1979 matches found
CVE-2026-54352: Improper Limitation of a Pathname to a Restricted Directory
Budibase is an open-source low-code platform. Prior to 3.39.9, POST /api/pwa/process-zip at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with [email protected] into a temp directory, then for each entry listed in icons.json validates the icon path, open...
CVE-2025-64152: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue...
CVE-2025-55017: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue...
GO-2026-5186 goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs
goshs: Improper Limitation of a Pathname to a Restricted Directory Path Traversal in github.com/patrickhener/goshs...
CVE-2026-56054: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in JS Help Desk = 3.1.1 versions...
CVE-2026-55092: Improper Limitation of a Pathname to a Restricted Directory
Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a...
CVE-2026-55667: Improper Limitation of a Pathname to a Restricted Directory
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope other tenants' data, a...
The vulnerability of the Content Credentials SDK libraries arises from an incorrect pathname limitation for access to restricted directories. This allows attackers to write to arbitrary files or directories.
The vulnerability of the Content Credentials SDK libraries exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a attacker to write to arbitrary files or directories using a specially created malicious file...
CVE-2026-10601: Improper Limitation of a Pathname to a Restricted Directory
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the...
GHSA-HMCR-RMJQ-47QR NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
Summary The spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the fix it was reachable unauthenticated, and its URL-extension allowlist was a regex tested against the full URL string, so URLs whose query string ended in .csv for example...
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
Summary The spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the fix it was reachable unauthenticated, and its URL-extension allowlist was a regex tested against the full URL string, so URLs whose query string ended in .csv for example...
CVE-2025-69128
Technical details about CVE-2025-69128 are not publicly available in the provided documents. Monitor for updates from vendors/security advisories; the records confirm a path traversal vulnerability in JobCareer
PT-2026-50477
Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1 Description The 'spreadsheet-import' endpoint axiosRequestMake could be used as a generic HTTP proxy. The endpoint was reachable without authentication, and its URL-extension allowlist used a regular expressi...
ROS-20260617-73-0021
The vulnerability of the console-based graphic editor ImageMagick is related to deficiencies in pathname restrictions for the directory. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...
CVE-2025-69131: Improper Limitation of a Pathname to a Restricted Directory
Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site = 1.0.7 versions...
CVE-2025-60223: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot = 13.6.5 versions...
ROS-20260617-73-0022
The vulnerability of the console-based graphic editor ImageMagick is related to deficiencies in pathname restrictions for the directory. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...
CVE-2026-54193: Improper Limitation of a Pathname to a Restricted Directory
Contributor Arbitrary File Deletion in Fusion Builder = 3.15.4 versions...