CVE-2026-81547: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal...

CVE-2026-77825: Improper Limitation of a Pathname to a Restricted Directory

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

CVE-2026-97360: Missing Authorization

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...

CVE-2026-19532: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: from 2.3.2 before 2.3.4-1124...

CVE-2026-78312: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-82077: Improper Limitation of a Pathname to a Restricted Directory

An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings...

CVE-2026-88843: Improper Limitation of a Pathname to a Restricted Directory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...

CVE-2026-96898: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument pathtype results in path traversal. It is possible to launch the atta...

CVE-2026-96884: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-97636: Authorization Bypass Through User-Controlled Key

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...

CVE-2026-85491: Incomplete Comparison with Missing Factors

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

PT-2026-97700

Name of the Vulnerable Software and Affected Versions ShopXO versions prior to 2.2.8 Description A path traversal issue exists in the Ueditor Upload Interface component within the config/ueditor.php file. A remote attacker can exploit this by manipulating the path type argument, allowing them to...

PT-2026-98206

Name of the Vulnerable Software and Affected Versions volotat Anagnorisis versions prior to 0.4.3 Description A path traversal issue exists that can be triggered remotely. The flaw is located within the get file content, save file content, move files, and start streaming functions of the page.htm...

PT-2026-97806

Name of the Vulnerable Software and Affected Versions HFS2 versions 2.4.0 and earlier Description An unauthenticated arbitrary file access issue exists due to a lack of an authorization model in the macro dispatcher and a failure in the path resolver to confine absolute paths. This allows...

PT-2026-97860

Name of the Vulnerable Software and Affected Versions LaSuite Doc versions 4.8.2 through 5.3.x Description An issue exists in the collaborative note taking, wiki, and documentation platform where the endpoint "/api/v1.0/documents/search/" accepts sequential seven-digit document paths to scope...

PT-2026-98257

Name of the Vulnerable Software and Affected Versions Rapid7 Insight Agent affected versions not specified Description An uncontrolled search path element in InsightVM assessment content on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM. This occurs because a chec...

PT-2026-98237

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.80.1 Description The public avatar and logo image endpoint allows an unauthenticated attacker to provide controlled fileName path segments. Because these segments are resolved against local storage without being...

PT-2026-98278

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The HTTP server in the firmware contains a path traversal flaw. This allows an attacker connected to the device WiFi network to send a specially crafted request to access files on the...

PT-2026-98259

Name of the Vulnerable Software and Affected Versions ruoyi-vue-pro versions prior to 2026.09 Description A path traversal issue exists in the File Upload component. This occurs within the getOriginalFilename function located in the...

PT-2026-97694

Name of the Vulnerable Software and Affected Versions MantisZip versions prior to 0.4.6 Description A path traversal flaw exists in the Preview component within the MainWindow.UI.cs file. The issue occurs in the Path.Combine function, allowing a remote attacker to manipulate file paths to access...