CVE-2026-85684: External Control of File Name or Path

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...

CVE-2025-6278

A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py. The manipulation of the argument file.filename leads to path traversal. The exploit has been disclosed to the public and may be used...

PT-2025-26240 · Upsonic · Upsonic

Name of the Vulnerable Software and Affected Versions: Upsonic versions up to 0.55.6 Description: A critical vulnerability was found in Upsonic, affecting the function os.path.join of the file markdown/server.py. The manipulation of the argument file.filename leads to path traversal. The exploit...

CVE-2025-6278: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py. The manipulation of the argument file.filename leads to path traversal. The exploit has been disclosed to the public and may be used...

PT-2025-12072

Name of the Vulnerable Software and Affected Versions eosphoros-ai/db-gpt version 0.6.0 Description The issue arises from the ability to pass an absolute path to a call to os.path.join, enabling an attacker to write files to arbitrary locations on the target server. This can be exploited by setti...

CVE-2024-7037

CVE-2024-7037 has multiple connected advisories confirming a vulnerability in open-webui v0.3.8. The issue is in the endpoint /api/pipelines/upload, where unsanitized file.filename is concatenated with CACHE_DIR, enabling arbitrary file write and delete operations. This can allow overwriting or d...

CVE-2024-4888: Missing Authorization

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the /audio/transcriptions endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes...