CVE-2026-37071

CVE-2026-37071 Renombrado arbitrario de archivos que conduce a escalada de privilegios en la función Actions::renameFile de Veno File Manager Project 4.4.9 permite que un atacante autenticado con el permiso 'reanme' se apodere de la cuenta de superadministrador mediante una solicitud POST...

CVE-2026-62278

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2026-62278 LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2026-62278: Improper Limitation of a Pathname to a Restricted Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2026-37071: Improper Privilege Management

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...

CVE-2026-37071

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...

PT-2026-82674

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...

EUVD-2026-67259

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...

CVE-2026-45139: External Control of File Name or Path

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist 'css','js','html','txt','json','sql','md' on content-write operations saveFile, createFile, but two destructive endpoints — deleteFileOrFolder and...

CVE-2025-2032

A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal. The exploit has been disclosed to the public and may be used...

CVE-2025-2032

A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal. The exploit has been disclosed to the public and may be used...

CVE-2025-2032 ChestnutCMS rename renameFile path traversal

A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal. The exploit has been disclosed to the public and may be used...

CVE-2025-2032 ChestnutCMS rename renameFile path traversal

A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal. The exploit has been disclosed to the public and may be used...

CVE-2025-2032

CVE-2025-2032 affects ChestnutCMS 1.5.2. The vulnerability is in the function renameFile of the file /cms/file/rename, where manipulation of the argument rename leads to a path traversal flaw. Documents indicate the exploit has been disclosed publicly and may be used, but do not provide specific ...

CVE-2025-2032: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal. The exploit has been disclosed to the public and may be used...

PT-2025-9978

Name of the Vulnerable Software and Affected Versions ChestnutCMS version 1.5.2 Description A problematic vulnerability was found in the renameFile function of the /cms/file/rename API endpoint. The manipulation of the rename argument leads to path traversal. The exploit has been publicly...

CVE-2019-19731

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder...

PT-2019-15931

Name of the Vulnerable Software and Affected Versions Roxy Fileman version 1.4.5 Description The issue allows a remote attacker to perform path traversal, enabling them to write uploaded files to arbitrary locations using the RENAMEFILE action. This can be exploited for code execution by uploadin...

Roxy Fileman 1.4.5 - Directory Traversal

Roxy Fileman 1.4.5 - Directory Traversal Exploit Title: Roxy Fileman 1.4.5 - Directory Traversal Author: Patrik Lantz Date: 2019-12-06 Software: Roxy Fileman Version: 1.4.5 Vendor Homepage: http://www.roxyfileman.com/ Software Link: http://www.roxyfileman.com/download.php?f=1.4.5-net CVE:...

CVE-2019-19731: Improper Limitation of a Pathname to a Restricted Directory

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder...