CVE-2021-41773

CVE-2021-41773 Apache HTTP Server 2.4.49 中的路径遍历与文件泄露漏洞 CVE-2021-41773 信息 在 Apache HTTP Server 2.4.49 的路径规范化更改中发现了一个缺陷。攻击者可以利用路径遍历攻击将 URL 映射到预期文档根目录之外的文件。 如果文档根目录之外的文件未受 "require all denied" 保护，这些请求可能成功。此外，此缺陷可能泄露解释型文件（如 CGI 脚本）的源代码。 此问题已知已在野外被利用。 该问题仅影响 Apache 2.4.49，不影响早期版本。 鸣谢：该问题由 Ash Daulton ...

CTF_WRITEUPS-TryHackMe-CVE-2021-41773-

CTFWRITEUPS-TryHackMe-CVE-2021-41773- CTFWRITEUPS/TryHackMe /CVE-2021-41773/ CVE-2021-41773/42013 关于 Apache 路径遍历漏洞及不完整修复的小型说明 任务 1：一些背景…… 简要历史 2021 年 10 月 5 日，一个关于 Apache HTTP Server v2.4.49 路径遍历攻击的 CVE 被发布。编号为 CVE-2021-41773，描述如下： 在 Apache HTTP Server 2.4.49 中对路径规范化所做的更改中发现了一个缺陷。攻击者可以利用路径遍历攻击将 U...

PoC-CVE-2021-41773

CVE-2021-41773 PoC 检查主机是否易受 CVE-2021-41773 影响的概念验证工具。 描述 https://vulners.com/cve/CVE-2021-41773 在 Apache HTTP Server 2.4.49-2.4.50 对路径规范化所做的更改中发现了一个漏洞。 攻击者可以使用路径遍历攻击将 URL 映射到预期文档根目录之外的文件。如果文档根目录之外的文件未受“require all denied”保护，这些请求可能会成功。此外，此缺陷可能会泄露解释文件（如 CGI 脚本）的源代码。 此问题仅影响 Apache 2.4.49 和...

CVE-2021-41773h

CVE-2021-41773 Apache HTTP Server 2.4.49 中的路径遍历与文件泄露漏洞（CVE-2021-41773） 信息 Apache HTTP Server 2.4.49 在路径规范化（path normalization）的变更中发现了一个缺陷。攻击者可以利用路径遍历攻击将 URL 映射到预期文档根目录之外的文件。 如果文档根目录之外的文件未受 "require all denied" 保护，这些请求可能会成功。此外，该缺陷还可能泄露 CGI 脚本等解释型文件的源代码。 已知此问题已在真实环境中被利用。 此问题仅影响 Apache 2.4.49，不影响更早版...

CVE-2021-41773

CVE-2021-41773 发现 Apache HTTP Server 2.4.49-2.4.50 中对路径规范化所做的更改存在一个漏洞。攻击者可以使用路径遍历攻击将 URL 映射到预期文档根目录之外的文件。如果文档根目录之外的文件未受到 require all denied 的保护，这些请求可能会成功。此外，此漏洞可能泄露解释文件（如 CGI 脚本）的源代码。...

CVE-2026-78394: Improper Limitation of a Pathname to a Restricted Directory

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including...

CVE-2026-64836

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

EUVD-2026-75455

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64836 ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

CVE-2026-64836 ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

EUVD-2026-75453

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

CVE-2026-64836

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint. The root cause is a logic error in the File::check() validation function, which compares realpath() to boolean true—a condition that never succeeds, effectively disabling the document-root confineme...

PT-2026-89417

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

CVE-2026-64838: Improper Limitation of a Pathname to a Restricted Directory

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-49970 Laravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination. Attackers can exploit the permissive...

EUVD-2026-43517

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination. Attackers can exploit the permissive...

CVE-2026-49970 Laravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination. Attackers can exploit the permissive...

Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

...

EUVD-2026-38069

YARD static cache reads raw traversal paths before router sanitization...

GHSA-PXCC-8665-PHX8 YARD static cache reads raw traversal paths before router sanitization

Summary YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joined against that root and can return a readable sibling .html file outside the intended static...