PT-2026-105501

Summary StaticFileHandler allows an unauthenticated attacker to read arbitrary files from the server's filesystem by requesting a path that resolves to a symbolic link placed inside the static root directory. Any application that serves user-uploadable content, or whose static directory is...

CVE-2026-55540 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, ispathwithindirectory uses os.path.abspath rather than os.path.realpath for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing readfile and other code tools to access files...

CVE-2026-7819

Symbolic-link path traversal CWE-61, CWE-22 in pgAdmin 4 File Manager. checkaccesspermission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storag...