CVE-2025-29845: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files...

CVE-2025-29846: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages...

CVE-2025-29843: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files...

CVE-2025-66300: Improper Limitation of a Pathname to a Restricted Directory

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files /grav/user/accounts/.yaml, which store hashed user password, 2FA secret, and the password...

EUVD-2025-198183

Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values...

PT-2025-46907

Name of the Vulnerable Software and Affected Versions Astro versions 5.2.0 through 5.15.6 Description A Reflected Cross-Site Scripting XSS vulnerability exists in Astro’s development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScrip...

The vulnerabilities of the cgiauth() and cgiprocess() functions in FortiWeb’s web application firewall allow attackers to enhance their privileges.

The vulnerability of the cgiauth and cgiprocess functions in FortiWeb web applications relates to errors in the mechanism for handling relative pathnames to directories. Exploiting this vulnerability can allow an attacker to enhance their privileges by sending specially crafted HTTP or HTTPS...

Siemens SIMATIC S7-1500 Improper Limitation of a Pathname to a Restricted Directory (CVE-2019-9948)

urllib in Python 2.x through 2.7.16 supports the localfile: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen'localfile:///etc/passwd' call. This plugin only works with Tenable.ot. Please...

CVE-2025-64346 archives: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

archives is a Go library for extracting archives tar, zip, etc.. Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the...

CVE-2025-64184: Improper Limitation of a Pathname to a Restricted Directory

Dosage is a comic strip downloader and archiver. When downloading comic images in versions 3.1 and below, Dosage constructs target file names from different aspects of the remote comic page URL, image URL, page content, etc.. While the basename is properly stripped of directory-traversing...

CVE-2025-64346: Improper Limitation of a Pathname to a Restricted Directory

archives is a Go library for extracting archives tar, zip, etc.. Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the...

CVE-2025-58423: Improper Limitation of a Pathname to a Restricted Directory

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context of the local system account...

youki 安全漏洞

youki is a youki open source implementation of the OCI runtime specification in Rust. A security vulnerability exists in youki version 0.5.6 and earlier, which stems from insufficient validation of the write target by the apparmor handler, which in combination with path substitution during pathna...

The vulnerability of the pam_namespace component of the Linux-PAM authentication module, which operates remotely, allows a hacker to elevate their privileges to the root level.

The vulnerability of the pamnamespace component of the Linux-PAM authentication module is related to incorrect pathname restrictions when processing symbolic links. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level...

CVE-2025-62596 youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects

Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path...

GHSA-VF95-55W6-QMRF youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects

Impact youki’s apparmor handling performs insufficiently strict write-target validation, which—combined with path substitution during pathname resolution—can allow writes to unintended procfs locations. Weak write-target check youki only verifies that the destination lies somewhere under procfs. ...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the applysubstitution function in the bsdtar when used with -s pathname-rewrite rules. An attacker can cause excessive memory allocation leading to application crash by supplying malicious input such as an empty patter...

CVE-2025-12422: Improper Limitation of a Pathname to a Restricted Directory

Vulnerable Upgrade Feature Arbitrary File Write may lead to obtaining super user permissions on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

CVE-2025-58959

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AmentoTech Taskbot taskbot allows Path Traversal.This issue affects Taskbot: from n/a through = 6.4...

WordPress plugin PT Luxa Addons 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...