CVE-2026-55552 Yamcs: Unauthenticated Directory Traversal

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...

CVE-2026-55552

Yamcs is a mission control framework affected by an unauthenticated directory traversal in StaticFileHandler.locateFile (yamcs-core). The method resolves request paths without calling Path.normalize and Path.toAbsolutePath to verify the result stays within the configured staticRoots, allowing tra...

CVE-2026-55552 Yamcs: Unauthenticated Directory Traversal

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...

CVE-2026-18080

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments function. This is due to missing file extension validation and missing path normalization whe...

PT-2026-82092

Name of the Vulnerable Software and Affected Versions RustDesk versions 1.3.9 through 1.4.9 Description A path traversal issue exists in the macOS clipboard file-paste code path. The application accepts file descriptor names provided by a peer and joins them to the target directory without...

PT-2026-80916

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.x Description A relative path traversal issue exists in the camel-azure-storage-datalake component during the...

CVE-2026-77815

toabspath in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by ispathtrusted in scripts/iib/api.py while...

CVE-2026-77815 Infinite Image Browsing Resolves Paths With normpath, Allowing Symlink Escape From Scanned Directories

toabspath in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by ispathtrusted in scripts/iib/api.py while...

openSUSE 16 Security Update : python-unearth (openSUSE-SU-2026:21606-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21606-1 advisory. Changes in python-unearth: - CVE-2026-73030: iswithindirectory function fails to normalize paths before validation and allows ../ sequences to bypass...

OPENSUSE-SU-2026:21606-1 Security update for python-unearth

This update for python-unearth fixes the following issues: Changes in python-unearth: - CVE-2026-73030: iswithindirectory function fails to normalize paths before validation and allows ../ sequences to bypass directory containment checks bsc1275440...

EUVD-2026-60470

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-71518 Typemill < 2.26.0 Authorization Bypass via Media File Download Route

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-52886: Improper Limitation of a Pathname to a Restricted Directory

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-49820 Probo has an open redirect bypass via path normalization

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Probo's saferedirect package validates redirect URLs used across authentication flows OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links. Prior to version...

CVE-2026-49820 Probo has an open redirect bypass via path normalization

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Probo's saferedirect package validates redirect URLs used across authentication flows OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links. Prior to version...

CVE-2026-49820

Probo (go.probo.inc/probo) carries a path normalization bug in its saferedirect redirect validator. Before patch 0.193.1, the validator only inspected the second character of relative paths, allowing crafted URLs like /../\evil.com to pass validation; Go's http.Redirect then normalizes the path t...

CVE-2026-49820 Probo has an open redirect bypass via path normalization

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Probo's saferedirect package validates redirect URLs used across authentication flows OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links. Prior to version...

CVE-2026-73658: Improper Input Validation

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path traversal

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7hxc-f267-h5q7. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal...

Security Bulletin: Vault vulnerable to LIST authorization bypass via trailing-slash strip

Summary Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a pat...