The vulnerability of the Trend Micro Apex One antivirus software arises from an incorrect limitation on the path to the catalog, allowing a malicious actor to execute arbitrary code.

The vulnerability of the Trend Micro Apex One antivirus software is related to an incorrect restriction on the path name to the catalog. Exploiting this vulnerability allows a hacker to execute arbitrary code...

The vulnerability of the CorpusReader class in the NLTK library for symbolic and statistical processing of natural language allows a hacker to read arbitrary files.

The vulnerability of the CorpusReader class in the NLTK library for symbolic and statistical processing of natural language is related to an incorrect restriction on the path name to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to read arbitrary fil...

PT-2026-54561

Уязвимость панели запуска платформы проектирования бизнес-приложений SAP Fiori связана с неверным ограничением имени пути к каталогу с ограниченным доступом. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к учетной записи пользовател...

The vulnerability of the FileBrowser Quantum file manager, related to incorrect restrictions on the path name of the restricted directory, allows a hacker to delete any files from the system.

The vulnerability of the FileBrowser Quantum file manager is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a remote attacker to delete any files from the system...

The vulnerability of the UniFi OS Server network management center arises from incorrect restrictions on the path to the directory, allowing unauthorized access by intruders to protected information.

The vulnerability of the UniFi OS Server network management center is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the PHPShop content management system lies in the incorrect limitation of the path name to the catalog, allowing attackers to execute arbitrary code.

The vulnerability of the PHPShop content management system is related to incorrect restrictions on the path to the catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the extractall() function in the Poetry dependency manager for the Python programming language allows a hacker to gain unauthorized access to protected information.

The vulnerability of the extractall function in the Poetry dependency manager for the Python programming language is related to an incorrect limitation on the path name of the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to...

The vulnerability of the decode_utf8 function in the base/gp_utf8.c software component, which is used for processing, transforming, and generating Ghostscript documents, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the decodeutf8 function in the base/gputf8.c software component for processing and generating Ghostscript documents is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow an attacker to gain unauthorized acces...

The vulnerability of the `createSessionInternal` method in the `PackageInstallerService.java` class of the Android operating system’s Framework component allows a hacker to escalate their privileges.

The vulnerability of the createSessionInternal method in the PackageInstallerService.java class of the Android operating system’s framework is related to an incorrect path limitation for the restricted access directory. Exploiting this vulnerability could allow an attacker to increase their...

The vulnerability in the software for downloading pyLoad files arises from incorrect path restrictions for the restricted access directory. This allows attackers to elevate their privileges and execute code as the root user.

The vulnerability of the software for downloading pyLoad files is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute code as the root user...

The vulnerability of the IPX image optimizer developed by Sharp and SVGO lies in the improper restriction on the path name to the restricted directory. This allows attackers to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of the IPX image optimizer developed by Sharp and SVGO is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions and gain unauthorized access to protected...

The vulnerability of the function for creating __screenshot-error screenshots in the software testing tool Vitest allows a hacker to execute arbitrary code.

The vulnerability of the screenshot-error function in the software testing tool Vitest relates to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code and disclose confidential information...

ROS-20260526-73-0017

Vulnerability in poetry related to incorrect path name restriction to a restricted directory. Exploitation of the vulnerability may allow a remote intruder to gain unauthorized access to protected information...

The vulnerability of the BuildKit container-building software lies in the improper restriction of the path name to the restricted-access directory, which allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the BuildKit container-building software is related to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability in the set of libraries for the Erlang programming language relates to incorrect restrictions on the path name to the restricted access directory. This allows a intruder to gain unauthorized access to protected information.

The vulnerability in the set of libraries for the Erlang programming language relates to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260524-73-0036

A vulnerability in the zip.vim plugin of the vim text editor is related to an incorrect restriction of the path name of a restricted directory. Exploitation of the vulnerability could allow an attacker to execute arbitrary commands...

The vulnerability of the cpdavd control panel for web hosting, including cPanel and WordPress Squared, as well as the WebHost Manager administrative panel, allows a hacker to read arbitrary files.

The vulnerability of the cpdavd control panel in web hosting using cPanel and WordPress Squared, as well as the WebHost Manager administration panel, is related to incorrect path name restrictions for restricted access directories. Exploiting this vulnerability could allow a malicious actor to re...

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

Summary pymdownx.snippets has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With restrictbasepath: True the default, the current filename.startswithbase containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling...

GHSA-62Q4-447F-WV8H Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

Summary pymdownx.snippets has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With restrictbasepath: True the default, the current filename.startswithbase containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling...

The vulnerability of the Java-based web application framework Apache Wicket relates to incorrect path name restrictions for restricted directories. This allows attackers to read arbitrary files.

The vulnerability of the Java-based web application framework Apache Wicket relates to an incorrect path name limitation for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to read arbitrary files...