CVE-2026-54910

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two...

DEBIAN-CVE-2023-45283

The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x...

golang: net/url: JoinPath does not strip relative path components in all circumstances

A flaw was found in the golang package. The JoinPath doesn't remove the ../ path components appended to a domain that is not terminated by a slash, possibly leading to a directory traversal attack...