CVE-2026-96279 Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure

Webmin before 1.290 and Usermin before 1.220 contain a path traversal caused by calling the simplifypath function before decoding HTML, letting remote attackers read arbitrary files, exploit requires sending crafted '..%01' sequences. id: CVE-2006-3392 info: name: Webmin 1.290 / Usermin 1.220 -...

CVE-2019-11510-poc

CVE-2019-11510-poc Pulse Secure SSL VPN 認証前ファイル読み取り 参照 1. https://hackerone.com/reports/591295 2. https://github.com/projectzeroindia/CVE-2019-11510/blob/master/CVE-2019-11510.sh 3. https://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.ht...

CVE-2019-11510_poc

CVE-2019-11510 PoC CVE-2019-11510 を悪用して '/etc/passwd' ファイルを読み取る Python スクリプト Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN - 任意のファイル開示の脆弱性 root@kitploit: USAGE: python3 CVE-2019-11510.py...

Icinga Web 2 - Arbitrary File Disclosure

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. id: CVE-2022-24716 info:...

CVE-2020-11579

CVE-2020-11579 はじめに PHPKB 9.0 Enterprise Edition MySQL database は、悪意のあるMySQLサーバーを介した認証不要の任意ファイル開示の影響を受けます。 リモートの攻撃者は、単一のHTTP GETリクエストを介して、Webサーバーの権限（例：www-data）を持つリモートの被害者ホスト上の任意のファイルを読み取ることができます。 詳細: https://shielder.it/blog/mysql-and-cve-2020-11579-exploitation 注意 このスクリプトはserver-only...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

CVE-2026-79306: Undefined Security Weakness

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

CVE-2026-79306

CyberPanel v1.9.1 is vulnerable to a path traversal vulnerability in the compress method via the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can provide absolute or out-of-scope file paths in the listOfFiles JSON property, along with ...

CVE-2026-77270

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

CVE-2026-77270

The MCP Atlassian server (a Model Context Protocol server for Jira and Confluence) is vulnerable in versions prior to 0.22.0 . The jira_upload_attachment and confluence_upload_attachment tools fail to validate file_path values, treating caller-controlled inputs as trusted server-local paths. An a...

EUVD-2026-84605

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

Linux Distros Unpatched Vulnerability : CVE-2026-93712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the...

CVE-2022-24716

CVE-2022-24716 脆弱性のエクスプロイト: Icinga Web 2 2.8.6、2.9.6、2.10 における任意ファイル開示の脆弱性 https://www.sonarsource.com/blog/path-traversal-vulnerabilities-in-icinga-web/ ヘルプ: python3 exploit.py -h 使用例: python3 -u http://127.0.0.1:8080 -f /etc/passwd 免責事項:...

CVE-2006-3392

Webmin 1.290 / Usermin 1.220 - 任意ファイル開示の脆弱性を悪用するシンプルなツールです。 使用方法： 1-スクリプト python exploit.py を実行します。 2-ポートを入力します。 3-表示したいフォルダを選択します。 ⛔ 重要 ⛔ 本スクリプトを非倫理的な行為に使用した場合、当方は一切責任を負いません。...

CVE-2026-76217

A flaw was found in GitPython where it fails to properly validate options provided to its git rm and git checkout commands. A remote attacker with low privileges could exploit this by supplying crafted parameters, such as --pathspec-from-file and --pathspec-file-nul. This vulnerability allows for...

CVE-2026-75889: Files or Directories Accessible to External Parties

Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-53580: External Control of File Name or Path

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

CVE-2026-63179

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...