CVE-2026-100520

Laranode versions before 1.2.1 are vulnerable to a path traversal vulnerability within the POST /filemanager/upload-file endpoint. This flaw allows authenticated users to bypass directory restrictions by supplying traversal sequences in the path parameter. Consequently, an attacker can write arbi...

CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

EUVD-2026-87375

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CLEANSTART-2026-GN20091 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the loki package. Previously, resolving relative paths containing parent directory '...

CVE-2026-100637: External Control of File Name or Path

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON fil...

CVE-2026-100636: Improper Limitation of a Pathname to a Restricted Directory

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences...

PT-2026-99186

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An issue exists in the QQBot voice attachment handling where filenames are decoded twice. This double decoding allows encoded traversal segments to reappear after the sanitization process, enabli...

PT-2026-99387

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description An authenticated customer with the export feature enabled can achieve host root and cross-tenant compromise. The issue occurs because the customer data-export DataDump cron fails to validate...

PT-2026-99307

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description A path traversal issue exists in the 'exportBrowserHTML' endpoint. Authenticated administrators can use directory traversal sequences in the folder parameter to write arbitrary HTML content to an...

PT-2026-99308

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description A path traversal issue exists in the 'checkoutRepo' endpoint. Authenticated administrators can overwrite arbitrary JSON files in pre-existing kernel-writable directories outside the workspace boundari...

PT-2026-99309

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description An issue exists in the 'setNotebookIcon' endpoint that allows authenticated administrators to perform path traversal, a technique used to access files and directories that are stored outside the web...

CVE-2026-100533: Improper Limitation of a Pathname to a Restricted Directory

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the...

WordPress 7.1.1 Path Traversal Checker

This diagnostic checker identifies whether WordPress versions 4.7.0 through 7.1.1 are exposed to an unauthenticated page-template path traversal issue and reports related compromise indicators...

CVE-2026-100520: Improper Limitation of a Pathname to a Restricted Directory

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CVE-2026-100549: Improper Limitation of a Pathname to a Restricted Directory

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended...

CVE-2026-100638: External Control of File Name or Path

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook...

Linux Distros Unpatched Vulnerability : CVE-2026-100689

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27j...

CVE-2026-100689: Improper Limitation of a Pathname to a Restricted Directory

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

PT-2026-99170

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description A path traversal issue exists in the tools.fs.workspaceOnly feature. This occurs because Unicode filename fallback can normalize validated parent directory components, allowing admitted requester...

PT-2026-99146

Name of the Vulnerable Software and Affected Versions Laranode versions prior to 1.2.1 Description Authenticated users can exploit a path traversal flaw to write arbitrary files outside their designated home directory. By providing directory traversal sequences in the path parameter of the 'POST...