CVE-2025-54387

IPX is an image optimizer (UnJS) vulnerable to a path-prefix bypass in its directory-check logic. Affected versions: 1.3.1 and earlier; 2.0.0-0 to 2.1.0; 3.0.0 to 3.1.0. The vulnerability allows bypassing allowed-directory checks via raw prefix comparison, potentially enabling access to files out...

Claude Code 路径遍历漏洞

Claude Code is an open source proxy coding tool from Anthropic. A path traversal vulnerability exists in versions of Claude Code prior to 0.2.111, which stems from path validation using prefix matching instead of canonical path comparison, which could lead to directory restriction bypass...

IPX 安全漏洞

IPX is an image optimizer open-sourced by UnJS. A security vulnerability exists in IPX versions 1.3.1 and earlier, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, which stems from improper path prefix checking and could lead to path prefix bypass...

GHSA-MM3P-J368-7JCR IPX Allows Path Traversal via Prefix Matching Bypass

Summary The approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison. PoC - setup mkdir /public123 move a png file...

IPX Allows Path Traversal via Prefix Matching Bypass

Summary The approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison. PoC - setup mkdir /public123 move a png file...

Privileged Vault Operator May Execute Code on the Underlying Host

Summary A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. This vulnerability, identified as CVE-2025-6000, is fixed in Vault Community Edition 1.20.1 and...

Security update for php8

This update for php8 fixes the following issues: Version update to 8.3.23: CVE-2025-1220: Fixed null byte termination in hostnames bsc1246167 CVE-2025-1735: Fixed pgsql extension does not check for errors during escaping bsc1246146 CVE-2025-6491: Fixed NULL Pointer Dereference in PHP SOAP Extensi...

BIT-PHP-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server...

CVE-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server...

CVE-2025-6491

CVE-2025-6491 causes a NULL pointer dereference in the PHP SOAP extension when parsing XML data with very large ( >2 GB) XML namespace prefixes, leading to server crashes and potential availability impact. It affects PHP versions across 8.1–8.4 series before patched releases; patched versions ...

CVE-2025-52985

A Use of Incorrect Operator vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to bypass security restrictions. When a firewall filter which is applied to the lo0 or re:mgmt interface references a prefix list with...

CVE-2025-52985 Junos OS Evolved: When a control-plane firewall filter refers to a prefix-list with more than 10 entries it's not matching

A Use of Incorrect Operator vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to bypass security restrictions. When a firewall filter which is applied to the lo0 or re:mgmt interface references a prefix list with...

CVE-2025-52985 Junos OS Evolved: When a control-plane firewall filter refers to a prefix-list with more than 10 entries it's not matching

A Use of Incorrect Operator vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to bypass security restrictions. When a firewall filter which is applied to the lo0 or re:mgmt interface references a prefix list with...

CVE-2025-52985

CVE-2025-52985 describes a Use of Incorrect Operator vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved. When a firewall filter applied to the lo0 or re:mgmt interface references a prefix list and that list contains more than 10 entries, the prefix list may fail to ...

Model Context Protocol Servers 路径遍历漏洞

Model Context Protocol Servers is a large model context protocol server from Model Context Protocol open source. A path traversal vulnerability exists in Model Context Protocol Servers versions prior to 0.6.4 and prior to 2025.7.01, which stems from the fact that prefix matching can lead to...

GHSA-Q66Q-FX2P-7W4M @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling

Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. Thank you to Elad Beber Cymulate for reporting these issues...

OESA-2025-1657 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

CVE-2025-49823

conda Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix userprefix using an eval statement, which executes unsanitized user input as shell code. Although the script runs...

CVE-2025-23171

CVE-2025-23171 affects Versa Director SD-WAN orchestration platform. The vulnerability arises from improper restriction of file upload permissions, where the UI may not reflect upload capability, yet uploads succeed and the system discloses full filenames of temporary files (including UUID prefix...

CVE-2025-49823

conda Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix userprefix using an eval statement, which executes unsanitized user input as shell code. Although the script runs...