CVE-2026-124680 Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding

Interpretation Conflict, resulting in Incorrect Authorization vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse encoded dot segments. Th...

CVE-2026-124680

Apache APISIX versions 0.9 through 3.19.0 are vulnerable to an Interpretation Conflict leading to Incorrect Authorization . An unauthenticated client can bypass route-level auth plugins by accessing upstream paths when a route without authentication exists on the same upstream, provided the upstr...

CVE-2021-41773

CVE-2021-41773 🐛 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like...

CVE-2021-41773

CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 CVE-2021-41773 Info A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document...

CVE-2021-41773

Apache HTTP Server 2.4.49 - Path Traversal & RCE CVE-2021-41773 A sophisticated Python-based proof-of-concept PoC exploit for CVE-2021-41773. This tool automates the process of testing Apache 2.4.49 servers for path traversal and remote code execution RCE vulnerabilities. ⚠️ Legal Disclaimer This...

CVE-2026-25890-FileBrowser-Access-Control-Bypass

CVE-2026-25890 - FileBrowser Access Control Bypass Unauthenticated users cannot exploit this — requires valid low-privileged credentials that are restricted from the target path. Path-based authorization bypass in FileBrowser ≤ v2.57.0 using multiple leading slashes //private instead of /private ...

grafana-CVE-2021-43798

Grafana CVE Scan 21-43798 0.1 Scanner for Grafana Path Traversal Vulnerability found in CVE-2021-43798 Disclaimer: This is for Educational Purposes only! References for CVE: 1 - NIST CVE Details 2 - Grafana Notes Workarounds All installations between v8.0.0-beta1 and v8.3.0 should be upgraded as...

unKover

unKover Uncover what's forbidden. 403 bypass tester by Brute Logic. Part of the King of Noobs suite — offensive recon tools built on KISS and the Pareto principle. Simple, fast, and effective. What It Does unKover tests a URL returning 403 Forbidden or 401 Unauthorized against a set of proven...

CVE-2026-88009-PoC

CVE-2026-88009 — Traefik routes an opaque request target as / but forwards it verbatim Affected: Traefik 2.11.57, and 3.0.0 – 3.7.13 Fixed: 2.11.57 / 3.7.13 Fix: commit 58d1e9ca2045 "Deny request with an opaque request target" — denyOpaque in pkg/server/serverentrypointtcp.go Advisory:...

CVE-2018-11759

CVE-2018-11759 Proof of concept Description The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported b...

CVE-2021-41773h

CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 CVE-2021-41773 Info A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document...

Path-traversal-RCE-Apache-2.4.49-2.4.50-Exploit

Exploit for CVE-2021-41773 and CVE-2021-42013 Path traversal attack and RCE in Apache/2.4.49-2.4.50 Features - Take a list of urls - Works for both CGI and non-CGI - Works for Apache/2.4.49 - 2.4.50 Usage $ git clone https://github.com/CalfCrusher/Path-traversal-RCE-Apache-2.4.49-2.4.50-Exploit $...

CVE-2025-55752

🚨🚨 CVE-2025-55752 — Apache Tomcat: Directory-protection bypass via Rewrite Valve → PUT-based RCE🚨🚨 Summary CVE-2025-55752 is a security regression in Apache Tomcat introduced while fixing bug 60013. When the Rewrite Valve is used, Tomcat applies path normalization before URL decoding. This...

Apache-CVE-2021-41773

CVE-2021-41773 Apache HTTP Server Path Traversal Contributors 이희수@lheeeesoo Apache HTTP Server 2.4.49 has a vulnerability where it fails to properly block encoded parent paths during URL path normalization. An attacker can use values like .%2e to traverse outside the directories that the web serv...

Addressable: Denial of service in URI path normalization

Impact Addressable::URI.normalizepath takes time quadratic in the number of nested dot segments in a path e.g., "/" + "a/" n + "../" n, which for n = 3 is /a/a/a/../../../, because it removes one dot segment per pass over the whole path. URInormalize, URInormalizedpath, URI==, URI=== and URIjoin...

GHSA-QQ38-M9MG-XJJ5 Addressable: Denial of service in URI path normalization

Impact Addressable::URI.normalizepath takes time quadratic in the number of nested dot segments in a path e.g., "/" + "a/" n + "../" n, which for n = 3 is /a/a/a/../../../, because it removes one dot segment per pass over the whole path. URInormalize, URInormalizedpath, URI==, URI=== and URIjoin...

GHSA-8GMH-2HHJ-2HV9 Addressable URI normalization resolves some dotted path segments to the wrong path

Summary Addressable::URI.normalizepath resolves some paths containing .. segments to a different path than RFC 3986 does. When a path climbs above the root before any other .. is resolved, the segments that later .. segments should remove are instead kept: /../../public/x/../../secret normalizes ...

CVE-2026-126210

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...

CVE-2026-126354 Addressable URI normalization resolves some dotted path segments to the wrong path

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalizepath can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver...

CVE-2026-126354

The Addressable library (versions 2.2.5 through 2.9.1 ) contains a URI normalization vulnerability where Addressable::URI.normalize_path resolves paths with leading or subsequent parent segments differently than an RFC 3986 resolver. This discrepancy affects URI#normalize , URI#join , URI#== , an...