EUVD-2026-87727

SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard util.IsForbiddenAbsPath, invoked from resolvePath is applied only to the allowed root of recursive operations and not to each resolved descendant path — an...

CVE-2022-22828

CVE-2022-22828 Synametrics - SynaMan バージョン 4.9 概要 Viden Labs は、Synametrics の SynaMan に Insecure Direct Object Reference IDOR の脆弱性を発見しました。この脆弱性は、バージョン 4.9 以前に存在します。 この脆弱性は、その後バージョン 5.0 で修正されました。 Insecure Direct Object References（IDOR）は、アプリケーションがユーザー提供の入力を使用してオブジェクトに直接アクセスする際に発生する、アクセス制御の脆弱性の一種です。 ...

CVE-2026-93353 copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The mkdir, rmdir, and...

CVE-2025-60012-POC

教育およびセキュリティ研究目的にのみ使用してください。所有していないシステム、または明示的な書面による許可を得ていないシステムに対しては使用しないでください。 →完全な免責事項 CVE-2025-60012 — Apache Livy の不正なファイルアクセス -yellow 概要...

CVE-2025-29927-PoC

CVE-2025-29927 研究および安全なテストフレームワーク このリポジトリには、CVE-2025-29927 に関する調査と分析 が含まれています。 これは、Web アプリケーションにおけるパストラバーサル/ミドルウェア設定ミスの脆弱性に対する、安全で制御されたテスト手法を示しています。 ⚠️ 重要: このリポジトリは教育目的のみです。明示的な許可なしにシステムを標的にしないでください 。 概要 CVE-2025-29927 は、ミドルウェアの処理における脆弱性に関連し、不適切に設定された場合に不正なファイルアクセスを引き起こす可能性があります。...

EUVD-2026-85401

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

Ghost-Path-Traversal-CVE-2023-32235-

Bug Bounty Report - Ghost Path Traversal CVE-2023-32235 概要 Ghostアプリケーションは、CVE-2023-32235として識別されるパストラバーサルの脆弱性の影響を受けます。この脆弱性により、攻撃者は「package.json」ファイルパスを操作することで、意図されたディレクトリ外の機密ファイルにアクセスできます。 脆弱性詳細 CVE ID: CVE-2023-32235 脆弱性タイプ: パストラバーサル 影響を受けるアプリケーション: Ghost 影響を受けるバージョン: 最新バージョンX.X.Xまでの全バージョン 影響:...

CVE-2024-24919

CVE-2024-24919 のエクスプロイト 説明 このPythonスクリプトは、CVE-2024-24919のエクスプロイトです。このCVEは、Check Point製品（CloudGuard Network、Quantum Maestro、Quantum Scalable Chassis、Quantum Security Gateways、Quantum Spark Appliances）およびバージョン（R77.20 EOL、R77.30 EOL、R80.10 EOL、R80.20 EOL、R80.20.x、R80.20SP EOL、R80.30 EOL、R80.30SP...

rsync: rsync: Unauthorized File Access via Symlink Module Root

A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks...

CVE-2026-81301

Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps a caller-controlled URI path directly to a filesystem path via new File(...), supporting query() , openFile() , and delete() ...

CVE-2026-81301 Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access

Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring caller permissions. The provider maps the caller-controlled URI path directly to a filesystem path and passes it to new File.... It then supports query, openFile,...

CVE-2026-9225

IBM Langflow OSS 1.0.0 through 1.11.5 is affected by an authorization bypass (CWE-639) in the File/Read File component. When executing flows via the /api/v1/run/advanced/{flow_id} endpoint, component inputs can reference storage paths using arbitrary user or flow identifiers without verifying own...

CVE-2026-9225 Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

PT-2026-89547

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-86422

A flaw was found in ImageMagick. This vulnerability, known as a time-of-check-time-of-use TOCTOU flaw, affects path policy enforcement on Windows. A local attacker can exploit this by manipulating symbolic links symlinks during the brief interval between when the system checks a file's permission...

PT-2026-88031

Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intende...

CVE-2026-79904: Improper Limitation of a Pathname to a Restricted Directory

Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intende...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

CVE-2026-48099

A flaw was found in WsgiDAV, a WebDAV server. A remote attacker could exploit this vulnerability by sending a specially crafted WebDAV request path containing encoded parent-directory segments. This could allow the attacker to escape the configured filesystem share root, potentially leading to...