CVE-2026-106109: Improper Limitation of a Pathname to a Restricted Directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

CVE-2026-105744: Improper Limitation of a Pathname to a Restricted Directory

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...

CVE-2026-76409

Cisco Nexus Dashboard is affected by an improper limitation of a pathname vulnerability (CWE-22), discovered during an internal security review and addressed in a software hardening release published in September 2026. The vulnerability is rated CVSS 3.1: 8.8 (HIGH) , with a vector of AV:N/AC:L/P...

GHSA-PC63-QCMH-9CMG Spring Framework Improper Path Limitation in XsltView

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

CVE-2026-47884

The Spring Framework is vulnerable to Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) due to the use of XsltView in Spring MVC applications. The issue occurs when an application possesses an "/ " mapping** that results in view rendering where the view name is not explicitly spe...

CVE-2026-47884 Spring Framework Improper Path Limitation in XsltView

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

CVE-2026-76842: Improper Limitation of a Pathname to a Restricted Directory

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-53457: Improper Limitation of a Pathname to a Restricted Directory

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...

CVE-2026-17173: Improper Limitation of a Pathname to a Restricted Directory

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths...

PT-2026-28974

Уязвимость функций File.ReadDir и File.Readdir языка программирования Go связана с неправильным ограничением пути к ограниченному каталогу. Эксплуатация уязвимости позволяет нарушителю получить несанкционированный доступ к защищаемой информации...

CVE-2026-24897: Improper Limitation of a Pathname to a Restricted Directory

Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged user can upload arbitrary files to any specified location due to insufficient validation of user‑supplied paths when creating shares. By specifying a writable path within the publ...

Linux Distros Unpatched Vulnerability : CVE-2021-20206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field i...

CVE-2024-49760: Improper Limitation of a Pathname to a Restricted Directory

OpenRefine is a free, open source tool for working with messy data. The load-language command expects a lang parameter from which it constructs the path of the localization file to load, of the form translations-$LANG.json. But when doing so in versions prior to 3.8.3, it does not check that the...

CVE-2024-23671

CVE-2024-23671 describes a path traversal vulnerability in Fortinet FortiSandbox versions 4.0.0–4.0.4, 4.2.0–4.2.6, and 4.4.0–4.4.3 that allows an attacker to execute unauthorized code or commands via crafted HTTP requests. The root cause is improper limitation of a pathname to a restricted direc...

CVE-2023-27812: Improper Limitation of a Pathname to a Restricted Directory

bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the deletefile function...

CVE-2022-20723: Improper Limitation of a Pathname to a Restricted Directory

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being...

CVE-2021-43289: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary directory of a GoCD server, but does not control the filename...

CVE-2022-26500: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code...

PT-2021-7911

Name of the Vulnerable Software and Affected Versions containernetworking/cni versions prior to 0.8.1 Description The issue is related to an improper limitation of path name flaw in the Container Network Interface CNI that can be exploited by an attacker to execute other existing binaries on the...

CVE-2020-29600: Improper Limitation of a Pathname to a Restricted Directory

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501...