cve-2026-21440-writeup-poc

cve-2026-21440 traversée de chemin menant à l'écriture arbitraire de fichiers dans @adonisjs/bodyparser aperçu une vulnérabilité critique de traversée de chemin existe dans le paquet @adonisjs/bodyparser qui permet à des attaquants distants d'écrire des fichiers arbitraires en dehors du répertoir...

CVE-2026-25732-NiceGUI-3.6.1

Auteur : Mohammed Idrees Banyamer Contact : Instagram : @banyamersecurity GitHub : https://github.com/mbanyamer CVE-2026-25732 — Traversée de chemin NiceGUI dans FileUpload → Écriture arbitraire de fichiers Titre de l'exploit : Traversée de chemin NiceGUI dans FileUpload menant à une écriture...

Exploit-CVE-2026-1357

Installer les dépendances pip3 install pycryptodome requests Exploit de base python3 wpvivi.py http://target.com Webshell personnalisée python3 wpvivi.py http://target.com --shell backdoor.php python3 wpvivi.py http://target.com --code "" Explication technique : Null Byte Key : Lorsque le...

CVE-2026-23907

Vulnérabilité de Traversée de Chemin dans Apache PDFBox Résumé de la Vulnérabilité Description Le code d'exemple ExtractEmbeddedFiles d'Apache PDFBox ne nettoie pas les noms de fichiers lors de l'extraction de fichiers intégrés à partir de PDF. Un attaquant peut intégrer des fichiers avec des...

CVE-2025-66034

CVE-2025-66034 — fontTools varLib 임의 파일 쓰기 취약점 fontTools는 폰트 파일을 조작하기 위한 Python 라이브러리입니다. 해당 varLib 모듈은 .designspace 파일여러 폰트 마스터를 보간하여 가변 폰트를 생성하는 방법을 설명하는 XML 형식을 처리합니다. 영향을 받는 버전에는 두 가지 약점이 존재합니다: 1. 정화되지 않은 출력 파일 이름 designspace 파일의 속성은 varLib가 컴파일된 출력 폰트를 기록하는 위치를 제어합니다. 라이브러리는 이 경로를 파일 시스템에...

CVE-2025-58180

CVE-2025-58180 RCE dans OctoPrint via nom de fichier non assaini lors du téléchargement Dans OctoPrint version =1.11.2, un attaquant disposant d’un accès au téléchargement de fichiers par exemple, une clé API ou une session valide peut créer un nom de fichier malveillant qui contourne...

CVE-2026-54165

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

MGASA-2026-0384 Updated spice-vdagent packages fix security vulnerabilities

Integer overflow in udscswrite leading to heap buffer overflow. CVE-2026-57965 Path traversal in file transfer via unsanitized filename. CVE-2026-57966...

CVE-2026-82673

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

CVE-2026-82673

ash-project ash_admin versions 0.13.7 through 1.3.0 are vulnerable to a path traversal in the file upload handler. The function AshAdmin.Components.Resource.Form.consume_file_uploads/1 constructs the upload destination using Path.join/1 with the browser-supplied filename without sanitization, all...

EEF-CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename

Summary Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

EUVD-2026-68331

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

CVE-2026-82635 Pake arbitrary file write via unsanitized download_file filename

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

CVE-2026-38093

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10 , contains a path traversal (CWE-22) vulnerability in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME value returned by ContentResolver.query() directly in file path const...

EUVD-2026-67771

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

EUVD-2026-67235

Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it ...

libreoffice-convert vulnerable to path traversal / arbitrary file write

Impact options.fileName is used to build a filesystem path path.jointempDir.name, fileName and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content t...

DEBIAN-CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

CVE-2026-65612

CVE-2026-65612 is a shell command injection in nnn (a terminal file manager). The root cause is an unsanitized filename variable that is embedded directly into a generated shell command when a file is opened with the preview-tabbed action. An attacker can place a file with a crafted name (contain...