CVE-2026-54250

K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to...

GO-2026-5285 Daptin has Unauthenticated Path Traversal and Zip Slip in github.com/daptin/daptin

Daptin has Unauthenticated Path Traversal and Zip Slip in github.com/daptin/daptin...

GO-2026-5367 Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape in github.com/daytonaio/daytona

Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape in github.com/daytonaio/daytona...

GO-2026-5394 goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

goshs: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in goshs PUT Upload in github.com/patrickhener/goshs...

GO-2026-5383 FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser...

GO-2026-5389 Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution in github.com/enchant97/note-mark/backend

Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution in github.com/enchant97/note-mark/backend...

GO-2026-5305 Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs

Gogs has Path Traversal in organization name that results in RCE through Git hooks in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-5311 Mattermost has a Path Traversal issue in github.com/mattermost/mattermost-server

Mattermost has a Path Traversal issue in github.com/mattermost/mattermost-server...

GO-2026-5344 Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host in github.com/boxlite-ai/boxlite/sdks/go

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host in github.com/boxlite-ai/boxlite/sdks/go...

GO-2026-5206 androidqf: APK download Path Traversal in device APK paths in github.com/mvt-project/androidqf

androidqf: APK download Path Traversal in device APK paths in github.com/mvt-project/androidqf...

GO-2026-5186 goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

goshs: Improper Limitation of a Pathname to a Restricted Directory Path Traversal in github.com/patrickhener/goshs...

GO-2026-5270 Code Extension Marketplace: Zip Slip Path Traversal in github.com/coder/code-marketplace

Code Extension Marketplace: Zip Slip Path Traversal in github.com/coder/code-marketplace...

CVE-2026-54917 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

CVE-2026-54917

CVE-2026-54917 affects SeaweedFS prior to 4.30. The S3 gateway and Iceberg REST catalog gateway construct routers with mux.NewRouter().SkipClean(true); when path cleaning is disabled, a .. segment in URLs can survive routing (example: GET /bucket-A/../evil-bucket/key) and be parsed as a valid buc...

CVE-2026-54917

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

CVE-2026-54917 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

GO-2026-5154 Rancher Extensions have arbitrary file access via path traversal in github.com/rancher/rancher

Rancher Extensions have arbitrary file access via path traversal in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...

GO-2026-5115 Grafana Loki Path Traversal - CVE-2021-36156 Bypass in github.com/grafana/loki

Grafana Loki Path Traversal - CVE-2021-36156 Bypass in github.com/grafana/loki...

GO-2026-5126 opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter

opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter...

GO-2026-5079 Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution in github.com/openclaw/crabbox

Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution in github.com/openclaw/crabbox...