CVE-2024-25081_2025-47273

CVE-2024-25081 和 CVE-2025-47273 概念验证 FontForge ≤ 20230101 版本 和 Setuptools 库 概念验证用于提升运行使用 Font Forge 的任务的用户的权限。第二个 CVE 能够将权限提升至 root，前提是您对敏感目录拥有写入权限。 更多信息： CVE ID| 漏洞| 影响 ---|---|--- CVE-2024-25081| 在将文件名传递给 shell 之前未进行清理| 命令注入（以所有者用户身份） CVE-2025-47273| 在解码 URL 之前进行初步清理 - URL编码| 路径遍历并写入文件...

CVE-2026-29780

公式サンプルスクリプトにおけるパストラバーサルによる任意ファイル書き込み 概要 公式サンプルスクリプト examples/recursivelyextractattachments.py には、意図した出力ディレクトリの外部への任意ファイル書き込みを可能にするパストラバーサル脆弱性が存在します。解析されたメールから抽出された添付ファイル名は、サニタイズ処理なしで出力ファイルパスの構築に直接使用されるため、攻撃者が制御したファイル名が対象ディレクトリから脱出できる可能性があります。 詳細 ファイル: examples/recursivelyextractattachments.py 行:...

asyncssh has SCP Path Traversal to Arbitrary File Write

| | ||---|---|| Product | asyncssh all versions through 2.23.0 || Related | CVE-2019-6111 same class in OpenSSH || Fix | AsyncSSH 2.23.1 |A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP recei...

CVE-2026-81694

openssl-encrypt (pip package, versions ≤ 1.4.8) is vulnerable to output injection in the verify-usb command. Filenames read from untrusted drive data—residing outside the AES-GCM authenticated manifest —are printed without sanitization, allowing an attacker to plant terminal cursor-movement and e...

CVE-2026-81694 verify-usb before 1.4.9 Output Injection via Unsanitized Filenames

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

CVE-2026-81694 verify-usb before 1.4.9 Output Injection via Unsanitized Filenames

openssl-encrypt pip package, versions = 1.4.8 fails to sanitize filenames read from untrusted drive data outside the AES-GCM authenticated manifest before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control...

CVE-2026-72570

CVE-2026-72570 affects the project cube-root/directory-serve up to version 1.3.7. The vulnerability is a stored XSS : uploading a file with a crafted filename containing HTML attribute-breaking characters allows the attacker to inject arbitrary JavaScript into the web interface. The root cause is...

CVE-2026-66415 Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

PT-2026-66544

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An authenticated attacker can perform server-side request forgery SSRF and local file inclusion LFI by providing unsanitized filenames to the file get contents function within the Blueprints::import method...

jupyterlab-git extension: Stored XSS leading to RCE

OverviewAmazon Web Services AWS Security has identified a stored cross-site scripting XSS issue in the jupyterlab-git JupyterLab extension that can lead to remote code execution RCE. The issue exists in thePlainTextDiff.ts component, where the createHeader method passes Git filenames directly to...

PT-2026-59198

Overview Amazon Web Services AWS Security has identified a stored cross-site scripting XSS issue in the jupyterlab-git JupyterLab extension that can lead to remote code execution RCE. The issue exists in the PlainTextDiff.ts component, where the createHeader method passes Git filenames directly t...

PT-2026-56520

Name of the Vulnerable Software and Affected Versions Horde Virtual File System VFS API versions prior to 3.0.1 Description The Horde Vfs Smb driver contains an OS command injection flaw where the escapeShellCommand method does not properly sanitize command substitution sequences. Authenticated...

PYSEC-2026-2047 Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

Summary - Vulnerability Type: Path Traversal CWE-22 leading to Arbitrary File Permission Modification. - Root Cause Component: wheel.cli.unpack.unpack function. - Affected Packages: 1. wheel Upstream source 2. setuptools Downstream, vendors wheel - Severity: High Allows modifying system file...

UBUNTU-CVE-2026-57966

A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized...

EUVD-2026-40050

A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized...

jupyterlab-git extension: Stored XSS leading to RCE

Overview Amazon Web Services AWS Security has identified a stored cross-site scripting XSS issue in the jupyterlab-git JupyterLab extension that can lead to remote code execution RCE. The issue exists in the PlainTextDiff.ts component, where the createHeader method passes Git filenames directly t...

Path Traversal

Spring AI is vulnerable to Path Traversal. The vulnerability is due to unsanitized LLM-influenced filenames in Path.resolve, where a malicious user could write files outside the intended target directory, including restricted directories...

CVE-2026-41863

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories. Affected versions: Spring AI: 1.1.0...

CVE-2026-43943

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution RCE vulnerability exists in electerm's SFTP open with system editor or "Edit with custom editor" feature. When a user opts to edit a file using open with system edito...

CVE-2026-6957

Mattermost Plugins versions =1.1.5 fail to sanitize filenames received from federated peers before using them to construct export destination paths, which allows an administrator of a remote federated Mattermost server to write files to arbitrary locations within the target server's filestore via...