1013 matches found
CVE-2026-43749: Improper Limitation of a Pathname to a Restricted Directory
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root privileges...
CVE-2026-65436: Improper Limitation of a Pathname to a Restricted Directory
Editor Arbitrary File Deletion in Kirki = 6.0.13 versions...
CVE-2026-40000: Improper Limitation of a Pathname to a Restricted Directory
The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths e.g., content://zte.com.cn.filer.fileprovider/rootpath, enabling file access with t...
CVE-2026-59542: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...
CVE-2026-65754: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...
CVE-2026-7872: Improper Limitation of a Pathname to a Restricted Directory
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user...
CVE-2026-50163: Improper Limitation of a Pathname to a Restricted Directory
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", " /payload.tar.gz/evilcwdlink" to resolve header.Linkname...
CVE-2026-59866: Improper Limitation of a Pathname to a Restricted Directory
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when kiota...
CVE-2026-52890: Improper Limitation of a Pathname to a Restricted Directory
Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments....
CVE-2026-48338
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...
CVE-2026-48338 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...
CVE-2026-48319 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code...
CVE-2026-48350
Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to access sensitive files or directories outside the...
CVE-2026-48350
CVE-2026-48350 affects Adobe Animate with a Path Traversal vulnerability that can lead to arbitrary code execution in the context of the current user. An attacker could access sensitive files/directories outside the intended restrictions. Exploitation requires user interaction (victim opens a mal...
CVE-2026-48310
Adobe Experience Manager (AEM) is affected by an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal, CWE-22) vulnerability that could enable arbitrary file system read. The issue arises from an improper pathname restriction, allowing access to sensitive files outside the ...
CVE-2026-48310 Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access...
CVE-2026-48310 Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access...
EUVD-2026-43993
Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-45496
The CVE-2026-45496 entry describes a path traversal vulnerability in Visual Studio Code where improper limitation of a pathname to a restricted directory allows local attackers to bypass a security feature. Affected component is Visual Studio Code (path handling/file access) with the root cause b...
