52566 matches found
EUVD-2026-57547
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...
CVE-2026-66898
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...
CVE-2026-66898
The CVE-2026-66898 entry describes a path traversal flaw in LXD during backup import/restore, where archive metadata allows unvalidated instance/storage volume names to include traversal sequences. This can let an attacker read/write files outside the intended restore directory, potentially enabl...
CVE-2026-66898 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...
EUVD-2026-57545
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...
CVE-2026-66898 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...
CVE-2026-66898 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...
CVE-2026-73409
Budibase Open Source platform suffered a filesystem information disclosure via builder-controlled TLS options. Before 3.40.1, packages/server/src/integrations/mongodb.ts passed tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A malicious builder could submit a...
CVE-2026-73409
Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify a...
CVE-2026-73409 Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify a...
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
Summary The S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as: GET /bucket-A/../evil-bucket/key is matched as bucket=bucket-A,...
EUVD-2026-39535
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access...
GHSA-W62W-66V9-VVGV SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
Summary The S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as: GET /bucket-A/../evil-bucket/key is matched as bucket=bucket-A,...
CVE-2026-72799 SiYuan before v3.7.4 Information Disclosure via Path Resolution
SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader — or any...
CVE-2026-72799
SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader — or any...
EUVD-2026-57459
SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader — or any...
CVE-2026-72799
CVE-2026-72799 affects SiYuan before v3.7.4 (up to v3.7.2). In publish mode, when Publish.Auth.Enable is false, unauthenticated readers or any publish reader token can call five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, getHPathByPath) to enum...
CVE-2026-73327
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported behavior is intentional. The update process is designed to write files to disk and is restricted to the highest-privilege users working with cryptographically verified Joomla archives...