OneUptime < 10.0.21 - Path Traversal

OneUptime 10.0.21 contains a path traversal caused by unsanitized componentName parameter in /workflow/docs/:componentName endpoint, letting unauthenticated attackers read arbitrary files from the server filesystem. id: CVE-2026-30958 info: name: OneUptime 10.0.21 - Path Traversal author:...

webp_server_go 0.4.0 - Path Traversal

webpservergo 0.4.0 contains a path traversal caused by insufficient sanitization in file handling, letting attackers read arbitrary files on the server, exploit requires attacker to send crafted requests. id: CVE-2021-46104 info: name: webpservergo 0.4.0 - Path Traversal author: pikpikcu severity...

Mockoon < 9.2.0 - Path Traversal

Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request. id: CVE-2025-59049 info: name: Mockoon 9.2.0 - Path...

EUVD-2026-111595

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the processcheckout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the serve...

PT-2026-127812

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the...

CVE-2026-112612

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...

PT-2026-125271

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.7.2 iOS versions prior to 27.2 iPadOS versions prior to 26.7.2 iPadOS versions prior to 27.2 Description A path handling issue exists due to insufficient validation. An attacker with physical access to a trust-paired...

Linux Distros Unpatched Vulnerability : CVE-2026-115355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences i...

Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h7ww-273w-6cm8. This link is maintained to preserve external references. Original Description Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith (CVE-2026-16725)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith due to a flaw in LangSmith SDK's TracingMiddleware that allows the server into accept a malicious HTTP request, reading a file from its local filesystem and uploading the contents to LangSmith as a trace...

CVE-2022-51022

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory...

CVE-2018-25438

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...

CVE-2022-51022

The YiShaAdmin software (versions 2.2 through 3.1 ) is susceptible to an unauthenticated path traversal vulnerability within the /admin/File/DownloadFile endpoint. The root cause allows attackers to use directory traversal sequences in the filePath parameter to read or delete arbitrary system fil...

CVE-2022-51022 YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory...

EUVD-2022-56066

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory...

CVE-2022-51022 YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory...

CVE-2018-25438 Intermesh Group-Office < 3.5.5 Path Traversal via compress.php

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...

CVE-2018-25438

Intermesh Group-Office versions 3.3.0 before 3.5.5 are vulnerable to an unauthenticated path traversal vulnerability in the compress.php component. The flaw allows remote attackers to read arbitrary files by manipulating the file parameter with ../ sequences, which are appended to the cache path ...

EUVD-2018-21962

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...

CVE-2017-20287 Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrmspotgetjson AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php...