CVE-2026-60009

In Eclipse Theia up to 1.73.1, the backend @theia/filesystem binds POST /file-upload in every filesystem-enabled deployment. The handler uses an attacker-supplied absolute path from the multipart uri field and calls fs.move(tmp, target, { overwrite: true }) with no workspace confinement and no au...

PT-2026-41544

Name of the Vulnerable Software and Affected Versions AstrBotDevs AstrBot versions prior to 4.23.6 Description A path traversal issue exists in the File Upload Handler component within the post file function of the astrbot/dashboard/routes/chat.py file. This occurs when the filename argument is...