EUVD-2026-68816

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...

pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

Summary When resolving a package, pnpm uses the resolved manifest name as a raw path segment for the isolated-linker import target. A tarball dependency whose package.json name is a scoped path traversal @x/../../…/ is therefore extracted outside nodemodules, to an attacker-chosen absolute path,...

EUVD-2026-68883

pnpm: A tarball dependency's manifest name escapes nodemodules → arbitrary file write/overwrite on install...

EUVD-2026-67076

NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots...

NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots

Summary Several model-artifact APIs still treat caller-controlled model paths as ordinary filenames even when NLTK path security is enforced. The same outside-root paths are rejected by guarded helpers, but these public read and write flows still use raw file APIs. Details - Vulnerability type:...

GHSA-8MGP-746C-J5XP NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots

Summary Several model-artifact APIs still treat caller-controlled model paths as ordinary filenames even when NLTK path security is enforced. The same outside-root paths are rejected by guarded helpers, but these public read and write flows still use raw file APIs. Details - Vulnerability type:...

CVE-2026-59683

A flaw was found in the OpenRGB network SDK protocol. Profile names received over the network are used directly in filesystem path construction without sanitization, allowing unauthenticated remote attackers to write attacker-controlled data to arbitrary filesystem paths via path traversal. By...

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

EUVD-2026-42744

Siyuan: Authenticated path traversal in /snippets/ static handler serveSnippets leaks conf/conf.json secrets and siyuan.db...

Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

Reporter: Cavan Loughran, Celvex Group Inc. Summary ------- The /snippets/filepath route handler serveSnippets in kernel/server/serve.go performs a bare filepath.Joinutil.SnippetsPath, filePath on the single-decoded c.Request.URL.Path and serves the result with c.File, with NO IsSubPath containme...

GHSA-275H-V5H9-VR82 Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

Reporter: Cavan Loughran, Celvex Group Inc. Summary ------- The /snippets/filepath route handler serveSnippets in kernel/server/serve.go performs a bare filepath.Joinutil.SnippetsPath, filePath on the single-decoded c.Request.URL.Path and serves the result with c.File, with NO IsSubPath containme...

CVE-2026-78657

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...

EUVD-2026-69872

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...

CVE-2026-78657 SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...

CVE-2026-78657

The SigmaForms Pro – AI Generated Forms WordPress plugin (versions ≤ 1.4.11) is affected by an unauthenticated arbitrary file deletion vulnerability rooted in insufficient file path validation in the delete_submission_files function. An attacker submits a malicious path traversal URL via the plug...

CVE-2026-84442

A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally...

CVE-2026-14982

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

CVE-2026-84441

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-84442 MapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt getDataColumn path traversal

A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally...

EUVD-2026-69822

A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally...