6 matches found
CVE-2026-16653
A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...
CVE-2026-16653 boazsegev facil.io Public Folder http.c http_sendfile2 path traversal
A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...
CVE-2026-16653 boazsegev facil.io Public Folder http.c http_sendfile2 path traversal
A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...
GHSA-PCJH-6R5H-R92R django-sendfile2 before 0.7.0 contains reflected file download vulnerability
Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of...
django-sendfile2 before 0.7.0 contains reflected file download vulnerability
Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of...
Directory traversal outside of SENDFILE_ROOT in django-sendfile2
django-sendfile2 currently relies on the backend to correctly limit file paths to SENDFILEROOT. This is not the case for the simple and development backends, it is also not necessarily the case for any of the other backends either it's just an assumption that was made by the original author. This...