vm-filesystem

vm-filesystem A Firebeam bytecode to perform Filesystem interacting while also monkey-patch the python function for the Havoc Interface File Browser interaction, allowing to interact with the remote filesystem without needing to have the filesystem embedded. This repository also is a representati...

CVE-2026-35585-poc

CVE-2026-35585: File Browser OS Command Injection PoC Description This repository contains a Proof of Concept PoC for CVE-2026-35585 , a critical OS Command Injection vulnerability discovered in File Browser versions 2.0.0 through 2.33.1. The vulnerability exists in the "Custom Command Hooks"...

EUVD-2026-44705

File Browser: Trailing-slash directory deletion leaves public shares active for recreated paths...

File Browser: Trailing-slash directory deletion leaves public shares active for recreated paths

Summary File Browser v2.63.15 can leave a public directory share behind when the shared directory is deleted through a path with a trailing slash. The share cleanup path calls DeleteWithPathPrefixfile.Path, userID, but the Bolt backend performs the database prefix query with the unnormalized...

GHSA-PP88-JHWJ-5QH5 File Browser: Trailing-slash directory deletion leaves public shares active for recreated paths

Summary File Browser v2.63.15 can leave a public directory share behind when the shared directory is deleted through a path with a trailing slash. The share cleanup path calls DeleteWithPathPrefixfile.Path, userID, but the Bolt backend performs the database prefix query with the unnormalized...

qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

CVE-2019-6447

CVE-2019-6447 The above investigation of the ES file browser security weakness allows us to see the issue in its entirety...

CVE-2024-6651

CVE-2024-6651 POC XSS - CVE-2024-6651 Functional PoC for vulnerability CVE-2024-6651, which affects the plugin WP File Upload 4.24.8, allowing Reflected Cross-Site Scripting XSS in WordPress. 📌 Description This vulnerability allows arbitrary JavaScript code injection via an unsanitized parameter ...

CVE-2026-54088-poc

CVE-2026-54088: Command Injection via Authentication Hook Shell Substitution Pre-Authentication RCE Description This repository contains a Proof of Concept PoC for CVE-2026-54088, a critical OS Command Injection vulnerability in File Browser versions = 2.63.5. The vulnerability exists in the Hook...

CVE-2026-126321

Versions of Dockhand before 1.0.55 are vulnerable to a path traversal flaw in the file-browser endpoints. Authenticated users with stacks:edit privileges can bypass path guards by combining symlinks with .. sequences. This allows attackers to read sensitive files such as /proc/self/environ, the S...

CVE-2026-117626

A flaw was found in Jenkins. The file browser for workspaces and user content fails to properly validate file paths, resulting in a path traversal vulnerability. An authenticated attacker with read or workspace permissions can exploit this flaw by submitting crafted requests to obtain sensitive...

CVE-2026-117626

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINSHOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the...

EUVD-2026-112191

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINSHOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the...

CVE-2026-117626

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINSHOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the...

CVE-2026-117626

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINSHOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the...

CVE-2026-117626

Jenkins versions 2.587 and earlier , and LTS 2.580.1 and earlier , are vulnerable to a path traversal flaw in the file browser for workspaces and $JENKINS_HOME/userContent/ . The root cause is the software's failure to properly validate file paths, allowing an authenticated attacker with Overall/...

CVE-2026-117626: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINSHOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the...

PT-2026-128314

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the...

Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities stem from improper handling of file paths attempting to perform path traversal within the file browser of workspaces and $JENKINSHOME/userContent/. Attackers with...

Path traversal vulnerability in file browser

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINSHOME/userContent/. This allows attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in...