Path Traversal

YesWiki is vulnerable to Path Traversal. The vulnerability is due to insufficient input validation due to improper sanitization of the squelette parameter, allowing unauthorized file read access on the server...

CVE-2025-32373

CVE-2025-32373 affects DNN (DotNetNuke) in the Microsoft ecosystem. In limited configurations, registered users may craft a request to enumerate or access portal files they should not have access to. The issue is fixed in version 9.13.8. Remediation: upgrade to 9.13.8 or newer to resolve the vuln...

PT-2025-15696 · Ibm · Ibm Security Guardium

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium versions 11.4 through 12.1 Description: The issue allows a privileged user to read any file on the system due to incorrect privilege assignment. Recommendations: For versions 11.4 through 12.1, update to a version that...

CVE-2024-41792

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices contains a path traversal vulnerability. This could allow an unauthenticated attacker it to access arbitrary files on the device with root privileges...

Unauthorized File Access

awssamcli is vulnerable to Unauthorized File Access. The vulnerability is due to improper handling of symlinks during the Docker build process, allowing access to privileged host files via elevated permissions...

Unauthorized File Access

awssamcli is vulnerable to Unauthorized File Access. The vulnerability is due to insecure symlink resolution during the build process, which causes the contents of symlinks to be copied into the local workspace cache as regular files, allows an attacker to access restricted files...

📄 Kemal Framework 1.6.0 Path Traversal

Kemal Framework version 1.6.0 suffers from a path traversal vulnerability. Exploit Title: Kemal Framework 1.6.0 - Path Traversal Discovered by: Ahmet Ümit BAYRAM Discovered Date: 04.04.2025 Vendor Homepage: https://github.com/kemalcr Software Link:...

CVE-2025-24233

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to read or write to protected files...

CVE-2025-24233

CVE-2025-24233 describes a permissions issue addressed by upgrades to macOS Ventura 13.7.5, macOS Sequoia 15.4, and macOS Sonoma 14.7.5. The issue could let a malicious app read or write to protected files. Remediation is to apply the fixed OS updates listed; no exploitation details are provided ...

CVE-2025-27716

CVE-2025-27716 affects HGW-BL1500HM (Ver 002.002.003 and earlier) and is a path traversal vulnerability in the USB storage file-sharing function. The issue arises in the file/folder listing path handling, allowing a crafted HTTP request from a LAN-connected device to obtain and/or alter product f...

CVE-2024-12905

An Improper Link Resolution Before File Access "Link Following" and Improper Limitation of a Pathname to a Restricted Directory "Path Traversal". This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intend...

CVE-2024-12905

CVE-2024-12905 affects the tar-fs package (index.js) and enables path traversal and related file writes/overwrites during extraction of crafted tar archives. Affected ranges: tar-fs < 1.16.4, < 2.1.2, and

PT-2025-13380

Name of the Vulnerable Software and Affected Versions tar-fs versions 0.0.0 through 1.16.3 tar-fs versions 2.0.0 through 2.1.1 tar-fs versions 3.0.0 through 3.0.7 Description This issue is related to an Improper Link Resolution Before File Access "Link Following" and Improper Limitation of a...

Incorrect Authorization

Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Incorrect Authorization due to missing checks in transformMiddleware which ignore certain query parameters. An attacker can access unauthorized files by including a ?raw?? ...

CVE-2024-10940

A flaw was found in Langchain Core. This vulnerability allows unauthorized users to read arbitrary files from the host file system by creating ImagePromptTemplate or ChatPromptTemplate with input variables that can access any user-specified path on the server. Mitigation Mitigation for this issue...

CVE-2025-26138

Systemic Risk Value =2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do n...

CVE-2024-9617

An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/fileid interface to view any user's file...

CVE-2024-10940

A vulnerability in langchain-core versions =0.1.17,=0.2.0,=0.3.0,0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchaincore.prompts.ImagePromptTemplate's and by extension langchaincore.prompts.ChatPromptTemplate's...

CVE-2024-7043

CVE-2024-7043 concerns open-webui/open-webui v0.3.8, where improper access control enables an attacker to enumerate and delete user-uploaded files via the API. The vulnerability arises because the system does not verify administrator privileges for GET /api/v1/files/ (listing files) and then enab...

CVE-2024-8551 Path Traversal in modelscope/agentscope

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of...