NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write

NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write vulnerability discovered by ? in WordPress Npm libreoffice-convert versions 1.8.2...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2 , the options.fileName value passed to path.join(tempDir.name, fileName) in index.js is never reduced to a base name. A filename containing ../ allows an attacker to escape the temporary d...

EUVD-2026-67161

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2021-31800-Impacket-SMB-Server-Arbitrary-file-read-write

CVE-2021-31800 - Impacket SMB Server Beliebiges Lesen/Schreiben von Dateien CVSS-Vektor : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS-Score : 9.9 Kritisch Beschreibung Eine Pfad-Traversal-Schwachstelle in smbserver.py ermöglicht es einem Angreifer, auf dem Server beliebige Dateien zu lesen...

CVE-2023-45878

CVE-2023-45878 Exploit GibbonEdu Gibbon versione 25.0.1 GibbonEdu Gibbon versione 25.0.1 e precedenti GibbonEdu Gibbon versione 25.0.1 e precedenti consente la scrittura arbitraria di file Leggi di più https://nvd.nist.gov/vuln/detail/CVE-2023-45878...

propane

propane Nutzt den Bug zum beliebigen Dateischreiben im modcopy-Modul von ProFTPD aus CVE-2015-3306 und versucht eine Codeausführung...

CVE-2025-8088

Technical Deep Dive: CVE-2025-8088 - Il Resiliente Path Traversal Disclaimer: Questo contenuto ha esclusivamente scopo didattico e di ricerca. Non utilizzare queste informazioni per attività dannose. Oggi facciamo un'analisi approfondita di un'affascinante vulnerabilità di path traversal, traccia...

CVE-2019-14751_PoC

CVE-2019-14751PoC Una Proof of Concept per CVE-2019-14751 Descrizione della vulnerabilità NLTK Downloader prima della versione 3.5 è vulnerabile a un directory traversal, che consente agli attaccanti di scrivere file arbitrari tramite un ../ dot dot slash in un pacchetto NLTK archivio ZIP che vie...

CVE-2021-33564

CVE-2021-33564 PoC Exploit-Skript für CVE-2021-33564 Argument Injection in Dragonfly Ruby Gem. Verwendung Beliebige Datei lesen python3 poc.py -u https:///system/refinery/images -r /etc/passwd Beliebige Datei schreiben python3 poc.py -u https:///system/refinery/images -w public/test.txt -c test.t...

POC-CVE-2024-44258-Py

PoC Concettuale CVE-2024-44258: Vulnerabilità Symlink in iOS Requisito: Python 3.7+ • Licenza: MIT ⚠️ Avvertenza: Questo repository contiene una prova di concetto PoC sviluppata a scopo esclusivamente educativo e di ricerca. Non è un exploit completamente funzionante. Il suo utilizzo su dispositiv...

CVE-2026-57171

A flaw was found in Compliance-trestle Trestle. The catalog-generate, profile-generate, and ssp-generate author commands are vulnerable to path traversal. A remote attacker can exploit this by providing a specially crafted output path, allowing them to write arbitrary files outside the intended...

CVE-2021-41579-LCDS-LAquis-SCADA-4.3.1.1085-Arbitrary-File-Write

LAquis SCADA Scrittura Arbitraria di File 👨‍💻 Autore Mohammed Idrees Banyamer 🐦 Instagram: @banyamersecurity Exploit proof-of-concept per CVE-2021-41579 - Scrittura arbitraria di file tramite file di progetto .els malevolo in LCDS LAquis SCADA ≤ 4.3.1.1085. 🚨 Descrizione della vulnerabilità...

CVE-2022-41678

CVE-2022-41678: MBeans Pericolosi Accessibili tramite API Jolokia in Apache ActiveMQ Elencando e ispezionando gli MBeans esposti dall'API Jolokia all'indirizzo http://127.0.0.1:8161/api/jolokia sono stati identificati i seguenti vettori d'attacco: Scrittura Arbitraria di File tramite Log4J che...

CVE-2026-81743

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2023-45878

CVE-2023-45878 CVE-2023-45878 GibbonEdu Beliebiges Schreiben von Dateien...

CVE-2026-71492

A flaw was found in Banks. The DirectoryPromptRegistry.set function improperly handles attacker-controlled Prompt.name and Prompt.version values. This allows for path traversal, enabling an attacker to write arbitrary files outside the intended registry root. This vulnerability could lead to...

EUVD-2026-67007

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-46345

A flaw was found in compliance-trestle. The trestle author jinja command, when processing the -o/--output argument, is vulnerable to path traversal. This allows a local attacker to write files to arbitrary locations outside the intended workspace by providing specially crafted path sequences or...

CVE-2026-19693

A flaw was found in extract-zip. This vulnerability allows a remote attacker to perform an arbitrary file write outside the intended destination directory. By crafting a malicious zip archive containing a symbolic link symlink and a regular file with the same name, the attacker can bypass securit...