CVE-2026-104081

KodExplorer versions prior to 4.55 are vulnerable to a path traversal vulnerability located in the unzip_pre_name() function within app/function/helper.function.php. The root cause is a non-recursive str_replace() sanitization pass that can be bypassed using crafted filenames like ....//, combine...

CVE-2026-104081

KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...

CVE-2026-104081: Improper Limitation of a Pathname to a Restricted Directory

KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...

PT-2026-108919

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip pre name function within app/function/helper.function.php, where a single non-recursive str replace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...

CVE-2026-86828

The BackWPup WordPress plugin (versions prior to 5.7.7 ) is vulnerable to a path traversal flaw during the backup restore process. When the plugin's fallback archive library is utilized, it fails to properly restrict the destination path of extracted files. This allows high-privileged users to wr...

CVE-2026-86828 BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...

CVE-2026-86828 BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...

Linux Distros Unpatched Vulnerability : CVE-2017-14719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components. CVE-2017-14719...

FreeBSD : wordpress -- multiple issues (a48d4478-e23f-4085-8ae4-6b3a7b6f016b)

wordpress developers report : Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. Before...

WordPress ZipArchive and PclZip Component Directory Traversal Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports in PHP and MySQL servers to set up a personal blog site . ZipArchive and PclZip components are among the compression/decompression components . A directory traversal...

CVE-2017-14719

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...

UBUNTU-CVE-2017-14719

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...

CVE-2017-14719

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...

Directory traversal

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...

DEBIAN-CVE-2017-14719

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...

CVE-2017-14719

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...

CVE-2017-14719

CVE-2017-14719 : WordPress

CVE-2017-14719

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...

CVE-2017-14719

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components...

PT-2017-13648

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.8.2 Description The issue allows for a directory traversal attack during unzip operations in the ZipArchive and PclZip components. Recommendations For versions prior to 4.8.2, update to version 4.8.2 or later to...