1208 matches found
CVE-2026-47078
The CVE affects Erlang/OTP stdlib’s zip handling (lib/stdlib/src/zip.erl). zip:unzip/1,2 and zip:extract/1,2 validate entry paths with zip:check_dir_level/2, which tracks directory depth; while .. can decrement the counter and normal components increment it, a path like ../x/y may become negative...
CVE-2026-47078 Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...
CVE-2026-47078 Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...
EEF-CVE-2026-47078 Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
Summary Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check\dir\level/2, which tracks directory depth as a running...
PT-2026-64979
Name of the Vulnerable Software and Affected Versions Erlang OTP versions 27.1 through 27.3.4.14 Erlang OTP versions 28.0 through 28.5.0.3 Erlang OTP versions 29.0 through 29.0.3 Description A relative path traversal issue in the stdlib zip module allows writing files outside the intended...
pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
EUVD-2026-45954
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
CVE-2026-12701 Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
CVE-2026-12701
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
CVE-2026-12701
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
The vulnerability of the automatic software update mechanism of the ViPNet Client 4 system, related to deficiencies in handling relative paths, allows a malicious intruder from a neighboring trusted network to compromise the integrity of the operating environment. This vulnerability enables the intruder to gain privileges in the attacked node’s system and execute arbitrary code using a specially crafted update package sent from a compromised network node with the role of a network management center.
The vulnerability of the automatic software update mechanism of the ViPNet Client 4 lies in the deficiencies in the handling of relative paths. Exploiting this vulnerability can allow a perpetrator operating from a neighboring trusted network to compromise the integrity of the operating...
CVE-2026-56196
Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a network...
CVE-2026-50454
Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally...
CVE-2026-50426
Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network...