CVE-2026-90954 Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

EUVD-2026-100951

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

cve-2022-41352-zimbra-rce

CVE-2022-41352 Zimbra Unauthenticated RCE CVE-2022-41352 is an arbitrary file write vulnerability in Zimbra mail servers due to the use of a vulnerable cpio version. CVE-2022-41352 NIST.gov CVE-2022-41352 Rapid7 Analysis AffectedZimbra versions: Zimbra 9.0.0.p27 Zimbra 8.8.15.p34 Refer to the pat...

CVE-2023-29343

CVE-2023-29343 This is PoC for arbitrary file write bug in Sysmon version 14.14 After last patch Sysmon would check if Archive directory exists and if it exists it would check if archive directory is owned by NT AUTHORITY\SYSTEM and access is only granted to NT AUTHORITY\SYSTEM. If both condition...

cve-2025-65099

Proof of Concept for CVE-2025-65099 Further details are provided in the published article. yarnPath Technique A vulnerable environment for yarnPath can be initialized as follows: docker run --rm -v "$PWD":/poc -it --workdir /poc ubuntu bash -c 'apt-get update -qq && DEBIANFRONTEND=noninteractive...

CVE-2022-39952

CVE-2022-39952 POC for CVE-2022-39952 affecting Fortinet FortiNAC The default configuration of this exploit writes a cron job to create a reverse shell. Be sure to change the payload file to suite your environment. Technical Analysis A technical root cause analysis of the vulnerability and...

CVE-2026-34990-poc

CVE-2026-34990 CUPS 2.4.16 local privilege escalation via arbitrary file write through CUPSCREATELOCALPRINTER. Vulnerability CUPS allows creating local printers with a device-uri set to a file:// path. Submitting a print job with document-format: application/vnd.cups-raw and compression: gzip...

YouPHPTube Encoder - Arbitrary File Write

Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube.The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack. id: CVE-2019-5128 info: name: YouPHPTube Encoder - Arbitrary...

DB-GPT <= 0.8.1 - Arbitrary File Write

DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the userid HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON...

Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

Camaleon CMS < 2.8.1 Arbitrary File Write to RCE

An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on depending on the permissions of the underlying filesystem. E.g. This can lead to a remote...

JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler plgajaxhelix3 accessible via the Joomla comajax component. The onAjaxHelix3 plugin method processes dataaction=save requests without any authentication check or CSRF token validation...

FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write

FUXA, an open-source Node.js SCADA/HMI web interface, through version 1.2.9 exposes an unauthenticated POST /api/upload endpoint that resolves the attacker-controlled destination field from the JSON request body against the application directory with only a leading underscore prefix and no...

Adobe ColdFusion - RDS Arbitrary File Write

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated...

Flowise - Path Traversal

Flowise = 2.2.8 contains a path traversal vulnerability caused by missing validation of chatflowId and chatId parameters in file handling, letting unauthenticated attackers read and write arbitrary files, exploit requires no authentication. id: CVE-2025-71334 info: name: Flowise - Path Traversal...

esm.sh <= v136 - Arbitrary File Write via Path Traversal

esm.sh = 136 contains a path traversal caused by improper canonicalization of the X-Zone-Id HTTP header, letting attackers write files outside the intended storage directory, exploit requires crafted header input. id: CVE-2025-59342 info: name: esm.sh = v136 - Arbitrary File Write via Path...

GL.iNet <= 4.3.7 - Arbitrary File Write

GL.iNet = 4.3.7 is vulnerable to an arbitrary file write exploit, allowing an attacker to overwrite arbitrary system files. id: CVE-2023-46455 info: name: GL.iNet = 4.3.7 - Arbitrary File Write author: Zierax severity: high description: | GL.iNet = 4.3.7 is vulnerable to an arbitrary file write...

Plenti < v0.7.2 - OS Command Injection

Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The /postLocal endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the...

CVE-2023-45878_to_RCE

CVE-2023-45878 to RCE This script chains and automates Arbitrary File Write to RCE on Gibbon LMS through CVE-2023-45878 exploitation. The script performs the following steps: 1. Generates an msfvenom stageless reverse shell for Windows 2. Uploads a webshell exploiting CVE-2023-45878 3. Downloads...

CVE-2025-7401

CVE-2025-7401 Premium Age Verification / Restriction for WordPress = 3.0.2 - Unauthenticated Arbitrary File Read and Write 🧾 Premium Age Verification / Restriction for WordPress = 3.0.2 — Unauthenticated Arbitrary File Read & Write 📝 Description The "Premium Age Verification / Restriction for...