Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in the editfile process of fsops.go in File Tools. An attacker can access or modify unintended files by exploiting symbolic link following. Remediation There is no fixed version for github.com/mosaxiv/clawlet/config...

CVE-2026-22682 OpenHarness Improper Access Control via File Tools

OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permission enforcement, allowing attackers who can influence agent tool execution to read arbitrary local files outside the intended repository...

CVE-2026-22682: Incorrect Authorization

OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permission enforcement, allowing attackers who can influence agent tool execution to read arbitrary local files outside the intended repository...

Zed < 0.225.9 Symlink Escape (CVE-2026-27967)

The version of Zed installed on the remote host is prior to 0.225.9. It is, therefore, affected by a symlink escape vulnerability: - A symlink escape vulnerability exists in the Zed Agent file tools readfile, editfile that allows reading and writing files outside the project directory when a...

CVE-2026-27967: Improper Link Resolution Before File Access

Zed, a code editor, has a symlink escape vulnerability in versions prior to 0.225.9 in Agent file tools readfile, editfile. It allows reading and writing files outside the project directory when a project contains symbolic links pointing to external paths. This bypasses the intended workspace...

CVE-2024-46644: Improper Limitation of a Pathname to a Restricted Directory

eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via editfile...

CVE-2008-5860

Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to create or read arbitrary files via directory traversal sequences in the editfile parameter...

CVE-2008-5860: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to create or read arbitrary files via directory traversal sequences in the editfile parameter...

CVE-1999-1255: Undefined Security Weakness

Hyperseek allows remote attackers to modify the hyperseek configuration by directly calling the admin.cgi program with an editfile action parameter...