CVE-2025-46822

CVE-2025-46822 Unauthenticated Arbitrary File Read via Absolute Path Description: While Path.resolve method is being used to protect against path traversal I have found that the usage of absolute path successfully read internal files , the endpoint is also not authenticated this means anyone can...

CVE-2020-13941

CVE-2020-13941: Использование UNC-путей в средах Windows в Apache Solr Было обнаружено, что несколько конечных точек Solr принимают абсолютные пути. В системах Windows эти абсолютные пути можно принудительно использовать, чтобы заставить ОС подключиться к подконтрольному атакующему SMB-серверу...

Gradio - Absolute Path Traversal

Gradio 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server. id: CVE-2026-28414 info: name: Gradio - Absolute Path Traversal author: 0xAkoko severity:...

LOLLMS WebUI - Absolute Path Traversal

An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the openfile endpoint of lollmsadvanced.py. The sanitizepath function with allowabsolutepath=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can...

Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Download

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data. id: CVE-2021-38146 info: name: Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Downloa...

CVE-2021-43798-Exploit-for-Windows-and-Linux

CVE-2021-43798-Exploit-for-Windows-and-Linux Модифицированный эксплойт для CVE-2021-43798. Оригинальный код эксплойта: https://www.exploit-db.com/exploits/50581 Изменения: Эта модифицированная версия совместима как с серверами на Windows, так и на Linux. Когда пользователь вводит абсолютный путь...

Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six

CVE-2025-64512 — pdfminer.six RCE exploit Python 3, stdlib...

rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options

A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...

Astra Linux – Vulnerability in ARK

The libarchiveplugin.cpp file in the KDE archive prior to version 24.12.0 can extract to an absolute path from an archive...

Astra Linux – Vulnerability in Ansible

There exists an absolute path traversal attack within the Ansible automation platform. This flaw allows an attacker to create a malicious Ansible role and have the victim execute that role. A symbolic link can be used to overwrite a file that is outside of the extraction path...

CVE-2025-70820

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...

CVE-2025-70820: Absolute Path Traversal

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...

EUVD-2025-210899

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...

CVE-2025-70820

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...

CVE-2025-70820

Zettlab D6 Ultra (a NAS device) prior to firmware 1.7.0 is affected by an absolute path traversal vulnerability that allows an attacker with low privileges on an adjacent network to reach folders outside the user's personal folder, resulting in low confidentiality impact (CVSS 3.5, LOW). The reme...

PT-2026-90948

Name of the Vulnerable Software and Affected Versions Zettlab D6 Ultra versions prior to 1.7.0 Description An absolute path traversal issue exists, allowing access to directories outside of the designated personal folder. Recommendations Update Zettlab D6 Ultra to version 1.7.0 or later...

EUVD-2026-75770

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

CVE-2026-82092

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

CVE-2026-81554

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

CVE-2026-45767

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some...