EUVD-2026-47867

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...

CVE-2026-16653 boazsegev facil.io Public Folder http.c http_sendfile2 path traversal

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...

CVE-2026-16653

CVE-2026-16653 concerns boazsegev facil.io up to version 0.7.58. The vulnerability affects the Public Folder Handler, specifically the http_sendfile2 function in lib/facil/http/http.c, where manipulation allows path traversal. Remote exploitation is possible and the exploit has been released publ...

PT-2026-64194

Name of the Vulnerable Software and Affected Versions Ne-Lexa php-zip versions prior to 4.0.3 Description A path traversal issue exists in the ZIP Handler component within the ZipFile::extractTo function located in the src/ZipFile.php file. A remote attacker can exploit this by manipulating the...

PT-2026-64188

Name of the Vulnerable Software and Affected Versions Microweber CMS versions prior to 2.0.21 Description A path traversal issue exists in the static file controller. Unauthenticated remote attackers can read arbitrary files, including system files and environment configuration files containing...

EUVD-2026-43647

Eclipse Jetty: Path parameter traversal...

EUVD-2026-42357

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction...

GHSA-5JMR-GCRJ-2C9Q LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive...

CVE-2025-60835

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...

GO-2026-6026 File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) in github.com/filebrowser/filebrowser

File Browser: Archive builder turns backslash filenames into path traversal zip-slip in github.com/filebrowser/filebrowser...

Security update for sssd

This update for sssd fixes the following issues CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation bsc1270709. CVE-2026-14476: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypas...

SUSE-SU-2026:3195-1 Security update for sssd

This update for sssd fixes the following issues - CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation bsc1270709. - CVE-2026-14476: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication...

CVE-2026-13186

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution...

CVE-2026-13189

CVE-2026-13189 affects Progress © Telerik® UI for AJAX (prior to v2026.2.708). The issue stems from insufficient validation of the language parameter in the spell check handler, which may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests. ...

CVE-2026-13189 SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests...

CVE-2026-13186

Progress Telerik UI for AJAX before v2026.2.708 contains a path traversal vulnerability in the file-based persistence storage provider. If the storage key is derived from user input, it can enable attacker-controlled deserialization and remote code execution. Affected product: Progress Telerik UI...

CVE-2026-13186 AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution...

EUVD-2026-47691

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution...

Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 CVSS score: 7.5, a case of unauthenticated path traversal impacting Windmill's "getlogfile" endpoint...

CVE-2026-65600

Traefik versions = v3.6.0 = v3.7.0 = v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator e.g. regex "^/api.", replacement "/$1...