CVE-2014-2383-LFI-to-RCE-Escalation

CVE-2014-2383 LFI/RFI escalation to RCE Testing environment: dompdf 0.6.0 - php 7.3.33 - apache 2.4.25 During a security assessment the presence of CVE-2014-2383 was discovered. This document is a proof of concept and does not include the details from the initial discovery in order to protect...

CVE-2026-102643

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.mappath uses posixpath.normpath on a client-supplied path and removes only one leading slash before passing the...

UBUNTU-CVE-2026-102643

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.mappath uses posixpath.normpath on a client-supplied path and removes only one leading slash before passing the...

SUSE CVE-2026-102643

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.mappath uses posixpath.normpath on a client-supplied path and removes only one leading slash before passing the...

CVE-2026-102643

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.mappath uses posixpath.normpath on a client-supplied path and removes only one leading slash before passing the...

EUVD-2026-120504

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.mappath uses posixpath.normpath on a client-supplied path and removes only one leading slash before passing the...

CVE-2026-102643

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.mappath uses posixpath.normpath on a client-supplied path and removes only one leading slash before passing the...

CVE-2026-102643

The AsyncSSH Python package (prior to version 2.24.1 ) contains a vulnerability in SFTPServer.map_path() where it fails to correctly handle client-supplied paths. The function uses posixpath.normpath() and only removes a single leading slash; however, a path starting with exactly two slashes rema...

PT-2026-141143

Name of the Vulnerable Software and Affected Versions AsyncSSH versions prior to 2.24.1 Description An authenticated SFTP user can bypass the SFTP chroot by providing a path that begins with exactly two slash characters. This occurs because the SFTPServer.map path function uses posixpath.normpath...

CVE-2026-102643: ronf asyncssh: AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on…

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.mappath uses posixpath.normpath on a client-supplied path and removes only one leading slash before passing the...

rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

A flaw was found in rsync. This vulnerability allows remote clients to bypass path confinement, a security measure designed to restrict file access. By crafting specific paths that include a '/./' boundary marker within a chroot environment, an attacker can gain unauthorized read or write access ...

CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-53793

rsync

CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-53793 rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

EUVD-2026-58101

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

PT-2026-71631

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A path confinement bypass allows remote clients to escape the intended inner-module root confinement. This occurs when the module root contains a /./ boundary marker, enabling the construction of paths...

CVE-2026-56722

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...

CVE-2026-55554 Dompdf: Chroot Validation Bypass

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-55554 Dompdf: Chroot Validation Bypass

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...