EUVD-2026-72109

h3 npm package versions = 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic. On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments %2e%2e are passed to decodeURI and decoded to ../ sequences without sanitization. An unauthenticated remote...

CVE-2026-86253 h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments

h3 npm package versions = 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic. On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments %2e%2e are passed to decodeURI and decoded to ../ sequences without sanitization. An unauthenticated remote...

CVE-2026-86253 h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments

h3 npm package versions = 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic. On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments %2e%2e are passed to decodeURI and decoded to ../ sequences without sanitization. An unauthenticated remote...

EUVD-2026-72107

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences e.g. %252e%252e to be decoded to %2e%2e, which survives resolveDotSegments because that function only checks for litera...

CVE-2026-86251 h3 before 1.15.9 Path Traversal via Double Decoding

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences e.g. %252e%252e to be decoded to %2e%2e, which survives resolveDotSegments because that function only checks for litera...

CVE-2026-86251

Versions of h3 before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. The root cause is a double-decoding flaw : a request path containing double-encoded dot sequences (e.g. %252e%252e) decodes to %2e%2e, which survives the resolveDotSegments() function because it only c...

CVE-2026-86251 h3 before 1.15.9 Path Traversal via Double Decoding

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences e.g. %252e%252e to be decoded to %2e%2e, which survives resolveDotSegments because that function only checks for litera...

PT-2026-86528

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can show that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual...

PT-2026-86520

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences e.g. %252e%252e to be decoded to %2e%2e, which survives resolveDotSegments because that function only checks for litera...

CVE-2026-67281 Unauthenticated file read in Mikrotik RouterOS

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences th...

CVE-2026-86189

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode...

EUVD-2026-72010

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode...

CVE-2026-86189

WWBN AVideo is affected by an unauthenticated path traversal vulnerability in notify.ffmpeg.json.php . By supplying a caller-chosen value in the avideoRelativePath parameter, an attacker can write files to arbitrary locations within the application root and its subdirectories. Authentication is b...

CVE-2026-86189 WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode...

rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

...

CVE-2026-14975

The WP File Download WordPress plugin (all versions up to and including 6.3.8 ) is vulnerable to Directory Traversal via the remoteurl parameter, discovered by 0xd4rk5id3 (EnvoraSec). An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta va...

CVE-2026-14975 WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2025-15693 JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal

The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate...

EUVD-2025-210849

The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate...

WordPress JCH Optimize plugin 4.2.1-5.0.0 - Admin+ Path Traversal vulnerability

Admin+ Path Traversal vulnerability discovered by Krugov Artyom in WordPress Plugin JCH Optimize versions 4.2.1-5.0.0...