CVE-2026-48374

Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") vulnerability that could enable arbitrary file system read outside the intended scope. Exploitation requires user interaction : a victim must open a malicious file. The CVSS 3.1 metrics indicat...

CVE-2026-67185

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...

CVE-2026-67185 TinyWeb 0.0.8 Path Traversal via URL Path Component

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...

CVE-2026-67185

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...

CVE-2026-67185

CVE-2026-67185 affects TinyWeb up to version 0.0.8 and describes a path traversal in HttpBuilder::buildResponse() that concatenates URL path segments directly to the web root without normalization, allowing unauthenticated attackers to read files via ../ sequences. The vulnerability can expose se...

EUVD-2026-49904

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...

CVE-2026-54545

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...

@wakaru/cli arbitrary file write during bundle unpack

Impact @wakaru/cli is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with --unpack. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such ...

CVE-2026-54545

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability (CVE-2026-14976, CVE-2026-15280)

Summary IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled. Vulnerability Details CVEID:CVE-2026-14976 DESCRIPTION: IBM WebSphere Application Server Liberty is affected by remote code...

CVE-2026-7521

Mattermost CVE-2026-7521 affects versions 11.8.x up to 11.8.0, 11.7.x up to 11.7.3, 11.6.x up to 11.6.5, and 10.11.x up to 10.11.20. The issue arises from a failure to verify the file deletion path in the remove file endpoint for SAML admin writes, enabling deletion of arbitrary files outside the...

CVE-2026-7521 SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

CVE-2026-57211

A flaw was found in RabbitMQ. The RabbitMQ management plugin static file handler, rabbitmgmtwmstatic, on Windows can be exploited when multiple management extension plugins are enabled. An attacker can pass specially crafted URL-encoded backslashes, bypassing path validation. This can lead to...

CVE-2026-63303

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-63303

Summary: CVE-2026-63303 describes a path traversal in Quick.CMS where the URI path component does not normalize ../ sequences, allowing an authenticated admin to read files in the webroot’s sibling directory. Affected product is Quick.CMS (component: URI handling). Underlying cause: failure to no...

CVE-2026-63303

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

EUVD-2026-49756

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-63303 Path Traversal in Quick.CMS

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

Security update for apache-sshd

This update for apache-sshd fixes the following issues: Update to upstream version 2.19.0. Security issues fixed: CVE-2026-56452: remote users can use SCP to send filenames that lead to arbitrary file writes due to a path traversal issue in the sshd-scp component of Apache MINA SSHD. bsc1272158...

CVE-2026-16585

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...