30 matches found
EUVD-2026-78167
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...
CVE-2026-91144
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...
CVE-2026-91144 ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...
CVE-2026-91144
ZFile through 5.0.5 suffers from a share entry filter bypass on its download endpoint. The application fails to validate requested file paths against a share link's allowed entries, allowing an attacker holding a valid share link to supply arbitrary file paths as query parameters and download any...
CVE-2026-91144 ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...
CVE-2026-91144 ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...
PT-2026-91742
Name of the Vulnerable Software and Affected Versions ZFile versions prior to 5.0.6 Description The download endpoint fails to validate requested file paths against the allowed entries of a share link. This allows an attacker with a valid share link to provide arbitrary file paths as query...
CVE-2026-91144: Authorization Bypass Through User-Controlled Key
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...
EUVD-2022-43372
Malicious code in bioql PyPI...
CVE-2022-40050
ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1...
ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution
A flaw was found in Artifex Ghostscript's psi/zfile.c component. This vulnerability allows arbitrary code execution via out-of-bounds data access...
ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution
A flaw was found in Artifex Ghostscript's psi/zfile.c component. This vulnerability allows arbitrary code execution via out-of-bounds data access...
ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution
A flaw was found in Artifex Ghostscript's psi/zfile.c component. This vulnerability allows arbitrary code execution via out-of-bounds data access...
CVE-2025-1818
A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. This issue affects some unknown processing of the file src/main/java/com/futvan/z/system/zfile/ZfileAction.upload. The manipulation of the argument file leads to unrestricted upload. The attack may be...
The vulnerability of the psi/zfile.c component in the software suite for processing, transforming, and generating Ghostscript documents allows a perpetrator to execute arbitrary code.
The vulnerability of the psi/zfile.c component of the software for processing, transforming, and generating Ghostscript documents is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
ALPINE-CVE-2024-46956
An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...
SUSE CVE-2024-46956
An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...
PT-2024-28980 · Oracle · Java
Name of the Vulnerable Software and Affected Versions: Java affected versions not specified Description: The issue allows an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validation. This could lead to remote code execution with no additional...
ZFile arbitrary file upload vulnerability
ZFile is a Java-based online web development program open-sourced by zfile-dev. ZFile v4.1.1 contains an arbitrary file upload vulnerability that stems from a lack of validation of uploaded files in its component /file/upload/1. An attacker could exploit this vulnerability to upload malicious fil...