EUVD-2026-90369

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the...

CVE-2026-102089 Kiteworks Email Protection Gateway path traversal

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the...

CVE-2026-102089 Kiteworks Email Protection Gateway path traversal

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the...

CVE-2026-102089

The Kiteworks Email Protection Gateway (versions before 9.5.0) is vulnerable to a path traversal weakness within an administrative import function. This flaw allows an authenticated administrator to write files to arbitrary locations on the server, which could potentially be leveraged to achieve ...

CVE-2026-102991 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991

The Mako Python template library is vulnerable to a path traversal flaw on Windows in versions prior to 1.4.2 . The issue stems from a discrepancy where TemplateLookup.get_template() uses posixpath to resolve URIs, while Template.__init__() uses os.path (which utilizes ntpath) for validation. Att...

CVE-2026-102991 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CLEANSTART-2024-DG53593 path traversal flaw was found in Buildah in versions before 1

Security vulnerability affects the buildah package. A path traversal flaw was found in Buildah in versions before 1...

CVE-2026-101885 ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasmpath manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins director...

EUVD-2026-90258

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasmpath manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins director...

CVE-2026-101885 ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasmpath manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins director...

CVE-2026-101885

Versions of ZeroClaw before 0.8.5 built with the plugins-wasm feature are vulnerable to a path traversal vulnerability during plugin installation. The root cause is a failure to validate the wasm_path manifest field, which allows an attacker to trick a user into installing a crafted plugin. This ...

CVE-2026-101885 ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasmpath manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins director...

Kiteworks multiple vulnerabilities

RECOMMENDED PRACTICES Fixed in version 9.5.0 and 9.5.1. 2. DESCRIPTION Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the...

CLEANSTART-2026-ZB48297 Git, a revision control system, is vulnerable to path traversal prior to versions 2

Security vulnerability affects the git package. Git, a revision control system, is vulnerable to path traversal prior to versions 2...

CVE-2026-55224

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...