1981 matches found
CVE-2026-77260: Improper Limitation of a Pathname to a Restricted Directory
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Confluence and Jira uploadattachment implementations accept an unconstrained filepath and open the referenced server-local file. A permitted MCP caller can upload sensitive host...
CVE-2026-77270: Improper Limitation of a Pathname to a Restricted Directory
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...
CVE-2026-77257: Improper Limitation of a Pathname to a Restricted Directory
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided filepath to local file operations without restricting it to the workspace. A remote MCP caller with tool access ca...
CVE-2026-84086
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
CVE-2026-84086
CVE-2026-84086 affects IBM Guardium Data Protection 12.2 and is a path traversal vulnerability (CWE-22) caused by improper limitation of a pathname to a restricted directory. A remote authenticated attacker with high privileges can exploit this to execute arbitrary code , resulting in high impact...
CVE-2026-84086 IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
CVE-2026-84086: Improper Limitation of a Pathname to a Restricted Directory
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
CVE-2026-45140: Improper Limitation of a Pathname to a Restricted Directory
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...
CVE-2026-53554: Improper Limitation of a Pathname to a Restricted Directory
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename data when selecting where uploaded content is stored, writes...
The vulnerability of the Linux operating system’s kernel, related to deficiencies in pathname restriction, allows attackers to trigger a service failure.
The vulnerability of the Linux operating system’s kernel is related to deficiencies in pathname restriction. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
EUVD-2026-81115
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...
CVE-2026-76409 Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Limitation of a Pathname
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...
CVE-2026-76409: Improper Limitation of a Pathname to a Restricted Directory
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...
CVE-2026-92137: Improper Limitation of a Pathname to a Restricted Directory
Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to create or replace arbitrary files on the...
CVE-2026-59944: Improper Limitation of a Pathname to a Restricted Directory
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...
PT-2026-93122
Name of the Vulnerable Software and Affected Versions Docker Sandboxes affected versions not specified Description The guest-to-host Unix-domain socket relay in Docker Sandboxes contains a flaw where it validates that a socket path is within an authorized workspace but subsequently reconnects usi...
CVE-2026-91751: Improper Limitation of a Pathname to a Restricted Directory
Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and newid parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries director...
CVE-2026-50024: Improper Limitation of a Pathname to a Restricted Directory
GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...
CVE-2026-83357: Improper Limitation of a Pathname to a Restricted Directory
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE component: Compiler. The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows...
