FreeBSD: VID-3f11e437-b7cd-11f1-a883-2cf05da270f3 (CVE-2026-84739): Gitlab -- vulnerabilities

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

Important: composer

Issue Overview: Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the permissions of a file outside that package's own directory and to register a...

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

PT-2026-102729

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

PT-2026-102467

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...

PT-2026-102881

An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of...

PT-2026-102802

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...

SiYuan 3.8.3 MCP File Operations Path Traversal

SiYuan versions 3.8.0 through 3.8.3 contain an incorrect authorization issue in recursive MCP file operations. An authenticated administrator can bypass the sensitive-path guard to read protected descendants or overwrite them through archive extraction...

PT-2026-102779

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...

PT-2026-102831

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

NoMachine Local Privilege Escalation

NoMachine contains an external control of file path vulnerability that allows local attackers with low-privileged code execution to escalate privileges and execute arbitrary code as root...

PT-2026-108525

Security vulnerability affects the elasticsearch package. Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1...

PT-2026-102664

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host for Linux versions prior to 15.82 Description An improper path validation issue exists in the Cloud Session Recording CSR functionality. A local authenticated attacker can exploit a race condition during path...

PT-2026-102946

Name of the Vulnerable Software and Affected Versions Fireware OS affected versions not specified Description A path traversal issue in the WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted managemen...

PT-2026-102446

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.18.4 Description A path traversal issue exists in the way Flatpak handles the files/etc directory during app deployment. This allows a malicious application to empty or replace critical host system files, such as...

PT-2026-109115

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe join function used by send from directory can allow a NUL: special-device path because safe join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application ru...

PT-2026-102634

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.1.9 Description The safe join function used by send from directory fails to remove empty NTFS Alternate Data Stream ADS markers before checking Windows device names. On Windows systems using NTFS, if an application...

CVE-2026-96440: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...

CVE-2026-91012: Improper Limitation of a Pathname to a Restricted Directory

org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...

CVE-2026-97024: UNIX Symbolic Link (Symlink) Following

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...