tag
Arbitrary-File-Read
Microweber CMS Unauthenticated Path Traversal → Arbitrary File Read (CVE-2026-65694)
Microweber CMS exposes an unauthenticated GET /userfiles/{path} route intended to serve files from its userfiles/ upload directory. The controller reads the path via $request->path — a Laravel magic-property accessor that falls back to the request's…
Rails Active Storage Arbitrary File Read to RCE via libvips Unfuzzed Loaders (CVE-2026-66066)
Rails Active Storage hands untrusted, attacker-supplied image uploads directly to libvips for variant/representation generation without disabling libvips' "unfuzzed" (i.e. not hardened against malicious input) loaders, specifically the MATLAB/HDF5 matload…
ZKTeco BioTime v8.5.5 Unauthenticated Path Traversal / Arbitrary File Read via iclock API (CVE-2023-38950)
ZKTeco BioTime v8.5.5 exposes the iclock device-communication API endpoint (/iclock/file) without authentication. The url query parameter, which is meant to reference firmware/log filenames pulled by physical biometric terminals, is concatenated into a…
Gladinet CentreStack / Triofox Hardcoded AES Key Access-Ticket Forgery to Arbitrary File Read (CVE-2025-14611)
CentreStack and Triofox protect file-download "access tickets" with AES-256-CBC, but the encryption key and IV are not generated per-installation — they are static byte strings hardcoded in GladCtrl64.dll's .data section and returned verbatim by the…
Weblate Arbitrary File Read via ssh-keyscan Host Argument Injection — CVE-2026-24126
Weblate's SSH host-key management feature (weblate/ssh/views.py, addhostkey()) passes the administrator-supplied host field straight into an ssh-keyscan subprocess invocation with no sanitization and no -- argument terminator. Because ssh-keyscan supports a…
Veno File Manager Path Traversal to Arbitrary File Read (CVE-2026-37066)
Veno File Manager Project 4.4.9 contains a path traversal vulnerability in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php that allows an authenticated attacker with the superadmin role to disclose sensitive information via two specially crafted HTTP…
Veno File Manager 4.4.9 — Authenticated Arbitrary File Read (CVE-2026-37070)
Veno File Manager 4.4.9 exposes the /vfm-admin/ajax/streamvid.php endpoint without properly restricting which files a session-authenticated user may request. A user who is only supposed to have access to their own assigned directory can instead read any…
UnPoller Path Traversal / Arbitrary File Read via file:// Password Prefix (CVE-2026-36851)
UnPoller supports a file:// prefix convention for its UniFi controller password configuration value, intended to read the password from a file on disk. However, the path following the file:// prefix is not restricted, allowing path traversal to read arbitrary…
Tandoor Recipes Authenticated Local File Disclosure via Recipe Import (CVE-2026-25964)
CVE-2026-25964 is a path traversal / arbitrary file read vulnerability in Tandoor Recipes' recipe-import workflow. The /api/recipe-import/ endpoint lets an authenticated user set an arbitrary filepath and storage backend on a RecipeImport object without…
OpenEMR EtherFax Module Authenticated Arbitrary File Read (CVE-2026-24849)
OpenEMR's Fax/SMS module ships an EtherFax integration whose disposeDoc() handler (in EtherFaxActions.php) takes an attacker-controlled filepath request parameter, checks only that the file exists, and passes it directly to readfile() with no canonicalization…
n8n Unauthenticated Arbitrary File Read to RCE Full Chain — CVE-2026-21858 + CVE-2025-68613
This PoC chains two n8n vulnerabilities into full unauthenticated remote code execution. First, CVE-2026-21858 is a Content-Type confusion bug in n8n's binary file handling: sending Content-Type: application/json instead of multipart/form-data to a form…
mcp-atlassian Path Traversal via confluence_upload_attachment (CVE-2026-27825)
The confluenceuploadattachment MCP tool in mcp-atlassian passes its filepath argument straight into open(filepath, "rb") with no path validation, letting an attacker read arbitrary files on the server's filesystem and exfiltrate them via a multipart upload to…
LiquidJS Template Engine Path Traversal — CVE-2026-30952
LiquidJS's layout, render, and include tags can resolve absolute file paths even when a root directory restriction is configured, because the library's fallback path-resolution logic does not properly verify that the resolved path stays within the configured…
Jenkins ClassFilter Deserialization Bypass → Arbitrary File Read — CVE-2026-53435
Jenkins restricts deserialization via a custom ClassFilter that only allows types defined in Jenkins core or installed plugins. CVE-2026-53435 shows this whitelist is insufficient: an attacker who can POST a view's config.xml can get Jenkins to deserialize a…
InvoicePlane Unauthenticated Path Traversal in Guest Controller (CVE-2026-23491)
InvoicePlane v1.6.3's Guest module exposes a getfile controller action that serves uploaded customer files. The action urldecode()s the requested filename and concatenates it directly onto a fixed base directory (uploads/customerfiles/) before passing the…
HashiCorp go-getter Git Pathspec Arbitrary File Read (CVE-2026-4660)
go-getter resolves Terraform/Nomad/Packer/Waypoint module sources with ref query parameters passed straight through to git checkout. An attacker can publish a module whose ref is set to a git option such as --pathspec-from-file=/path/to/file instead of a real…
exiftool-vendored.js Argument Injection via Newline-Delimited Tag Names (CVE-2026-43893)
exiftool-vendored sends caller-supplied strings (tag names in the object passed to exiftool.write(), filenames, and other options) to the underlying ExifTool process via stdin, one argument per line, without filtering embedded newline/carriage-return/NUL…
Apache HTTP Server mod_rewrite/mod_setenvif/mod_proxy_fcgi ap_expr Local File Read — CVE-2026-24072
Apache HTTP Server's apexpr expression evaluation engine exposes filesystem-introspection functions (file(), filesize(), and tests like -f, -d, -e, -s, -L, -h, -x) that are meant to be restricted when expressions are parsed from a .htaccess file rather than…
Jenkins CLI Arbitrary File Read to RCE (CVE-2024-23897)
CVE-2024-23897 is an arbitrary file read vulnerability in the Jenkins CLI command parser. The parser expands arguments that start with @ and can disclose controller-local files to unauthenticated attackers in common deployments. This disclosure can expose…