2480 matches found
DEBIAN-CVE-2026-74859
The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...
EUVD-2026-72559
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...
CVE-2026-68896: Absolute Path Traversal
Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...
PT-2026-87614
Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally...
CVE-2026-69612: Absolute Path Traversal
Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally...
SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath
CVE: This vulnerability corresponds to CVE-2026-72802. Summary POST /api/asset/resolveAssetPath returns the resolved absolute filesystem path of an asset, unmodified. The route is CheckAuth-only, so it is reachable by the publish RoleReader token and by the anonymous account when...
PT-2026-84299
appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write file and write files batch tools, allowing attackers to write files outside the intended PROJECT ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrit...
PT-2026-83557
Name of the Vulnerable Software and Affected Versions browser-use web-ui versions 2.0.0 through 3.0.0 Description The software fails to validate browser settings paths within the run agent task function. This allows unauthenticated users to create directories at arbitrary locations on the system...
CVE-2026-40526
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...
PT-2026-82672
Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...
CVE-2026-37069: Exposure of Sensitive Information to an Unauthorized Actor
Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...
EUVD-2026-66606
Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mageai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling...
PYSEC-2026-3790
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. loadlangngrams joins the corpus root with crubadancode, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open rather than the pathsec-validated opener, s...
CVE-2026-71514
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. loadlangngrams joins the corpus root with crubadancode, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open rather than the pathsec-validated opener, s...
EUVD-2026-64295
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. loadlangngrams joins the corpus root with crubadancode, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open rather than the pathsec-validated opener, s...
CVE-2026-71514 NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. loadlangngrams joins the corpus root with crubadancode, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open rather than the pathsec-validated opener, s...
PT-2026-79555
Name of the Vulnerable Software and Affected Versions NLTK versions 3.9.4 through 3.10.2 Description A path traversal issue exists in the CrubadanCorpusReader component. The load lang ngrams function joins the corpus root with the crubadan code variable, which is the value read from the column-0 ...
BIT-PYTHON-MIN-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
If shutil.unpackarchive is given a ZIP archive with an absolute Windows path containing a drive C:\... then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability...
BIT-PYTHON-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
If shutil.unpackarchive is given a ZIP archive with an absolute Windows path containing a drive C:\... then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability...
