ROS-20250925-03

Vulnerability of TarFile.extractall and TarFile.extract functions of tarfile module of Python programming language interpreter CPython is related to incorrect restriction of path name of the directory with restricted directory. Python programming language interpreter CPython functions...

The vulnerability of the Node.js software platform arises from incorrect restrictions on path names for restricted access directories. This allows attackers to gain read, modify, and delete permissions for files.

The vulnerability of the Node.js software platform is related to incorrect restrictions on path names in restricted access directories. Exploiting this vulnerability can allow an attacker to gain read, modify, and delete permissions for files...

PT-2025-34784 · Google +1 · Android Debug Bridge +1

Name of the Vulnerable Software and Affected Versions: Kapsch TrafficCom RIS-9260 RSU LEO versions 3.2.0.829.23, 3.8.0.1119.42, and 4.6.0.1211.28 Description: The Kapsch TrafficCom RIS-9260 RSU LEO software has the Android Debug Bridge ADB pre-installed and enabled by default. This allows...

The vulnerability of the Tidal component of the Alpine iLX-507 audio system allows a hacker to execute arbitrary code.

The vulnerability of the Tidal component of the Alpine iLX-507 audio system is related to an incorrect restriction on the name path to the restricted-access catalog. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2025-54794 Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of or ability t...

CVE-2025-54794 Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of or ability t...

CVE-2025-54794

CVE-2025-54794 – Claude Code path validation bypass : Claude Code versions older than 0.2.111 expose a directory-restriction bypass due to a path validation flaw that uses prefix matching instead of canonical path comparison. Exploitation requires either a pre-existing or creatable directory shar...

Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

Due to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of or ability to create a directory with the same prefix as the CWD and the...

GHSA-PMW4-PWVC-3HX2 Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

Due to a path validation flaw using prefix matching instead of canonical path comparison, it was possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of or ability to create a directory with the same prefix as the CWD and the...

The vulnerability of the file server, related to incorrect restrictions on the path to the restricted directory, allows a hacker to bypass security restrictions.

The vulnerability of the server-filesystem is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

SAMSUNG DMS 安全漏洞

SAMSUNG DMS is a data management server from Samsung South Korea. A security vulnerability exists in SAMSUNG DMS that stems from an improperly restricted path that could lead to the creation of arbitrary files...

The vulnerability of the Mattermost instant messaging application, related to an incorrect restriction on the path to the restricted catalog, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Mattermost instant messaging application is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the uploadFWBinary method in the network management system for monitoring industrial networks of Siemens SINEC NMS allows a intruder to gain unauthorized access to file writing and execute arbitrary code.

The vulnerability of the uploadFWBinary method in the network management system for monitoring industrial networks of Siemens SINEC NMS is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating...

The vulnerability of the unZipJarFilestoLocation method in the network management system allows a intruder to gain unauthorized access to file recording and execute arbitrary code. This vulnerability is present in Siemens SINEC NMS systems used for monitoring industrial networks.

The vulnerability of the unZipJarFilestoLocation method in the network management system for monitoring industrial networks of Siemens SINEC NMS is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operati...

The vulnerability of the Booco business automation platform lies in the improper limitation of the path name to the restricted access catalog. This allows attackers to create or overwrite files in the file system’s directories and execute arbitrary code.

The vulnerability of the Booco business automation platform is related to an incorrect restriction on the path name for restricted access catalogs. Exploiting this vulnerability allows a malicious actor to create or re-record files in file system catalogs and execute arbitrary code...

The vulnerability of the automated system for emulating intruder actions in Caldera, related to an incorrect restriction on the path name to the restricted catalog, allows an intruder to execute arbitrary code.

The vulnerability of the automated system for emulating intruder actions in Caldera is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability allows an intruder operating remotely to execute arbitrary code by sending a specially crafted HTTP...

The vulnerability of the setuptools project’s packaging simplification library arises from an incorrect limitation on the path to the restricted-access directory. This allows a malicious actor to compromise the vulnerable system.

The vulnerability of the setuptools project’s packaging simplification library is related to an incorrect restriction on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to compromise the vulnerable system remotely...

The vulnerability of the NetMRI network monitoring program lies in the improper restriction of the path name to the restricted access directory, allowing attackers to read arbitrary files.

The vulnerability of the NetMRI network monitoring program lies in the improper restriction of the path name to the restricted-access directory. Exploiting this vulnerability allows a malicious actor to read arbitrary files...

The vulnerability of the graphical SFTP and SCP client for the Windows operating system, WinSCP, arises from incorrect path name restrictions for access-controlled directories. This allows attackers to create a special file and control its path on a remote server.

The vulnerability of the graphical SFTP and SCP client programs for the Windows operating system is related to incorrect path name restrictions for access to restricted directories. Exploiting this vulnerability allows an attacker to create a special file and control its path on a remote server...

The vulnerability of the PHP Snappy library relates to incorrect restrictions on the path to the restricted directory. This allows attackers to gain unauthorized access to local files and directories.

The vulnerability of the PHP Snappy library is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to local files and directories on the server when...