CVE-2026-15789

A flaw was found in BuildKit. A custom client with valid permissions to access the BuildKit control API can produce an upload request that allows files to escape from the BuildKit-controlled state directory. This could lead to unauthorized modification or disclosure of sensitive data...

CVE-2026-75593

A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. A malicious client with valid permissions to access the BuildKit control API can craft a special upload request. This request allows files to escape from the BuildKit-controlled state directory, potentially...

AZL-97035 CVE-2026-75593 affecting package moby-engine for versions less than 25.0.3-20

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...

github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modification

A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. A malicious client with valid permissions to access the BuildKit control API can craft a special upload request. This request allows files to escape from the BuildKit-controlled state directory, potentially...

github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modification

A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. A malicious client with valid permissions to access the BuildKit control API can craft a special upload request. This request allows files to escape from the BuildKit-controlled state directory, potentially...

github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modification

A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. A malicious client with valid permissions to access the BuildKit control API can craft a special upload request. This request allows files to escape from the BuildKit-controlled state directory, potentially...

CVE-2026-15789

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

EUVD-2026-46309

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15789

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

PT-2026-61983

Name of the Vulnerable Software and Affected Versions BuildKit affected versions not specified Description A custom client with valid permissions to access the BuildKit control API can send a specially crafted upload request to the BuildKit daemon. This allows files to escape from the...

CVE-2026-22707

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configured MIME type restrictions plugin.upload.security.allowedTypes and deniedTypes. The same restrictions were correctly...

CVE-2026-22707 Strapi Upload Plugin MIME Validation Bypass via Content API

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configured MIME type restrictions plugin.upload.security.allowedTypes and deniedTypes. The same restrictions were correctly...

CVE-2026-22707

In Strapi, prior to 5.33.3, the Upload plugin’s Content API endpoints did not enforce the administrator-configured MIME restrictions, allowing an authenticated Content API user to upload disallowed file types (e.g., HTML, SVG). The Content API handlers bypassed magic-byte MIME checks and allow/de...

EUVD-2012-5464

Malware in sbrugna...

CVE-2024-10225

A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service DoS by appending a large number of characters to the end of a multipart boundary in a file upload request. This causes the server to continuously process each character, rendering the application...

CVE-2024-9437

SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service DoS attack. The vulnerability exists in the resource upload request, where appending characters, such as dashes -, to the end of a multipart boundary in an HTTP request causes the server to continuously process each...

CVE-2024-9437

SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service DoS attack. The vulnerability exists in the resource upload request, where appending characters, such as dashes -, to the end of a multipart boundary in an HTTP request causes the server to continuously process each...

CVE-2024-10051 Unauthenticated Denial of Service in shaunwei/realchar

Realchar version v0.0.4 is vulnerable to an unauthenticated denial of service DoS attack. The vulnerability exists in the file upload request handling, where appending characters, such as dashes -, to the end of a multipart boundary in an HTTP request causes the server to continuously process eac...

CVE-2024-9437 Unauthenticated Denial of Service in transformeroptimus/superagi

SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service DoS attack. The vulnerability exists in the resource upload request, where appending characters, such as dashes -, to the end of a multipart boundary in an HTTP request causes the server to continuously process each...

CVE-2024-37084 CVE-2024-37084: Remote code execution in Spring Cloud Data Flow

In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server...