CVE-2025-46822

CVE-2025-46822 Unauthenticated Arbitrary File Read via Absolute Path Description: While Path.resolve method is being used to protect against path traversal I have found that the usage of absolute path successfully read internal files , the endpoint is also not authenticated this means anyone can...

CVE-2026-120324

A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the...

CVE-2026-120324 Aklivity Zilla http-filesystem Binding FileSystemServerFactory Path.resolve path traversal

A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the...

EUVD-2026-115007

A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the...

CVE-2026-120324

A path traversal vulnerability exists in Aklivity Zilla versions up to 1.3.4, 2.4.7, and 2.5.0-rc2. The flaw is located in the Path.resolve function of the FileSystemServerFactory within the http-filesystem Binding component. Manipulation of the params argument allows for remote path traversal. P...

CVE-2026-120324 Aklivity Zilla http-filesystem Binding FileSystemServerFactory Path.resolve path traversal

A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the...

CVE-2026-120324: Aklivity Zilla: A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2

A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the...

PT-2026-135265

A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the...

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Summary launch-editor checked fs.existsSyncfileName before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename...

GHSA-587H-7WMJ-H5PM launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Summary launch-editor checked fs.existsSyncfileName before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename...

CVE-2026-54520 AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

CVE-2026-54520 AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without verifying that the result remains...

Relative Path Traversal

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without...

Path Traversal

art-template is vulnerable to Path Traversal. The vulnerability is due to the template sub-template resolution logic using path.resolveroot, filename without validating that the resolved path remains within the intended root directory, which allows an attacker to use path traversal sequences to...

EUVD-2026-67286

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-81837

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-81837 RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-81837

A path traversal vulnerability affects RooCodeInc Roo-Code versions up to 3.51.1 , specifically in the path.resolve function within src/core/tools/ApplyPatchTool.ts . The flaw allows remote exploitation with low complexity and no required privileges, though user interaction is needed. A proof-of-...

CVE-2026-81837 RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...