Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper enforcement of the --permission. An attacker can gain unauthorized access to read from or write to filesystem paths outside the intended allowlist by exploiting boundary handling across radix-tree prefix...

GHSA-2956-977X-2W3R Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Summary image.download fetches a URL and writes the response to disk. It does not use the central path guard validatepathwithenvconfig, which confines writes to FLYTOSANDBOXDIR; instead it confines the output to outputdir, but outputdir is itself a caller parameter. Since the attacker sets both t...

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Summary image.download fetches a URL and writes the response to disk. It does not use the central path guard validatepathwithenvconfig, which confines writes to FLYTOSANDBOXDIR; instead it confines the output to outputdir, but outputdir is itself a caller parameter. Since the attacker sets both t...

CVE-2026-15435

IBM App Connect Enterprise is vulnerable to an arbitrary file write due to a path traversal flaw (CWE-22). A remote attacker could send a crafted URL containing dot-dot sequences (/../) to traverse directories and write arbitrary files on the system. Affected versions are 13.0.1.0–13.0.7.2 and 12...

EUVD-2026-51138

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled outputdir instead of validatepathwithenvconfig and its FLYTOSANDBOXDIR confinement, allowing attacker-controlled response bytes to be...

CVE-2026-67429

Flyto2 Core (execution kernel for automation/AI-agent workflows) contains an Arbitrary File Write vulnerability in image.download and related file-writing modules prior to version 2.26.6. The root cause is caller-controlled output_dir, which bypasses validate_path_with_env_config and FLYTO_SANDBO...

CVE-2026-13346

Pip has a vulnerability (CVE-2026-13346) where doubly-encoded package URLs from indexes can lead to files being installed to arbitrary locations on disk, even when installing wheels. The issue is exploitable only when downloading/installing from a malicious package index; malicious packages alone...

Directory Traversal

Overview penelope-shell-handler is a Post-exploitation shell handler for authorized security testing Affected versions of this package are vulnerable to Directory Traversal in the download process when extracting tar archives from a remote session without validating archive member paths. An...

GHSA-F42X-P2MX-HM8R Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such ...

CVE-2026-59948

A flaw was found in Composer, a dependency manager for the PHP language. A remote attacker could exploit this vulnerability by providing a maliciously crafted package from an untrusted source. During installation or update, Composer's improper validation of package names allows it to write...

CVE-2026-29509

A flaw was found in Patool. A remote attacker could exploit a path traversal vulnerability in the safeextract function by providing a specially crafted archive. This vulnerability arises because a helper function uses an insecure comparison method, allowing malicious paths to bypass security...

UBUNTU-CVE-2026-56390

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...

Exploit for CVE-2026-52832

CVE-2026-52832-PoC-exploit-nuclei-dashboard Nuclio Dashboard...

Exploit for CVE-2026-52832

CVE-2026-52832-PoC-exploit-nuclio-dashboard Nuclio Dashboard...

CVE-2026-56390

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...

CVE-2026-56390

GNU Bison is affected by CVE-2026-56390 through grammar-defined output directives (%output, %header), which can accept unrestricted file paths and override caller-supplied output options. When processing attacker-supplied grammar, this allows writing generated files to arbitrary writable location...

@wakaru/cli arbitrary file write during bundle unpack

Impact @wakaru/cli is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with --unpack. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such ...

CVE-2026-54545

CVE-2026-54545 affects the @wakaru/cli component of the Wakaru toolkit. From 1.0.0 through 1.4.0, bundle-controlled module filenames were sanitized only once before writing extracted modules. A crafted filename containing overlapping traversal sequences (e.g., ....//) can collapse to ../ after sa...