EUVD-2026-73131

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...

Microsoft Word Remote Code Execution Vulnerability

External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally...

Microsoft Exchange Server Remote Code Execution Vulnerability

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network...

Windows Shell Elevation of Privilege Vulnerability

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...

Microsoft Exchange Server (September 2026)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. CVE-2026-55007 - External control of file name...

CVE-2026-47680: Relative Path Traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

PT-2026-87731

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description External control of a file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version...

CVE-2026-81830

A flaw was found in OpenVPN. The Windows interactive service in OpenVPN contains an incorrect file path validation vulnerability. A local authenticated user could exploit this flaw to bypass the trusted configuration directory constraint, leading to a security bypass and potential integrity...

CVE-2026-81830

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

CVE-2026-81830: External Control of File Name or Path

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

PT-2026-105771

The /v1/chat/agents/agent id/edit endpoint in local-operator versions before 0.47.5 resolves the caller-supplied file path with expanduser.resolve and reads it without checking that it lies inside the agent's workspace. An unauthenticated client with network access to the API can supply an absolu...

CVE-2026-85665

Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that...

CVE-2026-85665

Bruno versions through 3.4.2 are affected by an arbitrary file read vulnerability caused by insufficient validation of file paths in request body declarations. An attacker who can influence a collection's body:file path can embed parent-directory traversal (../) sequences that resolve outside the...

CVE-2026-82194: External Control of File Name or Path

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root...

PT-2026-85573

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument...

The vulnerability of the MailComposer.compile() method in the Nodemailer email sending library allows a hacker to expose protected information and perform an SSRF attack.

The vulnerability of the MailComposer.compile method in the Nodemailer email sending library is related to improper external manipulation of file names or file paths. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information and perform an SSRF attack...

EUVD-2026-68920

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the...

The vulnerability of the application software interface of the Natural Language Processing library package NLTK allows a hacker to bypass existing security mechanisms and gain access to read and write arbitrary files.

The vulnerability of the application programming interface of the Natural Language Processing library NLTK is related to improper external management of file names or file paths. Exploiting this vulnerability can allow an attacker to bypass existing security mechanisms and gain read-write access ...

PT-2026-84073

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the...

CVE-2026-82665

yaojingang GEOFlow (up to 2.1.0) contains a path traversal vulnerability in the Image Library Cleanup component. The flaw resides in the unlink function of app/Http/Controllers/Admin/ImageLibraryController.php, where an attacker who controls the file_path argument can delete files outside the int...