CVE-2026-97023: UNIX Symbolic Link (Symlink) Following

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...

WS-2026-0084

OpenBao before 2.6.3 / 2.7.0-beta evaluated ACL policies against the raw request path, while several backends policies, cert, userpass and kubernetes auth roles, PKI, workflows resolve names canonically, for example case-insensitively or with whitespace and path segments normalized. A token...

PT-2026-99895

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.0 through 4.0.13 Canonical LXD versions 5.0 through 5.0.9 Canonical LXD versions 5.21 through 5.21.7 Canonical LXD versions 6.0 through 6.9 Description Improper link resolution in the migration receive path allows an...

CVE-2026-101066: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of the component Archive Link Creation. This manipulation of the argument linkedFolder causes path traversal. The attack may be initiated...

CVE-2026-86334: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a...

PT-2026-99888

Name of the Vulnerable Software and Affected Versions Dayforce Payroll version R2026.2.0 Description An unauthenticated attacker can perform a Path Traversal attack via the file download functionality. By sending a GET request with the file path parameter set to an absolute local file path, an...

CVE-2026-101132: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation of the argument dsh.bundle.patch results in path traversal...

CVE-2026-54708: Improper Limitation of a Pathname to a Restricted Directory

FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or writ...

CVE-2026-93537: Relative Path Traversal

A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include...

CVE-2026-73642: Improper Limitation of a Pathname to a Restricted Directory

Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4...

CVE-2026-15953: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Protection and control IED manager PCM600. This issue affects Protection and control IED manager PCM600: through 2.14...

CVE-2026-101069: Improper Limitation of a Pathname to a Restricted Directory

A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/src/controllers/databaseConnections.js of the component Export Handler. Executing a manipulation of the argument outputFile can lead to path traversal. The attack can be executed...

CVE-2026-102332: Improper Limitation of a Pathname to a Restricted Directory

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs...

PT-2026-99931

Name of the Vulnerable Software and Affected Versions kube-compare affected versions not specified Description A flaw exists when processing a container:// reference path, where the tool incorrectly executes the entrypoint of an untrusted container image instead of extracting data from a stopped...

PT-2026-99881

A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers/runners.js of the component Files Endpoint. The manipulation of the argument runid leads to path traversal. The attack is possible to be...

PT-2026-102332

Name of the Vulnerable Software and Affected Versions Eleveo Quality Management version 9.7.0 Description A path traversal issue exists in the Questionnaire Audio Upload component within the Scorecard.jsp file. This flaw allows a remote attacker to manipulate file paths to access unauthorized...

PT-2026-99927

Name of the Vulnerable Software and Affected Versions PMWeb versions 7.x through 2025.x Description A path traversal issue exists in the processing of the 'downloader.aspx' endpoint. This occurs when the FullFileName or FileName arguments are manipulated, allowing a remote attacker to access file...

PT-2026-102355

Name of the Vulnerable Software and Affected Versions ZoAP versions 1.8.0 through 1.9.x Description The CoAP link-format helper match path uri in subsys/net/lib/coap/coap link format.c contains an out-of-bounds read. The issue occurs when comparing a registered resource path against a URI in a...

PT-2026-108080

TuxCare rebuilt parse-path to address 1 CVE. Fixed in 4.0.4-tuxcare.1...

WS-2026-0076

OpenBao's ACL policy store built its policy cache key with path.JoinnamespaceID, name, so a crafted policy name containing path traversal sequences could resolve to a cached policy belonging to another namespace, including the root namespace. This allows a token in one namespace to be granted...