CVE-2026-113505

A flaw has been found in aaPanel up to 8.25.0. Impacted is the function sendfile of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published a...

CVE-2026-113505 aaPanel Download Endpoint v2.py send_file path traversal

A flaw has been found in aaPanel up to 8.25.0. Impacted is the function sendfile of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published a...

EUVD-2026-105174

A flaw has been found in aaPanel up to 8.25.0. Impacted is the function sendfile of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published a...

CVE-2026-113505

A path traversal vulnerability exists in aaPanel up to version 8.25.0 within the Download Endpoint component. The flaw is located in the send_file function of the BTPanel/routes/v2.py file, where improper handling of the filename argument allows for remote path traversal. While an exploit has bee...

Rocky Linux 9 [CIQ] Security Update: perl-HTTP-Daemon (crlsa-2026_36187)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202636187 advisory. perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in sendfile CVE-2026-8450 Tenable has extracted the preceding description block...

Rocky Linux 10.2 [CIQ] Security Update: perl-HTTP-Daemon (crlsa-2026_36189)

The Rocky Linux 10.2 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202636189 advisory. perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in sendfile CVE-2026-8450 Tenable has extracted the preceding description bloc...

Rocky Linux 8 [CIQ] Security Update: perl-HTTP-Daemon (crlsa-2026_36188)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202636188 advisory. perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in sendfile CVE-2026-8450 Tenable has extracted the preceding description block...

Astra Linux – Vulnerability in libhttp-daemon-perl

Versions of HTTP::Daemon prior to version 6.17 for Perl allow for OS command injection through the sendfile function. The sendfile function opens its string argument using Perl’s two-argument open syntax. This two-argument syntax interprets certain magic prefixes: '| cmd' and 'cmd |' open a pipe ...

CVE-2026-75529 Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

CVE-2026-75529 Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

CVE-2026-75529: Improper Neutralization of Input During Web Page Generation

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/ /.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

CVE-2026-18991

A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component sendfile. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been...

CVE-2026-18991 nanocoai NanoClaw send_file core.ts path traversal

A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component sendfile. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been...

CVE-2026-18991 nanocoai NanoClaw send_file core.ts path traversal

A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component sendfile. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been...

CVE-2026-18991: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component sendfile. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been...

AlmaLinux 10 : perl-HTTP-Daemon (ALSA-2026:36189)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:36189 advisory. perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in sendfile CVE-2026-8450 Tenable has extracted the preceding description block...

Oracle Linux 10 : perl-HTTP-Daemon (ELSA-2026-36189)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-36189 advisory. - Fix CVE-2026-8450: sendfile shell-magic via 2-arg open Tenable has extracted the preceding description block directly from the Oracle Linux security advisor...

Alibaba Cloud Linux 3 : 0197: perl-HTTP-Daemon (ALINUX3-SA-2026:0197)

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by a vulnerability as referenced in the ALINUX3-SA-2026:0197 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-8450: HTTP::Daemon versions before 6.17 fo...

AlmaLinux 9 : perl-HTTP-Daemon (ALSA-2026:36187)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:36187 advisory. perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in sendfile CVE-2026-8450 Tenable has extracted the preceding description block...

RLSA-2026:36189 Important: perl-HTTP-Daemon security update

The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a socket for incoming requests. Security Fixes: perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in...