CVE-2026-73259 Mongoose: Reflected XSS via decoded URI in directory listing render

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...

PT-2026-79083

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22 Description A reflected cross-site scripting issue exists when the MG ENABLE DIRLIST feature is enabled. A remote attacker can send a crafted percent-encoded request path to a user, which is then processed by th...

EUVD-2026-40240

nltk: Arbitrary File Read via Path Traversal in nltk.data.load through Percent-Encoded Sequences...

SUSE CVE-2026-66754

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...

CVE-2026-70615

Boringproxy 0.10.0 is affected by a newline injection in the tunnel-creation endpoint’s domain parameter, enabling authenticated, low-privilege users with tunnel-creation permission to inject lines into the SSH authorized_keys file. This may allow insertion of an unrestricted public key, granting...

Directory Traversal

Overview @theia/plugin-ext is a Theia - Plugin Extension Affected versions of this package are vulnerable to Directory Traversal through the HostedPluginReader in plugin-reader, specifically the /hostedPlugin/:pluginId/:path resource handler. An attacker can read arbitrary files accessible to the...

CVE-2026-18376

Koji's SCM URL parser normalizes repository paths using urllib.parse.urlparse and os.path.normpath before evaluating them against the configured SCM policy. Because normpath decodes percent-encoded sequences at policy-check time but the underlying Git HTTP transport decodes them again during fetc...

CVE-2026-69245 Guzzle: Noncanonical cookie domain keeps subdomain scope

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

Directory Traversal

Overview copier is an A library for rendering project templates. Affected versions of this package are vulnerable to Directory Traversal via percent-encoded parent-directory segments or encoded path separators in template URLs. An attacker can execute unsafe template features from a repository...

CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

EUVD-2026-51625

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-53502

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...

UBUNTU-CVE-2026-53502

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...

CVE-2026-53502

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...

PT-2026-66839

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description An issue exists in the file loader where percent-encoded path segments are decoded after the root-boundary validation. This occurs because the unquote function is applied to the file path after the...

SUSE CVE-2026-42882

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication middleware evaluates resource path patterns against the...

FreeBSD : mailpit -- WebSocket origin check bypass via percent-encoded path (52a3f202-8a77-11f1-ac5d-0897988a1c07)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 52a3f202-8a77-11f1-ac5d-0897988a1c07 advisory. Mailpit author reports: The cross-site WebSocket hijacking fix was reimplemented as an origin check gat...

openhole-server vulnerable to path traversal via URL-decoded request path

Summary openhole-server forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of the original request-target. Percent-encoded dot-segments %2e and separators %2f were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but...