2187 matches found
CVE-2026-53757 Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE
Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...
CVE-2026-81939: Improper Limitation of a Pathname to a Restricted Directory
A Zip Slip vulnerability in the SonicWall Network Security Manager NSM On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive...
PT-2026-86233
Name of the Vulnerable Software and Affected Versions SonicWall Network Security Manager NSM On-Prem affected versions not specified Description A Zip Slip issue exists in the file upload and archive processing functionality. This allows an attacker to extract files outside the intended destinati...
SonicWall NSM On-Prem Affected By Multiple Vulnerabilities
1 CVE-2026-78327 - Authenticated Command Injection Vulnerability An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin...
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
Summary The @apostrophecms/import-export module reconstructs the on-disk source path of every imported attachment from JSON metadata contained in the uploaded archive. The archive carries an aposAttachments.json file whose name and extension fields are concatenated into a filesystem path with no...
EUVD-2026-68806
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to...
CVE-2026-61639 Wallos: Zip Slip path traversal in database restore writes files to webroot
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to...
CVE-2026-61639
Wallos , an open-source self-hostable personal subscription tracker, contains a Zip Slip path traversal in POST /endpoints/db/restore.php prior to version 4.9.6 . The endpoint calls ZipArchive::extractTo() without validating entry names for ../ sequences. An authenticated admin can upload a craft...
CVE-2026-61639 Wallos: Zip Slip path traversal in database restore writes files to webroot
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to...
CVE-2026-61639 Wallos: Zip Slip path traversal in database restore writes files to webroot
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to...
PT-2026-83992
Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.6 Description An issue exists where the application fails to validate entry names for directory traversal sequences when processing zip files. An administrator can upload a specially crafted zip archive to the 'POS...
EUVD-2026-68242
Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...
CVE-2026-19722 WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...
CVE-2026-19722
The WPvivid — Backup, Migration & Staging WordPress plugin (versions before 0.9.133 ) is vulnerable to a Zip Slip path-traversal condition during the backup restoration process. The application fails to validate the destination paths of files extracted from a backup package, allowing high-privile...
CVE-2026-19722 WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...
CVE-2026-81838
CVE-2026-81838 is a Zip Slip (arbitrary file write) vulnerability in AWS diagram-as-code (awsdac) , versions 0.10 through 0.23 . The zip extraction functionality fails to sanitize entry names, allowing a third party to craft zip entries with path traversal sequences that write arbitrary files to ...
CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...
CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...
CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...
