CVE-2026-47679: Improper Limitation of a Pathname to a Restricted Directory

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...

Linux Distros Unpatched Vulnerability : CVE-2026-100419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree...

Foxit PDF Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

GHSA-6CR4-CCF3-X7H4 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

Summary Missing path validation in confluenceuploadattachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call. --- Details...

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

Summary Missing path validation in confluenceuploadattachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call. --- Details...

GHSA-CC5H-2PWP-PVCC MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

Summary In the documented multi-user HTTP deployment --transport streamable-http with global operator Atlassian credentials, sooperset/mcp-atlassian exposes all tools to unauthenticated network clients, and the uploadattachment tool reads an attacker-supplied filepath with no path validation...

CVE-2026-88624

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

CVE-2025-1281 BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uxcbremovelayoutajax and uxcbtoolsexportajax functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with...

CVE-2026-88624

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

EUVD-2026-84856

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

CVE-2026-88624: Improper Limitation of a Pathname to a Restricted Directory

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

CVE-2026-88624

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

PT-2026-96655

Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description Insufficient file path validation in the ux cb remove layout ajax and ux cb tools export ajax functions allows authenticated attackers with Subscriber-level access and above to delete...

PT-2026-96950

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Missing path validation in the confluence upload attachment function allows an authenticated client to read arbitrary files from the server filesystem and exfiltrate their contents to a...

CVE-2026-88624

The openCode software (version v1.18.26 ) is vulnerable to a security flaw due to missing path validation in the Worktree.remove component. An attacker can exploit this by providing a crafted payload to perform arbitrary recursive directory deletion . The vulnerability carries a CRITICAL severity...

CVE-2026-86861

A flaw was found in pgAdmin 4. The File Manager's savefile endpoint, used for saving files from the Query Tool and ERD, did not properly handle symbolic links. An authenticated user with existing filesystem access to the pgAdmin host or a shared storage backend could exploit a timing window to...

PT-2026-94375

Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.27.3 Description Authenticated attackers can read arbitrary files by exploiting missing path validation. By providing absolute file paths in the file path parameter, users with valid access tokens can access any fil...

CVE-2026-76553

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

EUVD-2026-80178

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

CVE-2026-78088

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...