PT-2026-52828

Name of the Vulnerable Software and Affected Versions TemplateSpare versions 4.2.0 and earlier Description An issue allows an administrator to perform an arbitrary file upload. This means a user with high privileges can upload files of any type to the server, which could potentially lead to remot...

PT-2026-52765

Subscriber Arbitrary File Upload in Quform = 2.23.0 versions...

Unraid < 7.3.0 Multiple Command Injection Vulnerabilities (ZDI-26-385 / ZDI-26-386)

The remote host is running a version of Unraid prior to 7.3.0. It is, therefore, affected by multiple vulnerabilities: - A command injection vulnerability exists in the FileUpload.php file due to the lack of proper validation of a user-supplied string before using it to execute a system call. An...

PT-2026-52743

Customer Arbitrary File Upload in Booster for WooCommerce = 8.0.1 versions...

PT-2026-52991

Name of the Vulnerable Software and Affected Versions H.View HV-500S6 IP Camera affected versions not specified Description Certificate-related upload interfaces allow authenticated users to store arbitrary file content in fixed, persistent filesystem locations. The system fails to validate the...

PT-2026-52670

An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by improper validation of multipart upload headers when processing certificate-related upload fields. A remote attacker ma...

PT-2026-52766

Subscriber Arbitrary File Upload in Travel Booking = 2.2.5 versions...

PT-2026-52989

Name of the Vulnerable Software and Affected Versions DMP-5000 affected versions not specified Description The file service allows authenticated users to upload files of any type without validation. The system does not enforce file extension filtering or content inspection, which enables the uplo...

CVE-2026-33560: Unrestricted Upload of File with Dangerous Type

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and...

GO-2026-5712 Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GO-2026-5443 Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename in github.com/gotenberg/gotenberg

Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename in github.com/gotenberg/gotenberg...

GO-2026-5172 Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload in github.com/lin-snow/ech0

Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2026-5468 goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

goshs: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in goshs POST multipart upload in github.com/patrickhener/goshs...

CVE-2025-71333

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially...

CVE-2025-71324

Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile, where a fallback file-lookup path constructed...

Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF

Summary When verifying an uploaded certificate, lemur/certificates/verify.py extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An...

GHSA-54VG-PFH7-JQ95 Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF

Summary When verifying an uploaded certificate, lemur/certificates/verify.py extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An...

CVE-2025-71334 Flowise - Arbitrary File Access via Missing Chat Flow ID Validation

Flowise before 3.0.6 affected versions 2.2.8 and earlier contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value e.g., '../../../../../tmp' as the...

CVE-2025-71333 Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially...

CVE-2025-71333

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially...