Apache Commons VFS Path Traversal Vulnerability

Apache Commons VFS is a public virtual file system from the Apache USA Foundation. A path traversal vulnerability exists in Apache Commons VFS versions prior to 2.10.0, which stems from a program's failure to properly filter for special elements in a resource or file path. An attacker could explo...

Siemens SCALANCE LPE9403 SFTP Functional Path Traversal Vulnerability

Siemens SCALANCE LPE9403 is a local processing engine for industrial field data processing from Siemens. It is used to capture, collect and pre-process industrial field data. A path traversal vulnerability exists in Siemens SCALANCE LPE9403 6GK5998-3GS00-2AC2 V4.0 and earlier versions, which stem...

PT-2025-13380

Name of the Vulnerable Software and Affected Versions tar-fs versions 0.0.0 through 1.16.3 tar-fs versions 2.0.0 through 2.1.1 tar-fs versions 3.0.0 through 3.0.7 Description This issue is related to an Improper Link Resolution Before File Access "Link Following" and Improper Limitation of a...

@arc-directus/api (>=12.0.0, <=12.0.6), @deconz-community/directus-extension-ddf-store (0.1.0) +21 more potentially affected by CVE-2025-30225 via @directus/storage-driver-s3 (>=9.22.0, <=12.0.0)

@directus/storage-driver-s3 NPM version =9.22.0, =12.0.0, =9.25.0, =1.2.2, =11.1.0, =10.3.1, =1.0.5, =1.0.10, =0.1.0, =9.22.0, =11.4.1 and more Source cves: CVE-2025-30225 Source advisory: OSV:GHSA-J8XJ-7JFF-46MX...

CVE-2025-1310

CVE-2025-1310 affects the WordPress plugin Job Postings (Jobs for WordPress) up to version 2.7.11. Affected component: directory traversal via the job_postings_get_file parameter. Exploitation requires authenticated access at Subscriber level or higher, enabling reading of arbitrary server files ...

CVE-2025-27837

A flaw was found in Artifex Ghostscript. This vulnerability allows potential access to arbitrary files through a truncated path when invalid UTF-8 characters are used. The affected code areas are within base/gpmswin.c and base/winrtsup.cpp. system. Mitigation Mitigation for this issue is either n...

Path Traversal

agentscope is vulnerable to Path Traversal. The vulnerability is due to improper input sanitization, where the /api/file endpoint does not properly validate the path parameter, allowing an attacker to traverse directories and access arbitrary files on the server...

ALPINE-CVE-2025-27837

An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gpmswin.c and base/winrtsup.cpp...

CVE-2025-27837

An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gpmswin.c and base/winrtsup.cpp...

CVE-2025-27837

An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gpmswin.c and base/winrtsup.cpp...

CVE-2025-27837

An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gpmswin.c and base/winrtsup.cpp...

Vite bypasses server.fs.deny when using ?raw??

Summary The contents of arbitrary files can be returned to the browser. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Details @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or...

GHSA-X574-M823-4X7W Vite bypasses server.fs.deny when using ?raw??

Summary The contents of arbitrary files can be returned to the browser. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Details @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or...

Server-Side Request Forgery (SSRF)

composiocore is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied URLs in the BROWSERTOOLGOTOPAGE and BROWSERTOOLGETPAGEDETAILS actions, allowing an attacker to trigger SSRF and access arbitrary files on the system...

CVE-2025-27837

CVE-2025-27837 affects Artifex Ghostscript prior to 10.05.0. A vulnerability in path handling allows access to arbitrary files via a truncated path containing invalid UTF-8 characters in base/gp_mswin.c and base/winrtsup.cpp. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a CRIT...

Artifex Ghostscript 路径遍历漏洞

Artifex Ghostscript is a set of free software compiled by Artifex, Inc. based on Adobe, PostScript, and the Page Description Language for Portable Document Format PDL. A security vulnerability exists in Artifex Ghostscript versions prior to 10.05.0, which originates in base/gpmswin.c and...

Microsoft Edge’s vulnerability relates to the improper handling of symbolic links before accessing a file. This allows attackers to exploit their privileges.

The vulnerability of Microsoft Edge relates to the improper handling of symbolic links before accessing a file. Exploiting this vulnerability can allow an attacker to gain increased privileges...

CVE-2025-27837

An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gpmswin.c and base/winrtsup.cpp...

CVE-2025-27837

An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gpmswin.c and base/winrtsup.cpp...

CVE-2025-27837

An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gpmswin.c and base/winrtsup.cpp...