CVE-2025-57749 n8n has a symlink traversal vulnerability in "Read/Write File" node allows access to restricted files

n8n is a workflow automation platform. Before 1.106.0, a symlink traversal vulnerability was discovered in the Read/Write File node in n8n. While the node attempts to restrict access to sensitive directories and files, it does not properly account for symbolic links symlinks. An attacker with the...

n8n symlink traversal vulnerability in "Read/Write File" node allows access to restricted files

Impact A symlink traversal vulnerability was discovered in the Read/Write File node in n8n. While the node attempts to restrict access to sensitive directories and files, it does not properly account for symbolic links symlinks. An attacker with the ability to create symlinks—such as by using the...

GHSA-GGJM-F3G4-RWMM n8n symlink traversal vulnerability in "Read/Write File" node allows access to restricted files

Impact A symlink traversal vulnerability was discovered in the Read/Write File node in n8n. While the node attempts to restrict access to sensitive directories and files, it does not properly account for symbolic links symlinks. An attacker with the ability to create symlinks—such as by using the...

CVE-2025-54927

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system...

CVE-2025-49406

CVE-2025-49406 concerns the WordPress Houzez theme (

CVE-2025-47650

CVE-2025-47650 describes an path traversal in Infility Global (WordPress) affecting versions up to 2.14.7, allowing arbitrary file download. CVSSv3.1 base score 6.5 (Network, Low access, Privileges required: Low; Confidentiality impact: High). Connected sources corroborate: Red Hat and NVD entrie...

CVE-2025-48158

CVE-2025-48158 affects the WordPress plugin BuddyPress XProfile Custom Image Field (vulnerable:

CVE-2025-54021

CVE-2025-54021 affects WordPress plugin Simple File List (versions up to 6.1.14). The vulnerability is caused by an improper limitation of a pathname to a restricted directory (path traversal) , enabling an arbitrary file download. Public details list affected software as Simple File List: from n...

D-Link DIR-818L Injection Vulnerability

The D-Link DIR-818L is a WiFi router from the Chinese company AUO D-Link. The D-Link DIR-818L suffers from an injection vulnerability that originates from a misbehavior in the file /htdocs/cgibin, which can be exploited by an attacker to bypass authentication and access restricted data by injecti...

PT-2025-34074 · Frappé Technologies · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 15.74.2 Frappe versions prior to 14.96.15 Description: Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to via SQL injection...

WordPress plugin Houzez 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-33909 · Unknown · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global versions through 2.14.7 Description: This issue involves an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, in Infility Global. The vulnerability allows Path...

PT-2025-33917 · Unknown · Buddypress Xprofile Custom Image Field

Name of the Vulnerable Software and Affected Versions: BuddyPress XProfile Custom Image Field versions through 3.0.1 Description: This issue involves an improper limitation of a pathname to a restricted directory, also known as a path traversal. This allows an attacker to access restricted...

PT-2025-34003 · Mitchell Bennis · Simple File List

Name of the Vulnerable Software and Affected Versions: Mitchell Bennis Simple File List versions through 6.1.14 Description: An improper limitation of a pathname to a restricted directory 'Path Traversal' issue exists in Mitchell Bennis Simple File List, allowing path traversal. Recommendations:...

CVE-2025-31988

HCL Digital Experience is susceptible to cross site scripting XSS in an administrative UI with restricted access...

CVE-2025-31988

HCL Digital Experience is susceptible to cross site scripting XSS in an administrative UI with restricted access...

CVE-2025-31988 HCL Digital Experience is susceptible to cross site scripting (XSS)

HCL Digital Experience is susceptible to cross site scripting XSS in an administrative UI with restricted access...

CVE-2025-31988 HCL Digital Experience is susceptible to cross site scripting (XSS)

HCL Digital Experience is susceptible to cross site scripting XSS in an administrative UI with restricted access...

CVE-2025-31988

CVE-2025-31988 affects HCL Digital Experience. It is described as a cross-site scripting (XSS) vulnerability in an administrative UI with restricted access. Publiced technical details in connected sources show CVSS 3.1 with a Network attack vector, Low attack complexity, Privileges Required: High...

HCL Digital Experience 安全漏洞

HCL Digital Experience is a suite of digital experience platforms, content delivery solutions from HCL India. A security vulnerability exists in HCL Digital Experience that stems from the restricted access administrative interface being susceptible to cross-site scripting attacks...