CVE-2026-108790: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be...

CVE-2026-108980: Path Traversal: '../filedir'

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing...

CVE-2026-82101: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...

PT-2026-110429

Name of the Vulnerable Software and Affected Versions westboy CicadasCMS versions prior to 2431154dac8d0735e04f1fd2a3c3556668fc8dab Description An issue exists in the Template Management component within the TemplateController.input function of the /system/cms/template/input file. Remote...

PT-2026-110617

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.1 Description An absolute path traversal issue exists in the Smarty template handling. The checkTemplate function fails to reject absolute paths, although it restricts relative directory traversal sequences like ../. This...

PT-2026-111099

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable...

PT-2026-110917

🚨 CVE-2021-48011 Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI decodes before path.join in serveStaticFile and...

PT-2026-110461

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data...

CVE-2026-109247: Improper Limitation of a Pathname to a Restricted Directory

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-108899: Improper Authorization

A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack...

PT-2026-110664

FreeRDP before 3.32.0 contains a path traversal vulnerability in convert filedescriptors to file list in winpr/libwinpr/clipboard/synthetic file.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '...

PT-2026-110495

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...

CVE-2026-109309: Improper Limitation of a Pathname to a Restricted Directory

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

PT-2026-111113

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan send in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the net buf; the BT ATT OP SIGNED WRITE CMD branch...

PT-2026-111007

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction...

Important: rsyslog

Issue Overview: rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a valu...

PT-2026-111014

Name of the Vulnerable Software and Affected Versions Hugo versions 0.84.0 through 0.166.0 Description A path traversal issue exists where malicious themes or modules can read files outside the project root. This occurs through the ESBuild fallback resolver used in js.Build, js.Batch, and...

PT-2026-121719

TuxCare rebuilt path-to-regexp to address 2 CVEs. Fixed in 0.1.7-tuxcare.1...

Amazon Linux 2 : rust (ALAS-2026-3971)

The version of rust installed on the remote host is prior to 1.98.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3971 advisory. gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attacker...

CVE-2026-103060: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...