CVE-2026-109309: Improper Limitation of a Pathname to a Restricted Directory

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

CVE-2026-74237: Improper Neutralization of Argument Delimiters in a Command

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The webtoolscmd function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An...

PT-2026-57023

Name of the Vulnerable Software and Affected Versions psd-tools versions prior to 1.17.1 Description An issue exists where the SmartObject.save function writes embedded smart objects to a path taken directly from a PSD file without sanitization. This allows an attacker to use absolute paths or...

EUVD-2020-25026

Malware in sbrugna...

CVE-2025-25800

SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the filegetcontents function at adminsafefile.php...

CVE-2024-12806: Path Traversal: '/absolute/pathname/here'

A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file...

TX Text Control .NET Server For ASP.NET Arbitrary File Read / Write

Hej, Let's keep it short ... ===== Intro ===== A "sudo make me a sandwich" security issue has been identified in the TX Text Control .NET Server for ASP.NET1. According to the vendor2, "the most powerful, MS Word compatible document editor that runs in all browsers". Likely all versions are...

GHSA-Q73F-VJC2-3GQF OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file

The import task action in OpenStack Image Service Glance 2015.1.x before 2015.1.2 kilo, when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image...

PT-2021-18730

Name of the Vulnerable Software and Affected Versions PAN-OS versions prior to 8.1.19 PAN-OS versions prior to 9.0.14 PAN-OS versions prior to 9.1.10 Description An OS command argument injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to...

CVE-2018-20792: Improper Limitation of a Pathname to a Restricted Directory

tecrail Responsive FileManager 9.13.4 allows remote attackers to read arbitrary file via path traversal with the path parameter, through the getfile action in ajaxcalls.php...

CVE-2018-3727: Improper Limitation of a Pathname to a Restricted Directory

626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path...

CVE-2018-3724: Improper Limitation of a Pathname to a Restricted Directory

general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path...

CVE-2016-10400

Directory Traversal exists in ATutor before 2.2.2 via the icon parameter to /mods/core/courses/users/createcourse.php. The attacker can read an arbitrary file by visiting getcourseicon.php?id= after the traversal attack...