EUVD-2026-63588

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...

cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...

Arbitrary File Upload

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Arbitrary File Upload via the SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only...

Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...

Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

Summary HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php reads file paths from the clear request input and deletes them from the configured storage disk without verifying that the paths belong to the current model record. An authenticated user with Update...

GHSA-2P39-2JF3-FV2Q next-video: Unauthenticated arbitrary file read via /api/video request handler

Impact The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup. The...

next-video: Unauthenticated arbitrary file read via /api/video request handler

Impact The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup. The...

CVE-2026-2334

vsDesk v14.0101 is affected by a missing server-side file extension validation in the "Import via CSV" component. An authenticated attacker with administrative privileges can bypass client-side validation to upload an arbitrary file, leading to Remote Code Execution (RCE) within the web applicati...

EUVD-2026-63499

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255 Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255 Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-61625

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-18267

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2026-61625

VictoriaMetrics vmrestore is vulnerable to a path traversal caused by insufficient validation of backup part path components in lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go. An attacker who can supply or modify a backup source (S3, GCS, Azure Blob Storage, or other) can embed ....

EUVD-2026-63474

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-63043

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1 https://github.com/apache/inlong/pull/12146...

CVE-2026-64960

creationtimestamp| type| source ---|---|--- 2026-08-20 16:15:03+00:00| seen| https://cert.pl/en/posts/2026/08/CVE-2026-64960 2026-08-22 05:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtnk7sd5ur24...

CVE-2026-71492 Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation...

CVE-2026-71492

Banks is a Python library for generating LLM prompts using a template language. Prior to version 2.4.5 , the DirectoryPromptRegistry.set() method in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a filesystem path without canonicaliza...