CVE-2026-16263 WP Maps < 4.9.7 - Subscriber+ Local File Inclusion

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

CVE-2026-16263

The WP Maps WordPress plugin versions before 4.9.7 is vulnerable to a Local File Inclusion (LFI) flaw. The root cause is a failure to perform a capability check within an AJAX action and the lack of proper validation for a user-controlled path used in a file inclusion. This allows users with a Su...

GHSA-7HXC-F267-H5Q7 Craft CMS: Incorrect path validation could potentially lead to path traversal

The ensurePathIsContained function of the Local file system class is theoretically vulnerable to path traversal, although no exploitable scenario has been discovered. When a file is read, an Asset object uses the getFileStream method of the Volume where the asset file is stored, which in turn use...

Craft CMS: Incorrect path validation could potentially lead to path traversal

The ensurePathIsContained function of the Local file system class is theoretically vulnerable to path traversal, although no exploitable scenario has been discovered. When a file is read, an Asset object uses the getFileStream method of the Volume where the asset file is stored, which in turn use...

CVE-2026-70558 Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...

CVE-2026-70558

Dinky CVE-2026-70558 affects the v1.2.5 release and development branch. The vulnerable component is the POST /download/uploadFromRsByLocal handler, which passes a caller-supplied path directly to new File(path) and file.transferTo(dest) with no path validation. The route is SaIgnore’d and /downlo...

CVE-2026-70558 Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...

CVE-2026-15991

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

EUVD-2026-53703

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

CVE-2026-15991

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

CVE-2026-71309 rclone: Incomplete path validation allows backend root escape in serve restic

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...

CVE-2026-70603

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...

NPM: Electron: shell.openPath path validation bypass via embedded null byte

NPM: Electron: shell.openPath path validation bypass via embedded null byte vulnerability discovered by ? in WordPress Npm electron versions 39.8.6...

GHSA-5C9J-MHMV-5XGX Electron: shell.openPath path validation bypass via embedded null byte

Impact shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths for example, checking the file extension before passing them to shell.openPath could be bypassed, allowing an attacker-controlled path to open a different file than th...

Improper Neutralization of Null Byte or NUL Character

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Neutralization of Null Byte or NUL Character via the shell.openPath function. An attacker can bypass file path...

Electron: shell.openPath path validation bypass via embedded null byte

Impact shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths for example, checking the file extension before passing them to shell.openPath could be bypassed, allowing an attacker-controlled path to open a different file than th...

CVE-2026-70603 Electron: shell.openPath path validation bypass via embedded null byte

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...

CVE-2026-70603 Electron: shell.openPath path validation bypass via embedded null byte

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...

CVE-2026-70603

The provided documents describe CVE-2026-70603 for Electron: shell.openPath() could bypass path validation when a string-based check is used and embedded null bytes are present. Affected versions are prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1. If an application passes untrusted input-deri...

CVE-2026-70603 Electron: shell.openPath path validation bypass via embedded null byte

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...