Exploit for Path Traversal in Jenkins

CVE-2024-23897 — Jenkins CLI Arbitrary File Read Vulnerability...

CVE-2026-65919

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in...

CVE-2026-65920

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65701

SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audiopath field o...

CVE-2026-65920

Diffusers up to 0.39.0 is affected by a path traversal in the _get_checkpoint_shard_files function. Attackers can supply malicious weight_map values in the model index JSON (e.g., ../ sequences or absolute paths) to escape the model directory and read safetensors files outside the intended locati...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65919

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in...

CVE-2026-65919

Meshery (before 1.0.57) contains an unauthenticated arbitrary file read via /api/system/fileView and /api/system/fileDownload. User-supplied file parameters are passed directly to os.Open without path validation, enabling absolute paths or traversal sequences to read host files without authentica...

CVE-2026-65919 Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in...

CVE-2026-65919 Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in...

CVE-2026-65919 Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in...

CVE-2026-65701

SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audiopath field o...

NPM: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

NPM: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.11...

GHSA-6G55-P6WH-862Q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

Summary PostCSS's PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file...

CVE-2026-65689

Bold Reports Standalone Report Designer before 14.1.12 is affected by a path traversal vulnerability in the database download feature that allows unauthenticated attackers to read arbitrary files on the server filesystem, including authentication credentials, potentially giving full unauthorized ...

CVE-2026-65689 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

CVE-2026-65688 Bold Reports Standalone Report Designer 14.1.12 Arbitrary File Read via Font Processing

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

CVE-2026-65688 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font Processing

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...