PT-2026-103822

Name of the Vulnerable Software and Affected Versions Ghost versions 6.14.0 through 6.26.x Description The ImageSize service contains a path traversal issue where insufficient input validation of user-supplied file paths allows authenticated staff users to access local files located outside the...

PT-2026-103787

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0 Description A path traversal issue exists in the signed resume URL generation for Send-and-Wait approvals. Users with workflow creation permissions can forge...

PT-2026-103662

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schema name resul...

PT-2026-103911

Name of the Vulnerable Software and Affected Versions Prime Mover plugin for WordPress versions prior to 2.2.1 Description A Zip Slip path traversal issue exists during the migration ZIP import process. Authenticated administrators can write arbitrary files outside the intended extraction directo...

PT-2026-103921

The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...

CVE-2026-51883

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...

CVE-2026-51874

In Devika v1.0, the Patcher Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace...

PT-2026-104040

Name of the Vulnerable Software and Affected Versions Langchain-Chatchat version 0.3.0 Description The OpenAI-compatible file upload endpoint /v1/files is susceptible to path traversal, a condition where an attacker can access or write files outside the intended directory. By crafting malicious...

PT-2026-104034

Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description The save code to project function within the Feature Agent contains a path traversal flaw. This issue allows attackers to write files outside the designated project workspace, which could lead to a full server...

PT-2026-105805

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

PT-2026-105172

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No safe relative path / traversal check is applied ...

PT-2026-105583

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge...

CVE-2026-51875

In Devika v1.0, the Feature Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server...

PT-2026-105842

Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validate safe path is called without an explicit base dir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...

CVE-2026-51880: Improper Limitation of a Pathname to a Restricted Directory

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...

PT-2026-105887

Impact The Classic portlet plone.app.portlets.portlets.classic used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet...

PT-2026-104054

Name of the Vulnerable Software and Affected Versions Office-PowerPoint-MCP-Server versions prior to 2.0.8 Description A path traversal issue allows callers to read and write files outside the intended working directory by using absolute paths or ../ sequences. An attacker can use prompt injectio...

PT-2026-103682

A path traversal ZIP Slip vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code...

CVE-2026-51875

In Devika v1.0 , a path traversal vulnerability exists within the Feature Agent save_code_to_project function. This flaw allows an attacker to write files outside the intended project workspace, which could potentially compromise the entire server. While a proof of concept is mentioned in the met...

CVE-2026-76147: Missing Authorization

A path traversal ZIP Slip vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code...