CVE-2026-71313

The CVE affects the rclone local backend (local.go) from v1.51.0 through v1.75.0. A faulty filename encoder allows certain encodings (Slash, None, Raw, or Windows-preserving backslash variants) to be decoded into an actual parent-directory component by filepath.Join, enabling an attacker-controll...

EUVD-2026-53643

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

EUVD-2026-44530

rclone archive extract allows S3 destination prefix escape via crafted archive paths...

EUVD-2026-44533

rclone serve restic --private-repos authorization bypass: .. in the URL path lets an authenticated user read, overwrite and delete other users' repositories...

rclone: Path traversal in serve s3 allows reading and overwriting root-level files

Summary rclone serve s3 allows a client to read and write files at the root of the remote which would normally be inaccessible by using dot-dot path segments in the object key. It does not allow reading files outside of the root. A request such as GET /bucket/../root-secret.txt is handled as an...

CVE-2026-18959

CVE-2026-18959 affects yushine InnoShop (up to 0.8.2). The vulnerability resides in the Files Endpoint, specifically FileManagerController::destroyFiles in innopacks/restapi/routes/panel-api.php, which enables path traversal. It can be triggered remotely and an exploit has been published. The dis...

rclone: Incomplete path validation allows backend root escape in serve restic

Summary rclone serve restic does not correctly reject URL paths beginning with ../. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator. The issue affects rclone v1.40 through rclone v1.74.4...

CVE-2026-71309

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...

CVE-2026-17556

CVE-2026-17556 affects GitHub Enterprise Server. A path traversal bug allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the user storage directory (Git LFS objects, release assets, attachments, avatars). The issue arises from using the X-GitH...

CVE-2026-17556

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The...

CVE-2026-66881

CVE-2026-66881 affects Livebook: path traversal via URL-type file entries allows an attacker-authored notebook to cause arbitrary file writes controlled by the attacker. The root cause is that Livebook resolves the entry name beneath the session temp directory without enforcing containment, and f...

CVE-2026-66881

Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare fileentries metadata, each entry carrying a name. Every path that creates a file entry through...

CVE-2026-7658

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

CVE-2026-8183

Langflow OSS is affected (versions 1.0.0–1.10.3) by a vulnerability described as remote directory traversal via crafted URLs containing dot-dot sequences ( /.. / ), enabling access to arbitrary files on the system. The Connected CVE entry corroborates the affected versions and the traversal vecto...

CVE-2026-8183 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot "...

CVE-2026-8183

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot "...

CVE-2026-7658 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

CVE-2026-7658

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

CVE-2026-7869

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker...