CVE-2025-24813

CVE-2025-24813 - Apache Tomcat Path Equivalence Vulnerability Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../ sequences in paths. CVE ID: CVE-2025-24813 Severity: Critical Reference link: https://github.com/advisories/GHSA-83qj-6fr2-vhqg Po...

CVE-2002-0347

CVE-2002-0347 Directory traversal vulnerability in Cobalt RAQ 4 allows remote attackers to read password-protected files, and possibly files outside the web root, via a .. dot dot in an HTTP request. Packetstorm publication at https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html...

CVE-2024-4956-PoC

title="Nexus Repository Manager" GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 Windows NT 5.1; rv:21.0 Gecko/20100101 Firefox/21.0Connection: closeAccept: /Accept-Language: enAccept-Encoding: gzip...

CVE-2001-0931

CVE-2001-0931 Directory traversal vulnerability in Cooolsoft PowerFTP Server 2.03 allows attackers to list or read arbitrary files and directories via a .. dot dot in 1 LS or 2 GET. SecurityFocus publication at https://www.securityfocus.com/bid/3593/info Securiteam publication at...

CVE-2013-6987

CVE-2013-6987 Synology DiskStation Manager DSM 4.3-3810 Update 3 之前版本的 FileBrowser 组件中存在多个目录遍历漏洞，远程攻击者可通过 ..（点点）读取、写入和删除任意文件。 使用方法： root@kitploit: python 示例： list filesystem python filelist.py ABCDFEGH1234 /home/../../../../...

DEBIAN-CVE-2026-88046

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...

CVE-2026-88046 rclone: source object names can escape the configured root on upload

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...

NotCVE-2026-0009

nitroshare 中的路径遍历漏洞 描述 NitroShare Desktop v0.3.4 的局域网文件传输服务器存在路径遍历漏洞。该服务器监听所有网络接口（端口 40818），且无需身份验证。在接收文件时，发送方 JSON 项目头中的 name 字段会被直接传递，而未验证解析后的路径是否仍位于传输根目录 C:\UserName\Downloads\NitroShare 之内。同一局域网内的攻击者可以发送包含 ../（经典的点点斜杠攻击）序列的精心构造的文件名，从而在当前用户可访问的任何位置写入文件，包括 Windows 启动文件夹，以便在下次登录时执行代码（因此创建了相应的...

CVE-2023-32315

CVE-2023-32315 root@kitploit: GET /setup/setup-s/%002e%002e/Su002esu002e/log.jsp HTTP/1.1 Host: 192.168.40.132:9090 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; X64 AppleWebKit/537.36 KHTML, like Gecko Chrome/109.0.5414.120 Safari/537.36 Accept:...

CVE-2021-43798

CVE-2021-43798 1. 概述 Grafana 是一个支持数据监控和管理功能的开源平台，在以下版本中存在路径遍历漏洞，可通过 ../ 等特殊字符操纵文件路径。 8.0.0 及以上，但低于 8.0.7 8.1.0 及以上，但低于 8.1.8 8.2.0 及以上，但低于 8.2.7 8.3.0 漏洞路径为 /public/plugins//，其中 是已安装插件的 ID。可通过以下资料确认脆弱路径。 https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p 2. 配置和运行漏洞环境 2.1...

Preproduce-CVE-2021-41773

Reproducir CVE 2021-41773 Vulnerabilidad de path traversal y divulgación de archivos en Apache HTTP Server 2.4.49 CVE-2021-41773 POC root@kitploit: $ docker compose up Confirmar que funciona root@kitploit: $ curl -I http://localhost HTTP/1.1 200 OK Date: Wed, 06 Oct 2021 13:25:18 GMT Server:...

CVE-2026-17621

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

EUVD-2026-71491

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

EUVD-2026-71464

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

CVE-2026-17621 Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

CVE-2026-79781

A flaw was found in rclone. This path traversal vulnerability allows a remote attacker to read and overwrite sensitive files outside of their intended directory by manipulating S3 object keys with 'dot-dot' segments e.g., ../. This could lead to unauthorized access and modification of critical...

EUVD-2026-42285

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read...

Linux Distros Unpatched Vulnerability : CVE-2026-79781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in ...

CVE-2026-79781

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2026-79781

rclone serve s3 before version 1.74.4 contains a path traversal vulnerability in its handling of S3 object keys. An unauthenticated, network-based attacker can include dot-dot (../) segments in object key names (e.g., ../root-secret.txt) to escape the bucket namespace and read or overwrite files ...