110171 matches found
EUVD-2026-75175
In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...
PT-2026-89419
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...
PT-2026-89369
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...
PT-2026-89645
🚨 CVE-2026-84889 IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory. 🎖@cveNotify...
Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-2131)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2131 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function...
PT-2026-89725
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with pat...
Gitlab -- vulnerabilities
Gitlab reports: Path Traversal issue in repository commits API impacts GitLab CE/EE Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE Buffer Overflow issue in Unicode conversion wrapper impacts GitLab EE Scheduled Pipeline Execution Policy test allows Developers ...
PT-2026-89475
Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...
PT-2026-89417
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...
PT-2026-89423
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument file path leads to path traversal. Local...
PT-2026-89479
🚨 CVE-2026-88938 knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full...
PT-2026-89266
The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backup file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...
Amazon Linux 2 : containerd (ALASECS-2026-136)
The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-136 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...
CVE-2025-57231
Docmost v0.21.0 contains a Path Traversal vulnerability in avatar attachments , allowing an unauthenticated attacker to disclose local files by sending a POST request to a public URL. The CVSS 3.1 score is 7.5 (HIGH) with impact limited to confidentiality (no integrity or availability impact). Th...
PT-2026-89502
Summary Multiple backends, when given a specially crafted object to copy, can escape the backend confinement. | Backend | Keep/Close | Per-backend severity | |---|---|---| | sftp | Medium | Real filesystem escape, fires under default encoding. | | smb | Low-Medium | Escapes to a different SMB sha...
Next.js Unauthenticated Remote Code Execution
This Metasploit module exploits a remote code execution vulnerability in Next.js applications hosted on Windows servers. Specifically crafted requests can execute arbitrary code on the target server. The affected versions include releases from 13.4.0 up to 15.5.24, and 16.0.0 up to 16.3.3,...
PT-2026-89477
knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...
PT-2026-89279
Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled it's by default enabled. This issue affects Apache FreeMarker from 2.2.0...
PT-2026-89262
The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...
