CVE-2026-19722 WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

CVE-2026-82656: Improper Limitation of a Pathname to a Restricted Directory

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

PT-2026-83582

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

CVE-2026-82450

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

EUVD-2026-68105

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450 BookStack before 26.05.4 Remote Code Execution via Book Cover

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450

BookStack before version 26.05.4 is affected by a remote code execution vulnerability in the portable ZIP import functionality. A user with Import Content and Create Books permissions can upload a PHP polyglot file disguised as a book cover. The attacker bypasses image extension validation by emb...

CVE-2026-82450 BookStack before 26.05.4 Remote Code Execution via Book Cover

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450 BookStack before 26.05.4 Remote Code Execution via Book Cover

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

CVE-2026-82450: Unrestricted Upload of File with Dangerous Type

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

Unity Linux 20.1070e Security Update: libarchive (UTSA-2026-104945)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104945 advisory. A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryptio...

PT-2026-83429

Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.05.4 Description An authenticated remote code execution issue exists in the portable ZIP import functionality. Users possessing both Import Content and Create Books permissions can upload a PHP-image polyglot...

SUSE CVE-2026-15310

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

CVE-2026-81838

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

CVE-2026-59311

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

CVE-2026-81838

CVE-2026-81838 is a Zip Slip (arbitrary file write) vulnerability in AWS diagram-as-code (awsdac) , versions 0.10 through 0.23 . The zip extraction functionality fails to sanitize entry names, allowing a third party to craft zip entries with path traversal sequences that write arbitrary files to ...

CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

EUVD-2026-67232

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...