EUVD-2026-39104

chrome-devtools-mcp: validatePath does not canonicalize symlinks before enforcing roots...

Astra Linux – Vulnerability in Thunderbird

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or the connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking...

CVE-2026-55747 PocketFlow - Path Traversal in pocketflow-coding-agent Cookbook Example File Tools

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.joinworkdir, p wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this...

CVE-2026-69086

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish...

CVE-2026-54706

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionsharecli/web/sendbasemode.py through SendBaseModeWeb.setfileinfo and...

DEBIAN-CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

UBUNTU-CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-55554 Dompdf: Chroot Validation Bypass

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-63303 Path Traversal in Quick.CMS

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-43763

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to read files outside of its sandbox...

CVE-2026-43821

CVE-2026-43821 pertains to an access issue in Apple Safari/WebKit where an app may read files outside its sandbox. The vulnerability is addressed in Safari 26.6 and corresponding OS updates (iOS/iPadOS/macOS Tahoe 26.6, tvOS, visionOS, watchOS 26.6). The NVD/NCSC entries describe improved access ...

CVE-2026-43821

An access issue was addressed with improved access restrictions. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to read files outside of its sandbox...

GHSA-9XWG-3R6F-JCX2 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured basepath with os.path.normpath and opens the result directly, with no check that the resolved path stays inside basepath. A src containing ../ sequences, or an...

CVE-2026-65754 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension

Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...

Path Traversal

phpMyFAQ is vulnerable to Path Traversal. The vulnerability is due to improper path validation during PDF generation, where attacker-controlled image paths are passed to filegetcontents without canonicalization or directory containment checks, allowing authenticated users to read files outside th...

CVE-2026-47429

Vitest (a Vite-based testing framework) is affected by CVE-2026-47429 due to an incorrect isFileServingAllowed check in the Vitest UI/API server on Windows for the path /vitest_attachment . This allows a ?..\ path traversal to read files outside the project, and could enable arbitrary script exec...

CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

CVE-2026-14903

Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root...

CVE-2026-60088

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outsidesecret.txt or absolute paths in project command files to exfiltrate process-readable...

CVE-2026-60088

CVE-2026-60088 affects PraisonAI prior to 4.6.78. The issue is a path traversal flaw in custom command templates, where file paths are not validated, allowing an attacker to read files outside the workspace (e.g., @../outside_secret.txt or absolute paths) and exfiltrate process-readable files int...