CVE-2026-72722: Missing Authorization

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extractfrom, TopicLink.ensureentryfor, and TopicLink.duplicatelookup do not consistently enforce Guardian.cansee? checks when processing internal links. An authenticated user can submit...

CVE-2008-6398: Improper Link Resolution Before File Access

sngregress in SNG 1.0.2 allows local users to overwrite arbitrary files via a symlink attack on the 1 /tmp/recompiled$$.png, 2 /tmp/decompiled$$.sng, and 3 /tmp/canonicalized$$.sng temporary files...

CVE-2008-2665

Directory traversal vulnerability in the posixaccess function in PHP 5.2.6 and earlier allows remote attackers to bypass safemode restrictions via a .. dot dot in an http URL, which results in the URL being canonicalized to a local filename after the safemode check has successfully run...