CVE-2020-1048

CVE-2020-1048 An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then...

CVE-2026-63120

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage such as S3, GCS, or Azure to execute arbitrary file write...

EUVD-2026-108915

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage such as S3, GCS, or Azure to execute arbitrary file write...

CVE-2026-115375

The Incus container management software (versions 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0) is vulnerable to a path traversal vulnerability. The root cause is the lack of validation for dependent custom volume names within instance backup index.yaml files. An attacker with the ability to create ...

CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instan...

CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instan...

CVE-2025-71437

A flaw was found in uv. An attacker can perform arbitrary file writes outside the intended directory by providing a malicious source distribution sdist archive. During tar extraction, uv fails to properly validate a crafted sequence of symbolic links, redirecting file writes across the filesystem...

CVE-2026-114109

A flaw was found in uv. An attacker who convinces a user to install a malicious package can achieve arbitrary code execution. Because uv does not properly restrict entry point names, installing a crafted wheel package allows files to be written outside the intended directory, enabling an attacker...

CVE-2026-114096

A flaw was found in Dulwich. When checking out specific file paths, the application improperly follows symbolic links when creating or restoring files. By tricking a user into checking out files from a maliciously crafted repository, an attacker can write arbitrary files to the local filesystem,...

CVE-2026-114403

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

Insecure Temporary File

Overview Affected versions of this package are vulnerable to Insecure Temporary File via the FromAppData seeder in src/virtualenv/seed/embed/viaappdata/viaappdata.py when --symlink-app-data is used with a transient temporary app-data directory. Because the app-data directory is removed after...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the create method in venv.py and viaglobalselfdo.py, where output directories are created without first verifying they reside within the intended virtual environment destination. An attacker who can plant a symlink or...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the create method in venv.py and viaglobalselfdo.py, where output directories are created without first verifying they reside within the intended virtual environment destination. An attacker who can plant a symlink or...

CVE-2026-113651

ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads,...

CVE-2026-113651 ApostropheCMS: Path traversal in uploadfs

ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads,...

CVE-2026-113651 ApostropheCMS: Path traversal in uploadfs

ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads,...

EUVD-2026-105177

ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads,...

CVE-2026-113651

The uploadfs file storage library used by ApostropheCMS is vulnerable to a path traversal vulnerability in versions prior to 1.28.0 . An attacker could use parent-directory segments in attacker-controlled paths to escape the configured upload directory, potentially affecting file reads , writes ,...

MLflow FileStore trace IDs allow path traversal and arbitrary file writes

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...

GHSA-WQMH-QCCW-PQWF MLflow FileStore trace IDs allow path traversal and arbitrary file writes

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...