EEF-CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename

Summary Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ashadmin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consumefileuploads/1 builds the destination as Path.jointmpdir,...

CVE-2026-81889: Server-Side Request Forgery (SSRF)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-82472

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a delete...

CVE-2026-77037

multer is a Node.js middleware for handling multipart/form-data uploads. In version 2.2.0 , when a disk-backed upload is aborted or truncated before the write stream finishes, the disk storage engine removes the visible file but fails to close the underlying write file descriptor , leaving a dele...

CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a delete...

CVE-2026-82238

filebrowser version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to bypass upload-length validation by sending multiple concurrent PATCH requests at the same offset. This results in files that exceed their declared Upload-Length and triggers completio...

WordPress DHL for WooCommerce plugin < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory vulnerability

Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory vulnerability discovered by Artus KG in WordPress Plugin DHL Shipping Germany for WooCommerce versions 4.0.1...

WordPress Events Manager plugin < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads vulnerability

Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads vulnerability discovered by Usama Arshad in WordPress Plugin Events Manager versions 7.4...

CVE-2026-32639 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

CVE-2026-32639 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

CVE-2026-32639 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types...

PT-2026-78904

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

CVE-2026-76393 Race Condition during Model Upload through the REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload request for the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The race condition is...

CVE-2026-75952

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions app install, demo-data wipe,...

PT-2026-78451

Name of the Vulnerable Software and Affected Versions J-BusinessDirectory versions prior to 6.2.3 Description Cross-site request forgery occurs because tokens are missing on several AJAX and state-changing tasks. Affected areas include contact and quote forms, the cart, bookmarks, uploads,...

CVE-2026-75952: Cross-Site Request Forgery (CSRF)

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions app install, demo-data wipe,...

MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

Summary The findiconpathzip function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path. An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitra...

PT-2026-73133

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.1.2 Description This issue involves a Directory Traversal flaw where authenticated attackers with editor-level access or higher can read arbitrary files on the...

Incomplete Cleanup

Overview @fastify/multipart is a Multipart plugin for Fastify Affected versions of this package are vulnerable to Incomplete Cleanup due to the saveRequestFiles multipart upload handling in index.js. An attacker can hang a request and leave temporary files behind by sending a file part that excee...