EUVD-2026-33305

WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded...

CVE-2026-46337

WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded...

UBUNTU-CVE-2026-49128

Music Player Daemon MPD before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without...

CVE-2026-49128 Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling

Music Player Daemon MPD before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without...

CVE-2026-42028: Improper Limitation of a Pathname to a Restricted Directory

novaGallery is a php image gallery. Prior to version 2.1.1, a path traversal vulnerability has been identified in novaGallery. This allows unauthenticated users to read image files outside the intended gallery root directory. This issue has been patched in version 2.1.1...

CVE-2025-29843

A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files...

CVE-2025-29843

A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files...

CVE-2025-29843

A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files...

CVE-2025-29843: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files...

Linux Distros Unpatched Vulnerability : CVE-2025-32807

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png and .svg or .xpm for...

CVE-2015-8488: Exposure of Sensitive Information to an Unauthorized Actor

Cybozu Office 10.3.0 allows remote attackers to read image files via a crafted e-mail message, a different vulnerability than CVE-2015-8487...

PT-2016-3913

Name of the Vulnerable Software and Affected Versions Cybozu Office version 10.3.0 Description The issue allows remote attackers to read image files by sending a crafted e-mail message. Recommendations For Cybozu Office version 10.3.0, at the moment, there is no information about a newer version...

CVE-2013-3654

Directory traversal vulnerability in LOCKON EC-CUBE 2.12.0 through 2.12.4 allows remote attackers to read arbitrary image files via vectors related to data/class/SCCheckError.php and data/class/SCFormParam.php, a different vulnerability than CVE-2013-3650...

PT-2013-4543

Name of the Vulnerable Software and Affected Versions LOCKON EC-CUBE versions prior to 2.12.5 Description A directory traversal issue exists in the lfCheckFileName function, allowing remote attackers to read arbitrary image files. This is achieved through vectors involving the image parameter to...

CVE-2007-4847: Undefined Security Weakness

Google Picasa allows remote attackers to read image files stored by Picasa via unspecified vectors involving a picasa:// URI. NOTE: this information is based upon a vague pre-advisory...

PT-2007-1381 · Unknown · Ezonlinegallery

Name of the Vulnerable Software and Affected Versions: EZOnlineGallery versions 1.3 and earlier Description: The issue allows remote attackers to determine directory existence and read arbitrary image files due to multiple directory traversal vulnerabilities. This can be achieved by using a ".." ...