CVE-2026-48070 Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can...

Podcast Generator 1.2 - 'GLOBALS[]' Multiple Vulnerabilities

++ | Podcast Generator RFI | | | magicquotesgpc=off -- LFI | +-------------------------+-----------------------------------------------------------+ | delete.php?GLOBALSamilogged=true&file&GLOBALSabsoluteurl= | | admin.php?p=admin&GLOBALSabsoluteurl= | |...