PT-2026-89686

Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...

PT-2026-89682

Summary Multiple backends, when given a specially crafted object to copy, can escape the backend confinement. | Backend | Keep/Close | Per-backend severity | |---|---|---| | sftp | Medium | Real filesystem escape, fires under default encoding. | | smb | Low-Medium | Escapes to a different SMB sha...

PT-2026-89477

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

Next.js Unauthenticated Remote Code Execution

This Metasploit module exploits a remote code execution vulnerability in Next.js applications hosted on Windows servers. Specifically crafted requests can execute arbitrary code on the target server. The affected versions include releases from 13.4.0 up to 15.5.24, and 16.0.0 up to 16.3.3,...

GHSA-G72F-JW3W-MGH7 @openhop/server: Path Traversal in Flow ID File Operations

Path Traversal in Flow ID File Operations Summary @openhop/server passes unsanitized HTTP route parameters directly to path.join when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary .yaml files accessible to the OpenHop...

@openhop/server: Path Traversal in Flow ID File Operations

Path Traversal in Flow ID File Operations Summary @openhop/server passes unsanitized HTTP route parameters directly to path.join when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary .yaml files accessible to the OpenHop...

CVE-2026-30480

CVE-2026-30480: LibreNMS 로컬 파일 포함LFI 취약점 - 경로 탐색Path Traversal을 통한 공격 개요 LibreNMS의 NFSen 모듈에 로컬 파일 포함LFI 취약점이 존재합니다. 인증된 공격자는 경로 탐색 시퀀스를 악용하여 서버 파일시스템의 임의의 PHP 파일을 포함시킬 수 있습니다...

CVE-2026-9335-keras-hdf5-externallink

CVE-2026-9335 — Keras HDF5 ExternalLink によるローカルファイル内容の開示 2つの公開Keras API — keras.saving.KerasFileEditor と keras.saving.loadweights / model.loadweights — は、リンクタイプのチェックを行わずに でHDF5グループメンバーを読み取ります。h5py はインデックス時に / をするため、攻撃者が提供した のみを含む 、、または ファイルによって、 Keras はの内容を読み取ることになります。...

Apache-CVE-2021-41773

CVE-2021-41773 Apache HTTP Server Path Traversal Contributors 이희수@lheeeesoo Apache HTTP Server 2.4.49에는 URL 경로를 정규화하는 과정에서 인코딩된 상위 경로를 제대로 차단하지 못하는 취약점이 존재한다. 공격자는 .%2e와 같은 값을 이용하여 웹 서버가 공개하도록 설정한 디렉터리 밖으로 이동할 수 있다. 외부 디렉터리에 대한 접근이 허용된 환경에서는 서버 내부 파일이 노출될 수 있으며, CGI 기능이 활성화된 경우에는 시스템 셸을 실행하여 원격 명...

CVE-2026-88069

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

CVE-2026-71805

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...

CVE-2026-15913

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

CVE-2025-4123-Exploit

CVE-2025-4123 PoC 소규모 개념 증명 도구 — 대상에 특정 페이로드를 전송하고 301/302 리디렉션 응답을 확인하여 Location 헤더를 보고합니다. 이 저장소는 교육/연구 목적으로만 제공됩니다. 책임 있는 공개 정책을 준수하세요. 아래는 사용 및 빌드 지침입니다. 요약 이 도구는 다음 페이로드를 추가하여 도메인에 요청을 보내며, 서버가 301Moved Permanently 또는 302Found로 응답하면 Location 헤더를 확인하여 잠재적 취약점을 탐지합니다. 페이로드:...

CVE-2025-29927-NextJS

📦 Next.js CVE-2025-29927 - Доказательство концепции Этот репозиторий содержит минимальное доказательство концепции PoC для эксплуатации CVE-2025-29927 — уязвимости высокой степени серьёзности, затрагивающей определённые версии Next.js, которая позволяет несанкционированный доступ к внутренним...

CVE-2026-88069

Pandora (a file-analysis platform) contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths are not validated to ensure the destination remains within the intended extraction directory, allo...

CVE-2026-88069 Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

CVE-2026-88069 Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

By-Poloss..-..CVE-2026-18080

CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite = 1.17.7 인증 없이 가능한 임의 파일 업로드 — CRM 이메일 연결 IMAP 첨부 파일 경로 탐색을 통한 RCE...

cve-2021-41773-exploration

Обзор CVE-2021-41773 — это уязвимость обхода пути, обнаруженная в Apache HTTP Server 2.4.49 в октябре 2021 года. Основной причиной была ошибка в нормализации последовательностей точек, оканчивающихся в URL, перед проверкой того, остаётся ли запрошенный путь в пределах корневой директории...

CVE-2026-15913

Fortra's GoAnywhere MFT versions prior to 7.10.2 are affected by a path traversal vulnerability in the /attachRemoteFiles endpoint. An authenticated Web User holding both Secure Folders and Secure Mail permissions can escape their sandboxed home directory, enabling arbitrary file read . The CNA-a...