GHSA-CJ54-HPCC-GJ6H Thumbor has path traversal via post-validation URL decoding bypass in file_loader

The fileloader performs unquote on the file path AFTER the abspath + startswith security check. An attacker can use percent-encoded path traversal sequences %2e%2e for .. that pass the security check as literal directory names, but are then decoded to actual .. traversal sequences. Affected code...

Directory Traversal

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Directory Traversal via the GeneralUtility::isAllowedAbsPath function. An attacker can access files outside the intended project root by creating new file storag...

PT-2017-14691 · Automattic · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce plugin versions 3.x Description: The issue concerns a Directory Traversal vulnerability via the /wp-content/plugins/woocommerce/templates/emails/plain/ URI, which could potentially access a parent directory. However, a software...