CVE-2026-97677

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a path traversal vulnerability (CWE-22 ) where an authenticated flow author can bypass local file access isolation safeguards. This allows the attacker to write controlled content into any directory writable by the service account a...

EUVD-2026-119741

IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the content...

Enlogic SCADA Virtual Controller Path Traversal

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability allows a malicious actor to read and write arbitrary files...

CVE-2026-124490

OpenEMR versions prior to 8.3.0 are vulnerable to a path traversal vulnerability within the RingCentral RCFaxClient disposeDocument() method of the oe-module-faxsms component. This flaw allows authenticated attackers to perform arbitrary file reads and writes via the file_path parameter. Specific...

CVE-2026-124479

OpenEMR versions prior to 8.4.0 are vulnerable to an arbitrary local file read vulnerability within the REST document download functionality. The root cause is that the controller incorrectly passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path rather than as...

EUVD-2026-119534

OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authenticated users with document upload and...

CVE-2026-124457

OpenEMR versions before 8.3.0 are vulnerable to a path traversal vulnerability in the interface/billing/sl_eob_process.php component. The root cause is the processing of unsanitized eraname values , which allows authenticated users to read and write files on the system. Specifically, attackers wi...

CVE-2026-124450

OpenEMR versions prior to 8.3.0 are vulnerable to broken access control and path traversal within the fax/sms module's disposeDocument action. The root cause is an unvalidated file_path parameter , which allows authenticated low-privilege users to read sensitive files like sqlconf.php to recover ...

CVE-2026-124446

OpenEMR versions before 8.3.0 are vulnerable to a path traversal flaw in the FaxSMS module specifically within the RCFaxClient and SignalWireClient disposeDocument functions. The root cause is an unsanitized file_path parameter , which allows authenticated low-privilege users to read or overwrite...

CVE-2026-124434

The Grav Lightbox Gallery plugin (versions 1.1.0 before 1.3.2) on Grav 2.x is vulnerable to a file read vulnerability. The issue arises because the plugin calls any medium method specified in the image, thumb, or thumb_options shortcode values without performing the core's allowed media action ch...

CVE-2026-124428

Craft CMS versions 5.7.0 before 5.11.2 are vulnerable to an arbitrary file read vulnerability via the app/icon-svg endpoint. Authenticated control panel users can supply aliases or absolute paths that are resolved without permission checks. This allows the attacker to read any SVG-content file ac...

EUVD-2026-119572

Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, t...

TOTVS Fluig <= 1.7.0 - Arbitrary File Read

TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation of the 'file' parameter, letting attackers access arbitrary files, exploit requires attacker to control the 'file' parameter. id: CVE-2020-29134 info: name: TOTVS Fluig = 1.7.0 - Arbitrary File Read author: ls4ss...

Nezha Dashboard < 2.0.13 - Path Traversal

Nezha Monitoring 2.0.13 contains a path traversal caused by improper prefix checking in the dashboard's NoRoute handler, letting unauthenticated attackers read arbitrary files via crafted URLs. id: CVE-2026-53519 info: name: Nezha Dashboard 2.0.13 - Path Traversal author: Aryu-RU,str4k3r severity...

Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read

Microweber CMS = 2.0.20 contains a path traversal vulnerability caused by failure to normalize path query parameter in static file controller, letting unauthenticated remote attackers read arbitrary files. id: CVE-2026-65694 info: name: Microweber CMS = 2.0.20 - Unauthenticated Arbitrary File Rea...

Planyo Online Reservation System <= 3.0 - Arbitrary File Read

The Planyo Online Reservation System plugin for WordPress through 3.0 ships ulap.php, an AJAX proxy that is directly reachable without WordPress bootstrapping or authentication. The sendhttppost function validates the host of the supplied URL against an allowlist that includes localhost, but neve...

esm.sh <= v136 - Local File Inclusion

esm.sh = 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request. id: CVE-2025-59341 info: name: esm.sh = v136 - Local File Inclusion author: 0xAkoko severity: high description:...

Java-springboot-codebase 1.1 - Arbitrary File Read

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...

Lightdash version <= 0.510.3 Arbitrary File Read

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension .csv or .png is used. id: CVE-2023-35844 info: name: Lightdash version = 0.510.3 Arbitrary File Read author: dwisiswant0...

Eclipse Theia - Unauthenticated Path Traversal

Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscodebat plugin identifier...