CVE-2026-25732-NiceGUI-3.6.1

作者： Mohammed Idrees Banyamer 联系方式： Instagram：@banyamersecurity GitHub：https://github.com/mbanyamer CVE-2026-25732 — NiceGUI FileUpload 路径遍历 → 任意文件写入 漏洞利用标题： NiceGUI FileUpload 路径遍历导致任意文件写入 日期： 2025-06-06 测试环境： NiceGUI ≤ 3.6.1（Linux / Windows 上的 Python 3.8 – 3.12） 修复版本： NiceGUI 3.7.0 CVE：...

cve-2026-21440-writeup-poc

cve-2026-21440 @adonisjs/bodyparser 中的路径遍历导致任意文件写入 概述 @adonisjs/bodyparser 包中存在一个严重的路径遍历漏洞，允许远程攻击者在预期上传目录之外写入任意文件。当调用 multipartfile.move 函数时，如果没有显式提供经过清理的文件名，解析器会默认使用客户端提供的文件名，且未进行适当的清理。 由于实现使用了 path.join 且 options.overwrite 默认为 true，攻击者可以构造包含目录遍历序列的恶意文件名（例如...

Exploit-CVE-2026-1357

安装依赖 pip3 install pycryptodome requests 基础利用 python3 wpvivi.py http://target.com 自定义Webshell python3 wpvivi.py http://target.com --shell backdoor.php python3 wpvivi.py http://target.com --code "" 技术说明： Null Byte Key：当RSA解密失败时，返回false，phpseclib将其视为"\x00\x00\x00"。我们使用16个null字节作为AES-128 ECB密钥。...

CVE-2026-23907

Apache PDFBox 路径遍历漏洞 漏洞摘要 描述 Apache PDFBox 的 ExtractEmbeddedFiles 示例代码在从 PDF 中提取嵌入文件时未对文件名进行净化处理。攻击者可以嵌入包含路径遍历序列（../）的文件，从而将文件写入文件系统的任意位置。 漏洞代码 文件： pdfbox/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java private static void extractFileString filePath, String...

CVE-2025-66034

CVE-2025-66034 — fontTools varLib 任意ファイル書き込み 脆弱性 fontTools は、フォントファイルを操作するための Python ライブラリです。その varLib モジュールは .designspace ファイルを処理します。これは、複数のフォントマスターを補間して可変フォントを生成する方法を記述する XML 形式です。 影響を受けるバージョンには、2つの脆弱性があります： 1. サニタイズされていない出力ファイル名 designspace ファイル内の 属性は、varLib...

CVE-2025-58180

CVE-2025-58180 OctoPrint のファイルアップロードにおける無害化されていないファイル名によるRCE OctoPrint バージョン =1.11.2 において、ファイルアップロードアクセス（有効なAPIキーやセッションなど）を持つ攻撃者は、サニタイズ（無害化）をバイパスし、後に OctoPrint のイベントシステムによって実行される悪意のあるファイル名を作成できます。これにより、ホスト上でリモートコード実行（RCE）が発生します。 PoC: 脆弱性再現の手順 ステップ 1: バージョン情報 最新安定版リリースをダウンロード: OctoPrint 1.11.2 ステッ...

CVE-2026-88857 Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions saveWatermark copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension chec...

CVE-2026-54165

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

MGASA-2026-0384 Updated spice-vdagent packages fix security vulnerabilities

Integer overflow in udscswrite leading to heap buffer overflow. CVE-2026-57965 Path traversal in file transfer via unsanitized filename. CVE-2026-57966...

CVE-2026-82673

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

EEF-CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename

Summary Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

CVE-2026-82673

ash-project ash_admin versions 0.13.7 through 1.3.0 are vulnerable to a path traversal in the file upload handler. The function AshAdmin.Components.Resource.Form.consume_file_uploads/1 constructs the upload destination using Path.join/1 with the browser-supplied filename without sanitization, all...

CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

EUVD-2026-68331

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

PT-2026-83683

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ash admin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consume file uploads/1 builds the destination as Path.jointmp dir,...

CVE-2026-82635 Pake arbitrary file write via unsanitized download_file filename

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

GHSA-C6F4-WJ38-M3G3 Snipe-IT vulnerable to directory traversal in displaySig

Impact The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended...

EUVD-2026-67771

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

CVE-2026-38093

The file_picker (aka flutter_file_picker ) library for Flutter, affecting all versions through 10.3.10 , is vulnerable to a path traversal (CWE-22) in its Android implementation. The root cause is the openFileStream() method in FileUtils.kt , which uses the DISPLAY_NAME from ContentResolver.query...