PYSEC-2026-2193

LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchaincore.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an...

PT-2026-28599

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 1.2.22 Description Multiple functions within langchain core.prompts.loading read files from paths embedded in deserialized configuration dictionaries without validating against absolute path injection or directory...

CVE-2025-57403

Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL or a portion of it directly with a base path using os.path.join. This bypass allows directory traversal or absolute path injection, leading to th...

CVE-2025-57403

Cola Dnslog v1.3.2 is vulnerable to a Directory Traversal flaw during the processing of DNS TXT record queries . The root cause is the insecure use of os.path.join to concatenate a requested URL (or a portion of it) directly with a base path. This flaw allows for directory traversal or absolute p...

EUVD-2025-205449

Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL or a portion of it directly with a base path using os.path.join. This bypass allows directory traversal or absolute path injection, leading to th...

CVE-2021-30173

CVE-2021-30173 involves a Local File Inclusion vulnerability in the omni-directional communication system (Jun-He/Junghee/Junghee-type Total Communication System). The issue arises when an authenticated attacker injects an absolute path into the Url parameter, enabling access to arbitrary files o...