54252 matches found
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
Summary The S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as: GET /bucket-A/../evil-bucket/key is matched as bucket=bucket-A,...
EUVD-2026-39535
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access...
GHSA-W62W-66V9-VVGV SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
Summary The S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as: GET /bucket-A/../evil-bucket/key is matched as bucket=bucket-A,...
CVE-2026-72799 SiYuan before v3.7.4 Information Disclosure via Path Resolution
SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader — or any...
CVE-2026-72799
SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader — or any...
EUVD-2026-57459
SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader — or any...
CVE-2026-72799
CVE-2026-72799 affects SiYuan before v3.7.4 (up to v3.7.2). In publish mode, when Publish.Auth.Enable is false, unauthenticated readers or any publish reader token can call five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, getHPathByPath) to enum...
CVE-2026-73327
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported behavior is intentional. The update process is designed to write files to disk and is restricted to the highest-privilege users working with cryptographically verified Joomla archives...
CVE-2026-17266
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
CVE-2026-16860
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element...
CVE-2026-73327
The Initial Description states "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Joomla is a CNA in scope." This CVE ID is rejected/not used and does not represent an active vulnerability entry.
CVE-2026-73327
...
EUVD-2026-57390
Joomla 6.1.1 contains a path traversal vulnerability in the comjoomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with...
CVE-2026-73327 Joomla 6.1.1 Zip Slip Path Traversal via com_joomlaupdate extract.php
Joomla 6.1.1 contains a path traversal vulnerability in the comjoomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with...
CVE-2026-17266
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
EUVD-2026-57364
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
CVE-2026-17266
IBM i (7.6, 7.5, 7.4, 7.3) is affected by CVE-2026-17266 in Navigator for i, a path traversal flaw that could allow a remote authenticated attacker to obtain sensitive information by improper limitation of a pathname to a restricted directory. CVSS base 6.5 (Network, Low attacker effort, Privileg...
CVE-2026-17266 IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...