PT-2026-110349

Name of the Vulnerable Software and Affected Versions bleenco abstruse versions prior to 2.1.1 Description A path traversal issue exists in the Cache Endpoint component within the file server/api/worker/download cache.go. The flaw occurs in the filepath.Join function when processing the File...

evilarc

evilarc Zweck Mit evilarc können Sie eine ZIP-Datei erstellen, die Dateien mit Directory-Traversal-Zeichen in ihrem eingebetteten Pfad enthält. Die meisten kommerziellen ZIP-Programme winzip usw. verhindern die Extraktion von ZIP-Dateien, deren eingebettete Dateien Pfade mit...

CVE-2026-108603

slide-maker through 5.8.0 contains a path traversal vulnerability in generateimagesopenai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked...

CVE-2026-108603 slide-maker through 5.8.0 Path Traversal via generate_images_openai.py

slide-maker through 5.8.0 contains a path traversal vulnerability in generateimagesopenai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked...

CVE-2026-108603 slide-maker through 5.8.0 Path Traversal via generate_images_openai.py

slide-maker through 5.8.0 contains a path traversal vulnerability in generateimagesopenai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked...

CVE-2026-108603 slide-maker through 5.8.0 Path Traversal via generate_images_openai.py

slide-maker through 5.8.0 contains a path traversal vulnerability in generateimagesopenai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked...

CVE-2026-108603

slide-maker through 5.8.0 contains a path traversal vulnerability in generateimagesopenai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked...

CVE-2026-108603

The slide-maker software (versions through 5.8.0 ) contains a path traversal vulnerability in the generate_images_openai.py component. The root cause is the application's failure to sanitize manifest-supplied filenames, allowing attackers to use ../ sequences or symlinked filenames to write image...

EUVD-2026-96429

slide-maker through 5.8.0 contains a path traversal vulnerability in generateimagesopenai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked...

CVE-2026-108597

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-105892

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13...

CVE-2026-108597 Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-108597

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

EUVD-2026-96395

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-108597

The Cohere Python SDK versions 5.11.0 through 7.2.0 are vulnerable to a path traversal (tar slip) vulnerability within the _s3_models_dir_to_tarfile function. The root cause is the use of unvalidated tarfile.extractall() calls, which allows an attacker who can write model archives to the victim's...

CVE-2026-108597 Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-108597 Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-105892 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13...

EUVD-2026-96406

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13...

CVE-2026-105892 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13...