Directory Traversal

Overview patool is a portable archive file manager Affected versions of this package are vulnerable to Directory Traversal in the safeextract function in patoolib/programs/pytarfile.py when running on Python versions before 3.12, due to the use of os.path.commonprefix for character-level string...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal due to incorrect path string matching in the limit container paths process. An attacker can bypass intended directory restrictions by placing containers in sibling directories with similar names, allowing unauthorize...

0.extends.wechat (>=1.0.51, <=1.0.65), 007putra-my-bot (1.1.1) +17690 more potentially affected by CVE-2026-56876 via extract-zip (>=2.0.0, <=2.0.1)

extract-zip NPM version =2.0.0, =1.0.51, =0.0.1, =1.0.0, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: CVE-2026-56876 Source advisory: OSV:GHSA-JMR9-QJV8-65GV...

Directory Traversal

Overview extract-zip is an unzip a zip file into a directory using 100% javascript Affected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that poin...

Directory Traversal

Overview org.webjars.npm:extract-zip is an unzip a zip file into a directory using 100% javascript Affected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing...

Directory Traversal

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Directory Traversal via the StaticDirectoryHandler process. An attacker can gain unauthorized access to static files by sending requests with encoded slashes %2F i...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the StaticDirectoryHandler process. An attacker can gain unauthorized access to static files by sending requests with encoded slashes %2F in the URL, which bypasses route-level access controls due to inconsistent...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the StaticDirectoryHandler process. An attacker can gain unauthorized access to static files by sending requests with encoded slashes %2F in the URL, which bypasses route-level access controls due to inconsistent...

Directory Traversal

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Directory Traversal via the StaticDirectoryHandler process. An attacker can gain unauthorized access to static files by sending requests with encoded slashes %2F i...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the path parameter. An attacker can access arbitrary files outside the intended directory by submitting crafted input. Details A Directory Traversal attack also known as path traversal aims to access files and...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper validation of user-supplied input in the path parameter. An attacker can access arbitrary files outside the intended directory by crafting specially designed path values. Details A Directory Traversal...

GO-2026-5735 DDEV has ZipSlip path traversal in tar and zip archive extraction in github.com/ddev/ddev

DDEV has ZipSlip path traversal in tar and zip archive extraction in github.com/ddev/ddev...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the dump process when handling attacker-controlled message IDs via the --http interface. An attacker can write arbitrary files to the filesystem by supplying crafted message IDs that exploit path traversal...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the PATCH process for public shares. An attacker can access or modify files outside the intended shared directory by crafting malicious requests that exploit improper path validation. Details A Directory Traversa...

GO-2026-5464 androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers) in github.com/mvt-project/androidqf

androidqf: Zip entry Name Injection in APK bundle Zip Slip for zip consumers in github.com/mvt-project/androidqf...

Directory Traversal

Overview pynetdicom is an A Python implementation of the DICOM networking protocol Affected versions of this package are vulnerable to Directory Traversal via the qrscp application's C-STORE handler, which uses attacker-supplied DICOM dataset values directly in os.path.join without sanitization. ...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the etcd snapshot decompression process. An attacker can overwrite arbitrary files on the filesystem by supplying a ZIP archive containing entries with specially crafted file paths when an administrator restores a...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the RemoveAll process during upload failure-cleanup. An attacker can delete files outside their authorized directory by leveraging a symlink within their permitted scope, thereby bypassing intended access...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the RemoveAll process during upload failure-cleanup. An attacker can delete files outside their authorized directory by leveraging a symlink within their permitted scope, thereby bypassing intended access...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the RemoveAll process during upload failure-cleanup. An attacker can delete files outside their authorized directory by leveraging a symlink within their permitted scope, thereby bypassing intended access...