EUVD-2026-64724

A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument displayname results in path traversal. The attack requires a loc...

CVE-2026-78196

achorein expo-share-intent (versions up to 8.0.0) is affected by a path traversal vulnerability in the getDataColumn function of ExpoShareIntentModule.kt, within the Android File Copy Routine component. Manipulating the _display_name argument allows an attacker to traverse file paths. The attack ...

CVE-2026-78196 achorein expo-share-intent Android File Copy Routine ExpoShareIntentModule.kt getDataColumn path traversal

A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument displayname results in path traversal. The attack requires a loc...

CVE-2026-49245

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

EUVD-2026-63713

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-49245

SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 are affected by a stored XSS vulnerability. The inline query parameter on browsable-share and authenticated user-file download endpoints suppressed Content-Disposition: attachment, allowing an attacker-placed HTML file in a ...

EUVD-2026-63709

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controlled HTML file stored in a share or home...

EUVD-2026-63639

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

CVE-2026-54509 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

CVE-2026-54509

TREK (collaborative travel planner) versions 3.0.0 through 3.1.0 contain an IDOR vulnerability in the GET /api/journeys/:id/share-link route. The endpoint returns a journey share token without verifying that the authenticated requester owns or has access to the target journey. Because journey IDs...

CVE-2026-54509 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

PT-2026-79188

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 is affected by a missing authorization flaw in the REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go. Unlike the sibling handler for GET /a/share/cell/{Uuid}, which enforces MatchPolicies with ResourcePolicyAction_READ, the link handler calls L...

CVE-2026-76032 Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-76032 Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

EUVD-2026-61205

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...

CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...