rustypaste < 0.18.1 - Filename Header Path Traversal

rustypaste before 0.18.1 contains a path traversal caused by improper validation of the custom filename HTTP header, letting attackers write files outside the upload directory. id: CVE-2026-90774 info: name: rustypaste 0.18.1 - Filename Header Path Traversal author: carfeii severity: high...

CVE-2026-90774

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

EUVD-2026-76995

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774

rustypaste before 0.18.1 is vulnerable to a path traversal via the optional custom filename HTTP header. The root cause is that the destination path is validated before the filename header is applied, so an attacker can supply traversal sequences (e.g., ../) in the header to write files outside t...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774: Improper Limitation of a Pathname to a Restricted Directory

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

PT-2026-90841

Name of the Vulnerable Software and Affected Versions rustypaste versions prior to 0.18.1 Description An issue exists where the destination path is validated before the optional custom filename HTTP header is applied, which allows the bypass of directory-escape checks. Attackers can use path...

CVE-2026-15302

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files e.g., CSS to directories outside the...

CVE-2026-15302 ARMember <= 4.0.27 - Directory Traversal via X-FILENAME

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files e.g., CSS to directories outside the...

CVE-2026-15302

The ARMember plug-in for WordPress (affected: all versions up to and including 4.0.27) is vulnerable to Directory Traversal via the X-FILENAME HTTP header. Unauthenticated attackers can upload and overwrite certain files (e.g., CSS) outside the wp-content/uploads/armember directory. This is a net...

CVE-2026-15302

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files e.g., CSS to directories outside the...

CVE-2026-15302 ARMember <= 4.0.27 - Directory Traversal via X-FILENAME

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files e.g., CSS to directories outside the...

PT-2026-57077

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files e.g., CSS to directories outside the...

CVE-2026-24001

A flaw was found in jsdiff. A specially crafted patch input containing specific line break characters can cause the parsePatch method to enter an infinite loop, leading to uncontrolled memory consumption and a process crash, resulting in a denial of service. The applyPatch method is similarly...

CVE-2023-49565 Remote Code Execution

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

Nokia CloudBand Infrastructure Software and Nokia Container Service have security vulnerabilities

Nokia CloudBand Infrastructure Software and Nokia Container Service are both products of the Finnish company Nokia.Nokia CloudBand Infrastructure Software is a platform that supports the virtualization of network functions. Nokia Container Service is a container management service. A security...

Exploit for Improper Encoding or Escaping of Output in Exim

CVE-2024-39929 PoC Vulnerability Brief Exim through 4.97...

GHSA-X9FV-C87W-55WC Improper Control of Generation of Code in Apache Camel

Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple" in a CamelFileName message header to a 1 FILE or 2 FTP producer...