PT-2026-81517

Name of the Vulnerable Software and Affected Versions SonicWall NetExtender Linux client affected versions not specified Description A path traversal issue exists within the OPSWAT tarball component. This flaw allows an attacker to write arbitrary files with root privileges. Path traversal is a...

PT-2026-82011

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive...

CVE-2026-55527: Improper Limitation of a Pathname to a Restricted Directory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized userid into self.userpath. A caller supplying ../ or path separators can escape the memory directory and write JSON data to arbitrary process-writable locations. The fix sanitize...

PT-2026-81325

Name of the Vulnerable Software and Affected Versions praisonaiagents versions prior to 1.6.58 Description An arbitrary file write issue exists due to improper sanitization of the user id parameter in the FileMemory. init function. When the FileMemory constructor joins the user id into self.user...

PT-2026-81396

browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser download writes a fetched response body to joinsave dir, filename without validating the caller-controlled save dir, while browser save state and browser load state honor a caller-controll...

PT-2026-81130

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server...

Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

Description The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across...

PT-2026-81315

Name of the Vulnerable Software and Affected Versions sos affected versions not specified Description A flaw in the sos clean utility within the sos package allows a local attacker to create or overwrite arbitrary files. The issue stems from a path traversal flaw during the extraction of tar...

Linux Distros Unpatched Vulnerability : CVE-2026-79655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By...

EUVD-2026-39432

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation...

GHSA-JM48-M3RR-9HGG 3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray including roo...

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray including roo...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the downloadBlobToFile path in BlobOperations.java. An attacker can write or overwrite files outside the configured fileDir by supplying a blob name containing ../ segments in a container the route consumes...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the downloadBlobToFile path in BlobOperations.java. An attacker can write or overwrite files outside the configured fileDir by supplying a blob name containing ../ segments in a container the route consumes...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal through the downloadFileName process. An attacker can create or overwrite files outside the intended directory by supplying specially crafted object names containing parent-directory segments in a Google Cloud...

Acelle-Mail-4.0.24-Unauthenticated-Path-Traversal-to-RCE-Chain

Acelle Mail Note: The path traversal alone Step 1 is su...

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66907

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

CVE-2026-60093

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...