OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

Summary Alist's offline-download feature POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL, fetches it, and saves the bytes under a per-task temp directory before transferring to the user's destination storage. The temp filename is taken from the response's...

CVE-2026-75602

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

Exploit for CVE-2026-75604

CVE-2026-75604 - Next.js path traversal → RCE Windows · rese...

CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

EUVD-2026-70550

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-75602

OpenList (a file list program supporting multiple storage backends) versions prior to 4.2.3 are affected by an authenticated path traversal vulnerability in the offline-download feature. When the SimpleHttp tool is used via POST /api/fs/add_offline_download, an attacker-controlled Content-Disposi...

CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

GHSA-GW25-M53R-QH88 SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

Summary SiYuan's /export/ file handler was hardened against export disclosure issue 12213 by adding an IsSubPathexportBaseDir, fullPath check and an IsSensitivePath check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit...

CVE-2026-83557

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to control object creation by exploiting an incomplete list of restricted types in the DefaultBaseTypeLimitingValidator. By crafting malicious input, an attacker can cause the application to create arbitrary file...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in its REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation, allowing an unauthenticat...

EUVD-2026-70479

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

CVE-2026-65810

A flaw was found in .NET Framework. This vulnerability, caused by a relative path traversal, allows an unauthorized local attacker to elevate their privileges. By exploiting this flaw, an attacker can gain higher access rights than intended, potentially leading to unauthorized actions on the...

CVE-2026-85160

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...

CVE-2026-85124

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

CVE-2026-78069

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

htb-labs-nexus

🏴‍☠️ HTB Labs - Nexus English 🇺🇸 | Español 🇪🇸 English | Español 📋 Overview Nexus is an Easy-difficulty Linux machine from Hack The Box that demonstrates a multi-stage attack chain involving virtual host enumeration, exposed credentials, vulnerable web application functionality, remote code...

EUVD-2026-70445

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

CVE-2026-78069 Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

CVE-2026-78069

CVE-2026-78069 affects the J2Store Joomla extension (by j2commerce.com), versions 1.0.0–3.3.21, 4.0.0–4.0.21, and 4.1.0–4.1.6 . The root cause is a missing authorization check in the J2StoreControllerApps appTask delegation path, which instantiates app-plugin controllers with no deliberate ACL ch...