CVE-2026-120189

A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function saveuploadfile/mpuploadfile of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The...

CVE-2026-120189 D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow

A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function saveuploadfile/mpuploadfile of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The...

EUVD-2026-114738

A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function saveuploadfile/mpuploadfile of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The...

CVE-2026-120189

A stack-based buffer overflow vulnerability exists in the D-Link DIR-505 (version 1.10B02) within the TFTP Upload Filename Handler component. The flaw is located in the save_upload_file/mp_upload_file function of the /usr/bin/tftpd file. This vulnerability allows for remote exploitation via manip...

CVE-2026-120189: D-Link DIR-505: A vulnerability was identified in D-Link DIR-505 1.10B02

A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function saveuploadfile/mpuploadfile of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The...

PT-2026-134682

Name of the Vulnerable Software and Affected Versions D-Link DIR-505 version 1.10B02 Description A stack-based buffer overflow exists in the TFTP Upload Filename Handler component within the /usr/bin/tftpd file. The issue occurs when the save upload file or mp upload file functions process a...

CVE-2026-25548

CVE-2026-25548 — Remote Code Execution in InvoicePlane 1.7.0 Vulnerability: Remote Code Execution via Local File Inclusion + Log Poisoning Product: InvoicePlane Affected Version: 1.7.0 and likely prior versions Severity: Critical CVSS 3.1 Score: 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CW...

CVE-2026-101127 Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in...

CVE-2026-101127

The Joomla Extension - balbooa.com (specifically Balbooa Forms ) is vulnerable to an unauthenticated stored Cross-Site Scripting (XSS) in versions prior to 2.4.3.4 . The root cause is that the public form upload endpoint validates file extensions and MIME types but stores the attacker-supplied or...

CVE-2026-101127 Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in...

PT-2026-95739

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.09.003 Description Authenticated users with subscriber-level access and above can achieve Remote Code Execution via the wppa image magick function. The issue stems from insufficient sanitization of the...

CVE-2026-92919

admin3 versions through 3.0.0 are affected by an arbitrary file write vulnerability in the storage upload handler . The application fails to sanitize client-supplied filenames, allowing authenticated (low-privilege) users to inject dot-dot path traversal segments that escape the configured storag...

CVE-2026-85684

marker through version 2.0.0 contains a path traversal vulnerability in its FastAPI /marker/upload handler. The root cause is a failure to sanitize the file.filename parameter, allowing unauthenticated attackers to supply filenames containing directory traversal sequences. This permits writing ar...

CVE-2026-44829 Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives...

GHSA-WG2Q-39H6-66X9 goshs has a Path Traversal issue

Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. Finding Medium: upload filename escapes the served tree residual of CVE-2026-35393 The multipart filename fix updown.go lines 135-136 splits on the path...

goshs has a Path Traversal issue

Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. Finding Medium: upload filename escapes the served tree residual of CVE-2026-35393 The multipart filename fix updown.go lines 135-136 splits on the path...

PYSEC-2026-538 SGLang's multimodal generation runtime has an unauthenticated path traversal vulnerability

SGLang's multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints...

GO-2026-5443 Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename in github.com/gotenberg/gotenberg

Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename in github.com/gotenberg/gotenberg...

GHSA-HWC4-GMRW-5222 Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename

Summary filepath.Base on the Linux container does not strip backslashes , because \ is only a path separator on Windows. A multipart filename like ........\Windows\System32\evil.pdf survives Gotenberg's input sanitisation and lands verbatim as the zip entry name when a multi-output route...

Directory Traversal

Overview sglang is a SGLang is a fast serving framework for large language models and vision language models. Affected versions of this package are vulnerable to Directory Traversal via the upload filename parameter in specific endpoints. An unauthenticated attacker can overwrite or create...