CVE-2026-26329 OpenClaw has a path traversal in browser upload allows local file read

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, authenticated attackers can read arbitrary files from the Gateway host by supplying absolute paths or path traversal sequences to the browser tool's upload action. The server passed these paths to Playwright's setInputFiles APIs...

Insecure Defaults

Overview UmbracoForms is a tool that makes creating contact forms, entry forms and questionnaires just as easy as using Word. Affected versions of this package are vulnerable to Insecure Defaults. When using the default configuration for upload forms, it is possible to upload arbitrary file types...

PT-2020-20568 · Silverstripe · Silverstripe

Name of the Vulnerable Software and Affected Versions: SilverStripe versions prior to 4.6 Description: The issue affects files uploaded via Forms to folders migrated from Silverstripe CMS 3.x, where they may be put in the default "/Uploads" folder instead of the intended location. This impacts...