149119 matches found
Exploit for Path Traversal in Gitlab
CVE-2026-85706 GitLab unauthenticated arbitrary file read ★ C...
EUVD-2026-88074
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...
CVE-2026-87723 Untrusted Search Path (PATH Hijacking) in fuse-archive
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...
CVE-2026-87723
Google fuse-archive versions prior to 1.24 are vulnerable to an Untrusted Search Path (PATH Hijacking) . An attacker capable of prepending a directory to the PATH or writing a malicious binary to a writable directory within the PATH can hijack the execution pathway. This vulnerability allows for ...
CVE-2026-87723 Untrusted Search Path (PATH Hijacking) in fuse-archive
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...
CVE-2026-87723 Untrusted Search Path (PATH Hijacking) in fuse-archive
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
CVE-2026-54675: Improper Limitation of a Pathname to a Restricted Directory
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution RCE. Authentication...
CVE-2026-19444: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. If the tar binary ...
CVE-2026-94287: Excessive Platform Resource Consumption within a Loop
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...
CVE-2024-58386: Improper Limitation of a Pathname to a Restricted Directory
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
PT-2026-99885
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Protection and control IED manager PCM600. This issue affects Protection and control IED manager PCM600: through 2.14...
PT-2026-99959
Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.10 FreePBX versions prior to 17.0.5 Description An issue in the sound language upload and conversion functionality allows an authenticated attacker with a known username to perform arbitrary file writes. This is...
PT-2026-99808
Name of the Vulnerable Software and Affected Versions eBA Plus Document and Workflow Management System versions 6.7.141 through 10.0.10 Description An improper limitation of a pathname to a restricted directory, known as Path Traversal, exists in the system. This flaw allows an attacker to access...
CVE-2026-82915: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Path Traversal. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.1...
CVE-2026-101142: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown functionality of the file Scorecard.jsp of the component Questionnaire Audio Upload. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been...
PT-2026-99890
Name of the Vulnerable Software and Affected Versions Canonical LXD affected versions not specified Description A path traversal issue exists in the Btrfs storage driver within the unpackVolume function. An authenticated user with instance creation privileges can delete or replace arbitrary files...
CVE-2026-85526: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...
PT-2026-99871
Name of the Vulnerable Software and Affected Versions dbgate versions prior to 7.3.2 Description A path traversal flaw exists in the Create Connection Endpoint component. The issue occurs within the zipJsonLinesData function located in the packages/api/src/utility/zipJsonLinesData.js file. By...
CVE-2026-101080: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skillscan/tools/dir/diractions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly...