665 matches found
CVE-2026-109118
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
CVE-2026-109119
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
CVE-2026-109119 Missing Authorization in rdiffweb
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
EUVD-2026-102836
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
CVE-2026-109119 Missing Authorization in rdiffweb
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
CVE-2026-109119
The rdiffweb application contains an Improper Privilege Management vulnerability in the user management API endpoint (/api/users/{username_or_id}). This flaw allows authenticated users to perform a privilege escalation to administrator status by modifying the role parameter within a POST request ...
CVE-2026-109119
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
CVE-2026-109118 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
CVE-2026-109118
The ikus060 rdiffweb 7.1.1 software contains a Path Traversal vulnerability (CWE-22) due to an improper path containment check. An authenticated user can use a percent-encoded traversal sequence (%2e%2e) in the request path to cause browse, restore, history, and delete operations to resolve to pa...
EUVD-2026-102835
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
CVE-2026-109118
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
CVE-2026-109118 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
CVE-2026-109118 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
PT-2026-115578
Name of the Vulnerable Software and Affected Versions Rdiffweb affected versions not specified Description Improper Privilege Management in the user management API endpoint '/api/users/username or id' allows authenticated users to elevate their privileges to administrator. This is achieved by...
CVE-2026-109119: Missing Authorization
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
PT-2026-115577
Name of the Vulnerable Software and Affected Versions rdiffweb version 7.1.1 Description An improper path containment check allows an authenticated user to perform browse, restore, history, and delete operations on paths outside the intended repository. This occurs because the system uses a strin...
CVE-2026-109118: Improper Limitation of a Pathname to a Restricted Directory
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
Iku-soft Rdiffweb authorization issue vulnerability
The iKus-Soft RDiffWeb versions prior to 2.10.6 have a vulnerability related to authorization. This vulnerability stems from improper permission management in the user management API endpoint /api/users/usernameorid. Users who have been authenticated can elevate their permissions to administrator...
ikus-soft rdiffweb path traversal vulnerability
Versions of ikus-soft rdiffweb prior to version 7.1.1 have a path traversal vulnerability. This vulnerability stems from improper inclusion checks for paths, using string prefix comparisons instead of file system path boundary checks. Authenticated users can traverse sequences encoded with percen...
