CVE-2026-104843

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...

CVE-2026-103648

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...

CVE-2026-104843

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...

EUVD-2026-91752

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...

CVE-2026-104843 uv: Path traversal on Windows through wheel extraction

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...

CVE-2026-104843

The Python package and project manager uv (written in Rust) is vulnerable to a path traversal flaw during wheel extraction on Windows systems. Affected versions range from 0.12.7 until 0.12.18 . An attacker can trick a user into installing a specially crafted Python wheel package that, during ext...

CVE-2022-43293

Exploits for CVE-2022-43293 To get a persistent Windows Denial of Service as shown in the POC above, simply run Exploit.bat and enter %windir%\system32\cng.sys when you're asked which file you want to overwrite. Here you can find my Arbitrary File Write\Overwrite Vulnerability report. Here you ca...

CVE-2026-104471 YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...

CVE-2026-18953

CVE-2026-18953 — PoC Arbitrary file write in awslabs.aws-transform-mcp-server AWS Transform MCP server via the savePath parameter of the getresource tool. | ---|--- CVE| CVE-2026-18953 CWE| CWE-22 — Improper Limitation of a Pathname to a Restricted Directory Affected|...

Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230

CVE-2026-20230 Cisco Unified Communications Manager SSRF Arbitrary File Write to RCE PoC Derivation Process and Reflection Scope: This content is intended solely for local test environments, authorized reproduction environments, vulnerability verification, and protection rule analysis. Do not use...

Security update for helm

This update for helm fixes the following issues: CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction bsc1281104. CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal...

SUSE-SU-2026:4417-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction bsc1281104. - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows...

Lack of vulnerability protection in Fortinet FortiMail

Fortinet has identified a vulnerability in FortiMail. FortiMail contains a critical vulnerability CVE-2026-104286 in the processing of file paths, caused by a combination of Path Traversal CWE-22 and insufficient neutralization of NULL bytes CWE-158. An unauthorized attacker can use specially...

CVE-2025-8110

CVE-2025-8110 – Gogs ≤ 0.13.3 RCE PoC Proof-of-Concept for CVE-2025-8110 , an authenticated arbitrary file write in Gogs ≤ 0.13.3 caused by improper symbolic-link handling in the PutContents API. An authenticated user can commit a symlink pointing to .git/config, then use the API to overwrite it...

MAGNOLIA-8348

MAGNOLIA-8348: FreeMarker Restriction Bypass 3 in Magnolia CMS An issue in the FreeMarker Filter of Magnolia CMS v6.2.17 and below allows attackers to bypass security restrictions and execute arbitrary code, read/write/move/copy/delete arbitrary files or launch DoS attacks via a crafted FreeMarke...

MAL-010

MAL-010: Dangerous MBeans Accessible via JMX in Apache James By listing and inspecting the MBeans exposed by the JMX on localhost, port 9999, the following attack vectors have been identified: Arbitrary File Write using Log4J Arbitrary File Read using Log4J Note: Unlike the “MLet attack” presente...

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

The U.S. Cybersecurity and Infrastructure Security Agency CISA, on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 CVSS score: 9.8,...

CVE-2026-23009-DICOM-Network-Image-Injection-Without-Authentication

CVE-2026-23009 – DICOM Network Image Injection Without Authentication Program Code Python pydicom dicomserversim.py - DICOM C-STORE SCP with no AE title check from pynetdicom import AE, evt, AllStoragePresentationContexts def handlestoreevent: ds = event.dataset No authentication, accepts any ima...

UsoDllLoader

UsoDllLoader ⚠️ 2020-06-06 Update: this trick no longer works on the latest builds of Windows 10 Insider Preview. This means that, although it still works on the mainstream version of Windows 10 , you should expect it to be patched in the coming months. Description This PoC shows a technique that...

CVE-2026-44024_exploit

CVE-2026-44024 — Fluentd outfile $tag Path-Traversal Arbitrary File Write Unauthenticated arbitrary file write in Fluentd's outfile plugin via the $tag placeholder. outfile lets operators template the output path with a $tag placeholder e.g. path /var/log/fluent/$tag. Outputextractplaceholders...