python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

CVE-2026-53449 Coturn: Arbitrary File Write via CLI psd Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

CVE-2026-53449 Coturn: Arbitrary File Write via CLI psd Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

CVE-2026-53449 Coturn: Arbitrary File Write via CLI psd Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly passes it to fopen with no path validation. An authenticated admin with CLI access can overwrite arbitrary files writable ...

CVE-2026-53449

CVE-2026-53449 — Coturn : Before 4.13.0, the psd print sessions dump CLI command accepts a filename argument and passes it directly to fopen without path validation, enabling an authenticated admin with CLI access to overwrite arbitrary files writable by the coturn process with session dump data....

CVE-2026-60089

Prais onAI (pip package praisonaiagents) prior to version 1.6.78 is affected by a path-traversal issue: defaults loaded from a project-local .praisonai/config.toml can set defaults.output.output_file to an absolute or .. traversal path. If an Agent is started without an explicit output parameter,...

Cisco CUCM CVE-2026-20230 detection

Detects Cisco Unified Communications Manager instances exposing the webdialer WSDL endpoint used in CVE-2026-20230 SSRF to arbitrary file write and JSP command execution. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclie...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the updateWritingFileIfNeeded method of IoTDBFileReceiver, which builds the write target as new FilereceiverFileDirWithIdSuffix.get, fileName from the incoming pipe transfer fileName without confining it to the...

Exploit for Improper Access Control in Ollyo Helix3

Исследование уязвимости CVE-2026-49049: Unauthenticated Arbitr...

CVE-2026-40005 Apache IoTDB: Path Traversal in Pipe File Transfer Receiver

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to...

CVE-2026-40005

Apache IoTDB versions 1.0.0 before 2.0.10 are vulnerable to a Path Traversal (CWE-22) vulnerability. The root cause is insufficient validation of file paths within the updateWritingFileIfNeeded() method of the IoTDBFileReceiver component. An attacker who can send to the pipe file receiver can pro...

decompress: decompress: path traversal via indexOf containment bypass allows arbitrary file write (bypass of CVE-2020-12265 fix)

A flaw was found in the decompress component. An improper path containment check allows a local attacker to perform directory traversal. This vulnerability, when combined with unvalidated symlink creation, enables an attacker to write arbitrary files to directories outside the intended extraction...

decompress allows arbitrary hardlink creation during archive extraction

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...

EUVD-2026-42769

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function index.js line 29 and the extraction path validation index.js line 106 use String.indexOf to verify the resolved path is within the output...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +28574 more potentially affected by CVE-2026-39243 via decompress (>=0.1.6, <=4.2.1)

decompress NPM version =0.1.6, =1.0.0, =0.0.1, =0.0.4 - 1095h-cli 1.0.1 - 10secondsofcode-custom 1.0.0 and more Source cves: CVE-2026-39243 Source advisory: SNYK:JS-DECOMPRESS-17937340...

Directory Traversal

Overview org.webjars.npm:decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Directory Traversal via improper validation in the safeMakeDir function and extraction path validation process. An attacker can write arbitrary files...

CVE-2026-14480: External Control of File Name or Path

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename progfile directly into the Programs.File database field and later uses this value as the destination path for an...

CVE-2026-40005: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to...

Vulnerabilities related to Apache IoTDB permissions, permissions management, and access control

Apache IoTDB is an open-source IoT database developed by the Apache Foundation in the United States. There is a security vulnerability in Apache IoTDB. This vulnerability stems from the internal RPC interface used by DataNode to create Trigger instances, which constructs file paths using the...

CVE-2026-58499: Improper Limitation of a Pathname to a Restricted Directory

EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint because the per-message senderid field was not validated as a path-safe identifier, unlike appid and projectid. During user-memory extraction, senderid i...