acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

PT-2026-88002

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-6377 Path Traversal in Next4Biz's CSM (Customer Service Management)

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Path Traversal. This issue affects CSM Customer Service Management: from 6.8.9 before 8.0.3...

CVE-2025-15693: Improper Limitation of a Pathname to a Restricted Directory

The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate...

CVE-2026-17622

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

EUVD-2026-71596

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory...

EUVD-2026-70801

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...

PT-2026-85697

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory...

CVE-2026-85661: Improper Limitation of a Pathname to a Restricted Directory

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCELFILESPATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

CVE-2026-19306: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material secretkey, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories — by supplying absolute pat...

CVE-2026-19303: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory...

PT-2026-85769

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

CVE-2026-85439 MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...

CVE-2026-85439 MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...

CVE-2026-75602: Improper Limitation of a Pathname to a Restricted Directory

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

Incorrect Authorization

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Incorrect Authorization in BaseApp.removeBase, FetchState pathname stripping, and matchRequest in the routing and app base-handling...

The vulnerability of open libraries and tools written in C# ROS# relates to errors in the mechanism for handling relative pathnames to directories. This allows attackers to gain access to read, modify, or delete data.

The vulnerability of open libraries and tools written in C for ROS is related to errors in the mechanism for handling relative pathnames to directories. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to read, modify, or delete data...

CVE-2026-61639: Improper Limitation of a Pathname to a Restricted Directory

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to...

The vulnerability of the Dovecot mail server, related to deficiencies in pathname restriction, allows attackers to gain access to confidential data.

The vulnerability of the Dovecot mail server is related to deficiencies in pathname restriction. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

CVE-2026-78677: Improper Limitation of a Pathname to a Restricted Directory

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...