241 matches found
CVE-2026-35585-poc
CVE-2026-35585: File Browser OSコマンドインジェクション PoC English version 概要 このリポジトリは、File Browser （バージョン 2.0.0 から 2.33.1）で発見された重大なOSコマンドインジェクション脆弱性 CVE-2026-35585 のProof of Concept（PoC）です。 この脆弱性は「Custom Command Hooks」機能に存在します。シェル実行時に $FILE や $USERNAME...
CVE-2023-38831-POC
説明 名前 : CVE-2023-38831 CVSS スコア : 7.8 影響を受けるバージョン : Winrar 6.23 CVE-2023-38831 は、6.23 より前のすべてのバージョンの WinRAR に影響するゼロデイ脆弱性です。 問題は ZIP 形式の処理にあり、攻撃者が影響を受けるアーカイブを悪用してマルウェアを配布する可能性があります。悪意のある行為者は、ZIP アーカイブ内のファイルに正規のファイルと似た名前を付けることで悪意のあるファイルを偽装し、ユーザーが安全なファイルを開いていると思い込んで有害なコンテンツを実行するように仕向けます。この欠陥は 2023 年...
POC-CVE-2026-19679
CVE-2026-19679 — アップロードされたファイル名のサニタイズ不備（入力検証） ステータス: 確認済み 6.7.2-14.el9 ラボ環境（2026-08-20）。POST /rest/auditFile に tailoringOriginalFilename = "poc;touch$IFSpoc19679;me.xml" を指定すると HTTP 200 が返り、 AuditFile 1000002 が登録された — シェルメタ文字を含むファイル名は検証を通過し、 エンドツーエンドで保存された。6.9.0 では同じリクエストは "Invalid tailoring...
CVE-2026-48813-POC
Flawfinder-ANSI-Exploit-POC Flawfinder バージョン 2.0.19 では、潜在的に悪意のあるファイル名を解析する際にファイル名のサニタイズが行われません。影響を受ける端末は libvte ベースであり、以下の例では mate-terminal を示しています。 この脆弱性は、その後 David Wheeler と私によって 2026年5月17日時点のバージョン 2.0.20 で修正されました。 このリポジトリには、サンプルの POC bash スクリプトと、このエクスプロイトがどのように機能するかについての情報が含まれています。...
PYSEC-2026-3808 asyncssh has SCP Path Traversal to Arbitrary File Write
| | | |---|---| | Product | asyncssh all versions through 2.23.0 | | Related | CVE-2019-6111 same class in OpenSSH | | Fix | AsyncSSH 2.23.1 | A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP...
Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : SPICE vdagent vulnerabilities (USN-8723-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8723-1 advisory. It was discovered that SPICE vdagent had an integer overflow in the buffer size...
CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...
EUVD-2026-71133
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...
CVE-2026-82521
parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes...
CVE-2026-82521 parsedmarc 9.0.6 < 11.0.1 Path Traversal via Forensic Report Subject
parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes...
USN-8723-1 spice-vdagent vulnerabilities
It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, resulting in a denial of service. CVE-2026-57965 It was discover...
USN-8723-1: SPICE vdagent vulnerabilities
It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, resulting in a denial of service. CVE-2026-57965 It was discover...
Unity Linux 20.1070e Security Update: spice-vdagent (UTSA-2026-104950)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104950 advisory. A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the gue...
CVE-2026-81730
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it ...
CVE-2026-81694 verify-usb before 1.4.9 Output Injection via Unsanitized Filenames
openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...
PT-2026-82595
Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description The software fails to sanitize filenames read from untrusted drive data located outside the AES-GCM authenticated manifest before displaying them in the output of the verify-usb command. An...
SUSE CVE-2026-79992
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...
EUVD-2026-65616
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...
WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass vulnerability
Unauthenticated RCE via Control Character Filename Bypass vulnerability discovered by Jakub Herman in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions 1.3.9.9...
