CVE-2026-120577

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers,...

CVE-2026-120577

The FluentCart WordPress plugin (all versions up to and including 1.6.2 ) is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function. Authenticated attackers with custom-level access and above can exploit this to delete arbitrary files on the serv...

EUVD-2026-115671

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers,...

CVE-2026-120577 FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers,...

CVE-2026-109176

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

EUVD-2026-97380

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

CVE-2026-109176

MoguBlog versions through 6.2 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The issue exists because the NetworkDiskServiceImpl.deleteFile method fails to validate the file or folder uid against the admin_uid. This allows authenticated administrators to delete files ...

CVE-2026-109176 MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

CVE-2026-109176: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

PT-2026-110565

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

Path Traversal

Grav is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of directory paths in MediaUploadTrait::deleteFile, which allows an authenticated attacker with media management permissions to use ../ sequences to delete arbitrary files outside the intended media storage...

GHSA-JQ29-C7V8-RG55 Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion Summary A path traversal vulnerability in MediaUploadTrait::deleteFile allows an authenticated user with media management permissions to delete arbitrary files on the server. The method validates only the basename porti...

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion Summary A path traversal vulnerability in MediaUploadTrait::deleteFile allows an authenticated user with media management permissions to delete arbitrary files on the server. The method validates only the basename porti...

Directory Traversal

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Directory Traversal via the deleteFile function in the MediaUploadTrait process. An attacker can delete arbitrary files outside the intended...

Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jq29-c7v8-rg55. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated...

GHSA-896W-CW95-XQ7W Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jq29-c7v8-rg55. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated...

CVE-2026-72695

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...

CVE-2026-19054 Lspace-io lspace-server Repositories File API repository.ts deleteFile path traversal

A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument...

CVE-2026-19054 Lspace-io lspace-server Repositories File API repository.ts deleteFile path traversal

A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument...

EUVD-2026-38106

The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFLDeleteFile function in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server,...