @google/adk versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files when an agent tool invokes saveArtifact outside the intended artifact storage...

CVE-2024-6648

CVE-2024-6648 Nuclei template for CVE-2024-6648, absolute path traversal at Prestashop ApPage Builder plugin. Usage: nuclei -u https://vulnerable.site.com -t CVE-2024-6648.yaml...

CVE-2026-113672 Argo CD: A Jsonnet import can read files from the repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory...

CVE-2026-113672

The repo-server component in Argo CD (versions 0.9.0 through 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2) is vulnerable to a path traversal and arbitrary file read issue. The underlying cause is an importer that fails to confine import, importstr, or importbin operations to the repository root when eval...

npm-tar-path-traversal-scanner

CVE-2026-31802 — npm tar Path Traversal Scanner Detects npm packages vulnerable to CVE-2026-31802 , a path traversal vulnerability in the tar npm package that allows arbitrary file writes during archive extraction. Features Scans package-lock.json for vulnerable tar versions Checks nodemodules fo...

srikanth-lingala__zip4j_CVE-2018-1002202_1-3-2

zip4j This repository contains decompiled source code for the zip4j library versions 1.3.2 vulnerable and 1.3.3 fixed for CVE-2018-1002202, for the CWE-Bench-Java dataset. The original zip4j repository on Github doesn't include code from these versions. Versions Version 1.3.2 Vulnerable Tag : 1.3...

CVE-2026-105772 Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId

Path Traversal CWE-22 in FileArtifactService in Google ADK TypeScript @google/adk versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files when an agent tool invokes saveArtifact outside the intended artifact storage...

CVE-2026-105772

A Path Traversal (CWE-22) vulnerability exists in the FileArtifactService of Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 . A remote unauthenticated attacker can use crafted relative or percent-encoded path traversal sequences (e.g., ../ or ..%2F) in the userId or sessionId par...

EUVD-2026-105224

Path Traversal CWE-22 in FileArtifactService in Google ADK TypeScript @google/adk versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files when an agent tool invokes saveArtifact outside the intended artifact storage...

cve-2025-8088

CVE-2025-8088: WinRAR Path Traversal Detection Overview This repository documents research and detection strategies for CVE-2025-8088, a path traversal vulnerability in WinRAR. Exploitation of this vulnerability can allow attackers to extract files outside the intended directory, leading to...

CVE-2026-113651

ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads,...

CVE-2026-113505

A flaw has been found in aaPanel up to 8.25.0. Impacted is the function sendfile of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published a...

CVE-2026-54520

CVE-2026-54520 ai-agent-automation workflow file step path traversal allowed read/write outside the expected directory. Primary advisory: GHSA-cm8g-8jfq-887p Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54520 GHSA| GHSA-cm8g-8jfq-887p Project|...

CVE-2018-20250

exp for Extracting Code Execution From Winrar poc by Ridter how to use ? you just need to install python 3.7, and prepare a evil file you want to run, set the values you want, this exp script will generate the evil archive file automatically! 1. set the values you want ... ... The archive filenam...