CVE-2026-108110

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

CVE-2026-108110 MOVO through 0.2.3 Authorization Bypass via Document Endpoints

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

CVE-2026-108110 MOVO through 0.2.3 Authorization Bypass via Document Endpoints

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

CVE-2026-108110 MOVO through 0.2.3 Authorization Bypass via Document Endpoints

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

CVE-2026-108110: Authorization Bypass Through User-Controlled Key

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

PT-2026-108958

Name of the Vulnerable Software and Affected Versions MOVO versions prior to 0.2.4 Description An authorization bypass exists in the chat-api document endpoints. Authenticated users can access stored objects belonging to other users by providing arbitrary object paths. By sending a known target...

Himovo MOVO authorization issue vulnerability

The Himovo MOVO versions 0.2.3 and earlier have an authorization issue vulnerability. This vulnerability stems from an authorization bypass in the chat-api documentation endpoints. It allows authenticated users to access objects stored by other users by providing arbitrary object paths. Attackers...

Exploit for CVE-2026-105314

Papermerge-core: Authenticated Path Traversal to Arbitrary Fil...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

EUVD-2026-92275

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 is vulnerable to remote code execution (RCE) due to a directory traversal flaw in the /api/documents/upload endpoint. A standard user can exploit this to write a Python .pth file into the site-packages directory. The malicious code within the .pth file is executed automatically d...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314: Path Traversal: '../filedir'

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

PT-2026-104748

Name of the Vulnerable Software and Affected Versions Papermerge version 3.5.3 Description A standard user can achieve remote code execution through a directory traversal flaw in the '/api/documents/upload' endpoint. This allows an attacker to write a Python .pth file into the site-packages...

CVE-2026-50027: Missing Authentication for Critical Function

mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key MCPAPIKEY or OAuth. An unauthenticated remote...

CVE-2026-18359 Server-Side Request Forgery (SSRF) in eScriptorium

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...

CVE-2026-18359

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...

CVE-2026-18359: Server-Side Request Forgery (SSRF)

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...