GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read

GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or...

CVE-2024-38819-POC2

CVE-2024-38819: Prueba de Concepto PoC Esta es una prueba de concepto para la vulnerabilidad CVE-2024-38819, la cual reporté, demostrando un exploit de path traversal. Pasos de Ejecución 1. Construir la imagen Docker Spring Boot 3.3.4, basado en Spring Framework 6.1.13 root@kitploit: cd vuln dock...

CVE-2026-12243-NLTK-PoC

CVE-2026-12243 — Laboratorio de Path Traversal en NLTK Un laboratorio Docker pequeño y reproducible que contrasta el comportamiento de path traversal con codificación porcentual en NLTK 3.9.4 con el comportamiento corregido en NLTK 3.10.0. La versión vulnerable valida el nombre del recurso antes ...

CVE-2021-41773-POC

CVE-2021-41773 Informe de Reproducción de Vulnerabilidad Resumen de la Vulnerabilidad CVE ID : CVE-2021-41773 Nombre de la Vulnerabilidad : Vulnerabilidad de Path Traversal en Apache HTTP Server Nivel de Riesgo : Alto CVSS 7.5 Versiones Afectadas : Apache HTTP Server 2.4.49 Descripción de la...

CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

Aviso de seguridad: Denegación de servicio remota mediante aserción alcanzable en el manejo de prefijos de URL rouille CVE ID asignado: CVE-2026-66754 Resumen Request::removeprefix comprueba la URL decodificada en porcentaje, pero hace la aserción sobre la URL cruda. Una solicitud cuya ruta...

CVE-2026-73319

CVE-2026-73319: JavaScript URI accepted as a dynamic redirect XenForo before 2.3.13 accepts a same-host javascript: URI as a dynamic redirect and later assigns it to window.location. What happens Server-side redirect validation rejects foreign hosts but does not require HTTP or HTTPS. A URL shape...

CVE-2026-69201

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn ...

CVE-2026-69201 Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn ...

CVE-2026-86818

A flaw was found in fast-uri, a Node.js URI parser. In versions 4.1.3 and 4.1.4, the mailto parser incorrectly handles percent-encoded query field names. This desynchronization between parsing and serialization allows an attacker to inject arbitrary recipients, subjects, or body content into mail...

DEBIAN-CVE-2026-86818

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86472

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

CVE-2026-86472

A flaw was found in fast-uri, a dependency-free URI parser. This vulnerability occurs because the software folds the host to lowercase before percent-decoding it, allowing percent-encoded uppercase characters to bypass this normalization. A remote attacker could exploit this by crafting a malicio...

CVE-2026-86818

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86818 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still...

CVE-2026-86818

fast-uri v4.1.3–4.1.4, a dependency-free RFC 3986 URI parser for Node.js used by Fastify and ajv , suffers from a percent-encoded field-name desynchronization in its mailto parser. At parse time, reserved field names (to, subject, body) are compared in their still-percent-encoded form and thus no...

EUVD-2026-78395

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

CVE-2026-86472

fast-uri is a dependency-free RFC 3986 URI parser for Node.js used by Fastify and ajv . In versions before 2.4.7, 3.0.0–3.1.7, and 4.0.0–4.1.4, the library folds the host to lowercase before percent-decoding, so a percent-encoded uppercase octet (e.g. %41 → A) is never folded. For scheme-relative...

Linux Distros Unpatched Vulnerability : CVE-2026-86818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 an...

Linux Distros Unpatched Vulnerability : CVE-2026-86472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 throu...

CVE-2026-55846 Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath in Commands.setUpServer in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the...