ROS-20261001-73-0020

The vulnerability in Go-Git relates to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

CVE-2026-103290: Path Traversal: '.../...//'

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server...

PT-2026-105558

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection in github.com/rabbitmq/amqp091-go...

PT-2026-103911

Name of the Vulnerable Software and Affected Versions Prime Mover plugin for WordPress versions prior to 2.2.1 Description A Zip Slip path traversal issue exists during the migration ZIP import process. Authenticated administrators can write arbitrary files outside the intended extraction directo...

PT-2026-103873

Name of the Vulnerable Software and Affected Versions Sharp and Toshiba Tec rebranded multifunction printers affected versions not specified Description An unauthenticated local file inclusion issue exists, allowing remote attackers to read arbitrary files. By manipulating the path parameter in t...

CVE-2026-51874: Improper Limitation of a Pathname to a Restricted Directory

In Devika v1.0, the Patcher Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace...

PT-2026-103788

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0 Description A path traversal issue exists in the Supabase node where the tableId parameter is inserted into request paths without proper validation. This allo...

CVE-2026-79768: Path Equivalence: '/./' (Single Dot Directory)

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

Apache HTTPD: CVE-2026-79768: Path Equivalence: '/./' (Single Dot Directory)

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

PT-2026-103942

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68 Description A path equivalence issue exists in the mod userdir module when configured with an absolute non-wildcard UserDir directive. This flaw involves the use of the /./ single dot directory...

CVE-2026-51883

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...

CVE-2026-104286: Improper Limitation of a Pathname to a Restricted Directory

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on th...

CVE-2026-51882

The Langchain-Chatchat version 0.3.0 contains a path traversal vulnerability in its OpenAI-compatible file upload endpoint, /v1/files. An attacker can craft malicious filenames to write files to arbitrary locations outside the intended openai_files directory. This vulnerability has been exploited...

CVE-2026-51882

The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the openaifiles directory by crafting malicious filenames...

CVE-2026-51882: Improper Limitation of a Pathname to a Restricted Directory

The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the openaifiles directory by crafting malicious filenames...

CVE-2026-103664: Improper Neutralization of Input During Web Page Generation

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-51883

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...

PT-2026-104042

The /knowledge base/upload temp docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory...

PT-2026-104034

Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description The save code to project function within the Feature Agent contains a path traversal flaw. This issue allows attackers to write files outside the designated project workspace, which could lead to a full server...

PT-2026-104038

Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description A path traversal issue exists in the EditFileTool.execute function. A remote caller can use the live tutorbot WebSocket interface to force the tool layer to write or edit absolute paths outside the designate...