CVE-2026-49244

SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 contain a path confinement bypass in the public web-client partial ZIP download endpoint for browsable shares. The root cause is a raw byte-prefix comparison used to validate client-supplied file entries instead of a directo...

CVE-2026-49244 SFTPGo: Path confinement bypass in public browsable share partial ZIP download

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the tarball extraction logic in pkg/archive/extractor.go. An attacker can overwrite files outside the restore destination by supplying a malicious backup tarball with archive entries such as ../escape.txt...

extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass

A flaw was found in extract-zip. This vulnerability allows a remote attacker to craft a malicious zip file containing symbolic links that point to locations outside the intended extraction directory. When a user extracts this malicious archive, extract-zip fails to validate the symlink targets,...

CVE-2026-64966

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...

EUVD-2026-63367

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...

CVE-2026-64966

ATutor (a learning management system) is affected by a Path Traversal vulnerability in its ZIP extraction functionality. An attacker with instructor privileges can upload a specially crafted ZIP archive that writes files outside the intended extraction directory, enabling placement of a server-ex...

CVE-2026-64966 Path Traversal leading to Remote Code Execution in ATutor

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...

CVE-2026-64966 Path Traversal leading to Remote Code Execution in ATutor

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...

CVE-2026-64966 Path Traversal leading to Remote Code Execution in ATutor

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...

CVE-2026-14947

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of...

EUVD-2026-63218

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of...

CVE-2026-14947 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious ZIP file

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of...

CVE-2026-14947

FDS102 for FAdC/FAdCi R2 by Frauscher Sensortechnik fails to validate ZIP entry paths, allowing a high-privileged remote attacker to inject directory traversal sequences (../) and write files to arbitrary locations, potentially achieving arbitrary code execution and full system compromise. CVSS 3...

CVE-2026-15049

The Depicter — Popup & Slider Builder WordPress plugin (versions before 4.8.0 ) contains an arbitrary file upload vulnerability. The root cause is a failure to validate the type of files uploaded via the import feature and a failure to remove malformed uploads. This allows users with editor-level...

CVE-2026-15049 Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...

CVE-2026-15049 Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...

FreeBSD : zeek -- multiple vulnerabilities (e6a17802-cda9-4f53-8870-b629e4ac3d40)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e6a17802-cda9-4f53-8870-b629e4ac3d40 advisory. Tim Wojtulewicz of Corelight reports: HIGH: SMB: Chains of AndX messages can crash Zeek HIGH: DNP3:...

CVE-2026-49244: Improper Limitation of a Pathname to a Restricted Directory

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

PT-2026-78905

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of...