31 matches found
CVE-2026-57441: Improper Resolution of Path Equivalence
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On...
CVE-2026-73019
CVE-2026-73019 involves an improper resolution of path equivalence in the Windows URL Moniker component, allowing an unauthorized attacker to bypass a security feature over a network. The vulnerability requires user interaction and grants low confidentiality impact with no integrity or availabili...
EUVD-2026-73754
Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network...
EUVD-2026-73497
Improper link resolution before file access 'link following' in Windows NTFS allows an authorized attacker to perform tampering locally...
CVE-2026-69289
CVE-2026-69289 is an elevation of privilege vulnerability in Windows Setup Files Cleanup , caused by improper link resolution before file access ("link following"). An authorized local attacker with low privileges can exploit it without user interaction to gain high impact across confidentiality,...
Windows URL Moniker Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network...
PT-2026-87928
Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network...
PT-2026-88102
Name of the Vulnerable Software and Affected Versions Windows Update Stack affected versions not specified Description An improper link resolution before file access, known as link following, occurs within the Windows Update Stack. This issue allows an authorized attacker to elevate their...
CVE-2026-63693
Dell Client BIOS contains an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Write...
CVE-2026-17171 Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links...
dotnet: .NET: Local file tampering via link following vulnerability
A flaw was found in .NET's System.Formats.Tar library. When extracting a specially crafted TAR archive containing symbolic links, the TarFile.ExtractToDirectory method may incorrectly follow those links and write files outside the intended extraction directory. An attacker could exploit this issu...
CVE-2026-50568: Improper Resolution of Path Equivalence
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefixpath,...
.NET Tampering Vulnerability
Improper link resolution before file access 'link following' in .NET allows an unauthorized attacker to perform tampering locally...
CVE-2026-23674: Improper Resolution of Path Equivalence
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network...
CVE-2025-58290: Improper Resolution of Path Equivalence
Denial of service DoS vulnerability in the office service. Successful exploitation of this vulnerability may affect availability...
CVE-2025-43298: Improper Resolution of Path Equivalence
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to gain root privileges...
CVE-2025-54107: Improper Resolution of Path Equivalence
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network...
CVE-2024-6839: Improper Resolution of Path Equivalence
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...
CVE-2025-24470: Improper Resolution of Path Equivalence
An Improper Resolution of Path Equivalence vulnerability CWE-41 in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to retrieve source code via crafted HTTP requests...