cve-2026-21440-writeup-poc

cve-2026-21440 path traversal to arbitrary file write in @adonisjs/bodyparser overview a critical path traversal vulnerability exists in the @adonisjs/bodyparser package that allows remote attackers to write arbitrary files outside the intended upload directory. when the multipartfile.move functi...

CVE-2026-25732-NiceGUI-3.6.1

Author: Mohammed Idrees Banyamer Contact: Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer CVE-2026-25732 — NiceGUI Path Traversal in FileUpload → Arbitrary File Write Exploit Title: NiceGUI Path Traversal in FileUpload Leading to Arbitrary File Write Date: 2025-06-06 Tested on:...

Exploit-CVE-2026-1357

Install dependencies pip3 install pycryptodome requests Basic exploit python3 wpvivi.py http://target.com Custom webshell python3 wpvivi.py http://target.com --shell backdoor.php python3 wpvivi.py http://target.com --code "" Technical explanation: Null Byte Key: When RSA decryption fails, it...

MGASA-2026-0384 Updated spice-vdagent packages fix security vulnerabilities

Integer overflow in udscswrite leading to heap buffer overflow. CVE-2026-57965 Path traversal in file transfer via unsanitized filename. CVE-2026-57966...

CVE-2026-23907

Apache PDFBox Path Traversal Vulnerability Vulnerability Summary Description Apache PDFBox's ExtractEmbeddedFiles example code does not sanitize filenames when extracting embedded files from PDFs. An attacker can embed files with path traversal sequences ../ to write files to arbitrary filesystem...

CVE-2025-66034

CVE-2025-66034 — fontTools varLib Arbitrary File Write Vulnerability fontTools is a Python library for manipulating font files. Its varLib module processes .designspace files — an XML format that describes how multiple font masters should be interpolated to produce a variable font. Two weaknesses...

CVE-2025-58180

CVE-2025-58180 RCE in OctoPrint via Unsanitized Filename in File Upload In OctoPrint version =1.11.2, an attacker with file upload access e.g., valid API key or session can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote...

CVE-2026-82673

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

EEF-CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename

Summary Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

CVE-2026-82673

ash-project ash_admin versions 0.13.7 through 1.3.0 are vulnerable to a path traversal in the file upload handler. The function AshAdmin.Components.Resource.Form.consume_file_uploads/1 constructs the upload destination using Path.join/1 with the browser-supplied filename without sanitization, all...

EUVD-2026-68331

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

CVE-2026-82635 Pake arbitrary file write via unsanitized download_file filename

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

EUVD-2026-67771

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

CVE-2026-38093

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10 , contains a path traversal (CWE-22) vulnerability in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME value returned by ContentResolver.query() directly in file path const...

EUVD-2026-67235

Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it ...

libreoffice-convert vulnerable to path traversal / arbitrary file write

Impact options.fileName is used to build a filesystem path path.jointempDir.name, fileName and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content t...

DEBIAN-CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

CVE-2026-65612

CVE-2026-65612 is a shell command injection in nnn (a terminal file manager). The root cause is an unsanitized filename variable that is embedded directly into a generated shell command when a file is opened with the preview-tabbed action. An attacker can place a file with a crafted name (contain...

CVE-2026-73680

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...