CVE-2026-100520

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CVE-2026-100520

Laranode versions before 1.2.1 are vulnerable to a path traversal vulnerability within the POST /filemanager/upload-file endpoint. This flaw allows authenticated users to bypass directory restrictions by supplying traversal sequences in the path parameter. Consequently, an attacker can write arbi...

CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

EUVD-2026-87375

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CVE-2026-100520: Improper Limitation of a Pathname to a Restricted Directory

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CVE-2023-4220-Chamilo-LMS

Chamilo LMS 未认证大文件上传远程代码执行漏洞 PoC 该脚本允许利用 CVE-2023-4220 所描述的 Chamilo LMS 软件安全漏洞。系统在 1.11.24 之前的版本中存在漏洞。 用法 将仓库克隆到您的计算机并使用 pip 安装依赖项（建议使用 virtualenv 创建一个环境，以将这些安装与全局安装分开） git clone https://github.com/m3m0o/chamilo-lms-unauthenticated-big-upload-rce-poc cd...

PyTorch Lightning path traversal vulnerability

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

CVE-2026-54593

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

CVE-2026-54593

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

MAL-2026-11124 Malicious code in api-node-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8133fdea40df12d51091c8ce094062f366f0c30be0d17667a827ed00b75f78a On npm install, the package's postinstall hook node test.js executes an attacker-controlled workflow against the installer's host. It recursively sca...

CVE-2026-54593: Improper Restriction of Security Token Assignment

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

PT-2026-59229

A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create upload file of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API Endpoint. The manipulation results in unrestricted upload. It is possible to launch the attack...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the UploadFileRequest process, which fails to properly sanitize SVG content unless PHP finfo reports image/svg+xml, and the...

CVE-2026-48127 Frappe: Arbitrary Attachment Injection via add_attachments and upload_file

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-handling API endpoints such as addattachments. This issue is fixed in versions 16.20.0 and 15.110.0...

CVE-2026-48127 Frappe: Arbitrary Attachment Injection via add_attachments and upload_file

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-handling API endpoints such as addattachments. This issue is fixed in versions 16.20.0 and 15.110.0...

PYSEC-2026-1941 Starlette has possible denial-of-service vector when parsing large files in multipart forms

Summary When parsing a multi-part form with large files greater than the default max spool size starlette will block the main thread to roll the file over to disk. This blocks the event thread which means we can't accept new connections. Details Please see this discussion for details:...

CVE-2026-36162

An authenticated stored cross-site scripting XSS vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to execute arbitrary Javascript or HTML via injecting a crafted payload into the Name parameter...

CVE-2026-36162

An authenticated stored cross-site scripting XSS vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to execute arbitrary Javascript or HTML via injecting a crafted payload into the Name parameter...

PT-2026-56276

Name of the Vulnerable Software and Affected Versions LiquidFiles version 4.2.7 Description An authenticated stored cross-site scripting XSS issue exists in the Upload File Shares API. This allows an attacker to execute arbitrary Javascript or HTML by injecting a crafted payload into the Name...