Directory Traversal

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization of filenames in the client-upload signed-URL endpoints for S3, GCS, Azure, and R2. An attacker can escape the...

Directory Traversal

Overview sillytavern is a LLM Frontend for Power Users Affected versions of this package are vulnerable to Directory Traversal via the avatarurl parameter in the chat export and delete endpoints. An attacker can read or delete arbitrary files within the user data root by supplying directory...

Directory Traversal

Overview sillytavern is a LLM Frontend for Power Users Affected versions of this package are vulnerable to Directory Traversal via the createRouteHandler function. An attacker can determine the existence of arbitrary files on the server's filesystem by sending specially crafted requests containin...

Directory Traversal

Overview @anthropic-ai/sdk is a The official TypeScript library for the Anthropic API Affected versions of this package are vulnerable to Directory Traversal via improper validation of user-supplied paths in the memory tool. An attacker can access or modify files outside the intended sandboxed...

Directory Traversal

Overview onnxruntime is a performance-focused scoring engine for Open Neural Network Exchange ONNX models. Affected versions of this package are vulnerable to Directory Traversal due to insufficient validation of external TensorProto data paths. The external data loading path validation did not...

Directory Traversal

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal via the mediaUrl and fileUrl parameters, which bypass validation of localRoots. An attacker can access arbitrary files on the local filesystem by supplying crafted...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through improper validation of URL-encoded traversal sequences in the backend process. An attacker can delete critical configuration directories by supplying specially crafted paths. Details A Directory Traversal...

Directory Traversal

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal via the mediaUrl or fileUrl parameter keys, which are not properly normalized in the relevant process. An attacker can access sensitive files belonging to other agents...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via the...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via the extractarchivetodir function. An attacker can overwrite arbitrary files or gain elevated privileges by supplying a crafted tar.gz file containing malicious paths during...

Exploit for Exposure of Resource to Wrong Sphere in Linuxfoundation Containerd

ZipSlip Container Escape Vulnerability in containerd CVE...

Exploit for Exposure of Resource to Wrong Sphere in Linuxfoundation Containerd

ZipSlip Container Escape Vulnerability in containerd CVE...

Path Traversal

pf4j is vulnerable to Path Traversal. The vulnerability is due to improper handling of zip entry names, where a lack of proper path normalization and validation can allow directory traversal or Zip Slip attacks...

Directory Traversal

Overview langchain-core is a Building applications with LLMs through composability Affected versions of this package are vulnerable to Directory Traversal via the loadprompt, loadpromptfromconfig, or .save methods on prompt classes. An attacker can access arbitrary files on the host filesystem by...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the uploaduserfile function. An attacker can overwrite or create files in arbitrary locations on the filesystem by submitting specially crafted filenames containing path traversal sequences in the multipart form...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the systemd.credential process. An attacker can overwrite arbitrary files on the host system by crafting credential names that traverse directories. This can lead to privilege escalation or denial of service by...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the systemd.credential process. An attacker can overwrite arbitrary files on the host system by crafting credential names that traverse directories. This can lead to privilege escalation or denial of service by...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal when using a custom frontend. An attacker can write files outside of the intended storage root by crafting a malicious API message when an untrusted frontend is used with syntax or --build-arg BUILDKITSYNTAX. Note:...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the explodeExtension function. An attacker can access unauthorized files by supplying specially crafted file extensions containing path separators. Details A Directory Traversal attack also known as path traversal...

Linux Distros Unpatched Vulnerability : CVE-2025-70952

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory...