PT-2026-27205

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.4 Description The file server endpoint does not validate permissions on the temp/ path and does not filter path traversal sequences, potentially allowing unauthorized access to arbitrary files on the server. If...

CVE-2026-23483: Improper Limitation of a Pathname to a Restricted Directory

Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join to concatenate paths but does not verify if the final path is within the plugins directory, leading to path traversal. At time of publication, there are no publicly...

CVE-2026-23482: Improper Limitation of a Pathname to a Restricted Directory

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and does not filter path traversal sequences, allowing unauthorized attackers to read arbitrary files on the server. When scheduled backup tasks...

Blinko 路径遍历漏洞

Blinko is an open-source AI-based card-based note-taking app designed for users who want to quickly capture and organize fleeting ideas. Versions of Blinko 1.8.3 and earlier contained a path traversal vulnerability. This vulnerability occurred because the plugin file server endpoint used the join...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through a discrepancy in path normalization between protocol handlers and internal routing. An attacker can bypass folder-level permissions or escape the boundaries of a configured virtual folder by crafting specific...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the resolveURI function while performing directory validation when the configuration value livy.file.local-dir-whitelist is set to a non-default value. An attacker can gain unauthorized access to arbitrary...

EUVD-2026-11379

Copyparty has unexpected JavaScript execution via crafted URL to folder with .prologue.html...

CVE-2026-32109

Copyparty (portable file server) contains a vulnerability where an attacker with both read and write permissions can upload a file named .prologue.html and craft a link to potentially execute arbitrary JavaScript in a victim’s context. The attack requires the target to click the crafted link; nor...

CVE-2026-32108

Copyparty before version 1.20.12 had a missing permission-check in the shares feature (shr global-option). If a share is created to expose a single file inside a folder and FTP or SFTP is enabled and publicly accessible, a user browsing the share over FTP/SFTP could read other files in the same f...

PT-2026-24824

Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note th...

dhtmlx FileExplorer 安全漏洞

dhtmlx FileExplorer is a JavaScript file system developed by the dhtmlx company. There is a security vulnerability in dhtmlx FileExplorer, which stems from an authentication bypass in the embedded SwiFTP FTP server component. This vulnerability allows network attackers to log in and perform file...

CVE-2026-32109: Improper Neutralization of Input During Web Page Generation

Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note th...

EUVD-2026-10602

Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally...

EUVD-2026-10603

Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally...

CVE-2026-24283

Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally...

CVE-2026-24283

Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally...

CVE-2026-24283

Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally...

Exploit for Code Injection in Rejetto Http_File_Server

Optimum --- Optimum – Hack The Box Writeup Overview I...

Multiple UNC Provider Kernel Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally...

PT-2026-24279

Name of the Vulnerable Software and Affected Versions Windows File Server affected versions not specified Description A heap-based buffer overflow exists in Windows File Server. An authorized attacker can exploit this to elevate privileges locally. Recommendations At the moment, there is no...