144236 matches found
EUVD-2026-86474
Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...
EUVD-2026-86475
Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...
PT-2026-106309
Summary The /home/file path:path endpoint in web client.py serves static files by directly concatenating the user-supplied file path with the home directory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequenc...
BuildKit Path Traversal
The vulnerability of the BuildKit container-building software is related to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow a perpetrator to gain unauthorized access to protected information...
Glances secure_popen Command Execution
The vulnerability of the securepopen function in the Glances monitoring tool glances/secure.py is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...
PT-2026-99065
Name of the Vulnerable Software and Affected Versions GLPI versions 10.0.0 through 10.0.25 GLPI versions prior to 11.0.8 Description Insufficient path validation in the profile-picture update flow allows any logged-in user to request the deletion of an arbitrary file hosted on the server selected...
CVE-2026-84882: Improper Limitation of a Pathname to a Restricted Directory
IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system...
CVE-2026-100419: Improper Link Resolution Before File Access
gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwriteexisting enabled, attackers can craft malicious repository trees...
CVE-2026-100419: Improper Link Resolution Before File Access
gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwriteexisting enabled, attackers can craft malicious repository trees...
CVE-2026-100372: Improper Limitation of a Pathname to a Restricted Directory
ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...
CVE-2026-63006: Improper Limitation of a Pathname to a Restricted Directory
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected...
CVE-2026-48482: Improper Limitation of a Pathname to a Restricted Directory
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location...
CVE-2026-91841: Improper Neutralization of CRLF Sequences
A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege...
CVE-2026-61525: Improper Limitation of a Pathname to a Restricted Directory
Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to...
CVE-2026-47679: Improper Limitation of a Pathname to a Restricted Directory
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...
CVE-2026-97566: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADDADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADDADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not te...
PT-2026-99020
rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...
CVE-2026-97994
In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...
PT-2026-99100
Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3-197 Description A path traversal issue exists in the admin template editor. Authenticated administrators with manage template access permission can use directory traversal sequences in the folder parameter to...
VulnCheck KEV: CVE-2026-42608
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sessionid passed as form-flash-id in POST requests, an unauthenticated attacker can traverse the filesystem to create arbitrary directories an...