CVE-2026-53535 Activepieces: Arbitrary file write in git-sync via path traversal and symlinks

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-53535 Activepieces: Arbitrary file write in git-sync via path traversal and symlinks

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-46338 PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

CVE-2026-46338

PyMdown Extensions (pymdownx.snippets) contains a regression that reintroduces a sibling-prefix path traversal when restrict_base_path is True. From 10.0.1 through 10.21.2, get_snippet_path uses a string-prefix check (filename.startswith(base)) that can read files from sibling paths sharing the s...

CVE-2026-46338 PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

CVE-2026-46687

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from apicontroller.php without validation, and logcontroller.php later checks fileexists and calls include View::getView$template, allowing an...

CVE-2026-46336

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/modelfile.rb uses the user-controlled...

CVE-2025-45870

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion LFI in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories...

CVE-2026-46336

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/modelfile.rb uses the user-controlled...

CVE-2026-46336 Manyfold: Authenticated Path Traversal via File Rename

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/modelfile.rb uses the user-controlled...

CVE-2026-46336 Manyfold: Authenticated Path Traversal via File Rename

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/modelfile.rb uses the user-controlled...

CVE-2026-46336

CVE-2026-46336 affects Manyfold (0.96.0–0.140.0). Authenticated users can rename uploaded files, and due to unsanitized user-controlled filenames in app/models/model_file.rb used with File.join(model.path, filename), path traversal may move/write files outside the library directory. Impact: poten...

CVE-2026-46687

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from apicontroller.php without validation, and logcontroller.php later checks fileexists and calls include View::getView$template, allowing an...

CVE-2026-46687

CVE-2026-46687 affects Emlog prior to or including 2.6.13. The flaw stems from an unvalidated path-traversal template parameter used by api_controller.php and a subsequent include in View::getView($template) after a file_exists check in log_controller.php. This enables an authenticated author to ...

EUVD-2026-44986

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from apicontroller.php without validation, and logcontroller.php later checks fileexists and calls include View::getView$template, allowing an...

EUVD-2026-44976

A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code...

CVE-2026-13103

A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code...

CVE-2026-13103

Lenovo App Store (Chinese market) contains a path traversal vulnerability allowing a local authenticated user to execute arbitrary code. The issue affects the package/component handling file paths, with impact on confidentiality, integrity, and availability reported as high. CVSS: from the report...

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests...

CVE-2026-59866

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when kiota generate ra...