tag
Arbitrary-File-Write
Microsoft SCCM — AdminService CAB Extraction Path-Traversal to SYSTEM RCE (CVE-2026-47301)
CVE-2026-47301 is a remote code execution vulnerability in Microsoft Configuration Manager (SCCM) that chains four weaknesses: broken access control on the AdminService UploadExtensionInChunks endpoint (any domain user, no RBAC check), CAB extraction…
Crawl4AI Docker API Server Arbitrary File Write via `output_path` (CVE-2026-56260)
Crawl4AI's Docker API server exposes /screenshot and /pdf endpoints that accept an outputpath parameter specifying where the rendered output should be saved. The parameter is passed straight into a file-write call with no validation whatsoever — no check for…
ZimaOS Arbitrary File Write via Unvalidated File API Path — CVE-2026-28286
ZimaOS exposes a file-management REST API endpoint (/v21/files/file) that accepts a user-supplied file path without canonicalizing it or restricting it to a base directory. Because this is a web-facing REST API rather than a local system call, an attacker…
Veno File Manager Arbitrary PHP File Overwrite (CVE-2026-37068)
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the superadmin role to overwrite any PHP file in the application via a specially crafted POST request,…
Responsive Filemanager 9.14.0 — Unauthenticated RCE via Duplicate File (CVE-2026-39023)
Responsive Filemanager 9.14.0 allows an unauthenticated attacker to abuse its "duplicate file" functionality to create a new file with an attacker-chosen name and PHP extension containing arbitrary content. By duplicating an existing file into a .php file…
OpenPLC_v3 glue_generator Path Traversal — CVE-2026-31156
gluegenerator.cpp is a code-generation utility used in the OpenPLCv3 build pipeline to parse a variable-definition header file and emit corresponding glue-code source. The tool accepts input and output file paths as command-line arguments without validating…
Node.js `tar` Package Symlink Path Traversal — CVE-2026-29786
The tar package's extraction engine does not sufficiently validate destination paths when an archive entry is of type symlink. An attacker can craft a tarball containing a symlink entry that points outside the intended extraction directory (e.g. to…
FUXA SCADA/HMI — Unauthenticated Path Traversal to Remote Code Execution (CVE-2026-25895)
FUXA's POST /api/upload endpoint (server/api/projects/index.js:193) is registered without the middleware chain applied to every other project-management route, so it bypasses both the JWT/API-key check and the admin permission gate — even when the…
Fireshare Unauthenticated Arbitrary File Write/Overwrite — CVE-2026-54337
Fireshare's public upload endpoint (/api/upload/public) accepts multipart form fields (file, filename, folder) that are passed largely unsanitized into a downstream ffmpeg invocation used to process the uploaded video. By embedding extra ffmpeg-style…
exiftool-vendored.js Argument Injection via Newline-Delimited Tag Names (CVE-2026-43893)
exiftool-vendored sends caller-supplied strings (tag names in the object passed to exiftool.write(), filenames, and other options) to the underlying ExifTool process via stdin, one argument per line, without filtering embedded newline/carriage-return/NUL…
Casdoor Authenticated Path Traversal to Arbitrary File Write (CVE-2026-6815)
Casdoor's Local File System storage provider fails to properly sanitize the pathPrefix configuration and fullFilePath parameter during resource uploads. An authenticated administrator (or equivalent privileged user) can use directory traversal sequences to…
ApostropheCMS Import — Malicious Tar Archive Path Traversal (CVE-2026-32731)
ApostropheCMS supports importing a site/content archive (.tar.gz) containing aposDocs.json and aposAttachments.json metadata files. The import handler does not validate that entries extracted from the archive stay within the intended extraction directory,…
Apktool Resource Table Path Traversal — Malicious APK Builder (CVE-2026-39973)
Apktool decodes an APK's resources.arsc to reconstruct resource file paths during decompilation, and a security regression (commit e10a045, PR #4041) removed the BrutIO.detectPossibleDirectoryTraversal() check that previously validated the fully-built output…
Amazon WorkSpaces Skylight Workspace Config Service Local Privilege Escalation (CVE-2026-7791)
The Skylight Workspace Config Service on Amazon WorkSpaces runs as SYSTEM and performs scheduled log rotation under C:\ProgramData\Amazon. Permissive ACLs on this directory, a ROTATE directory junction, absence of file-type checks, and a ~1-10 ms TOCTOU…
AdonisJS bodyparser Path Traversal to Arbitrary File Write (CVE-2026-21440)
CVE-2026-21440 is a path-traversal vulnerability in @adonisjs/bodyparser's MultipartFile.move() method. When an application calls file.move(location) without explicitly supplying a sanitized name option, the library falls back to the client-supplied original…
WinRAR Archive Extraction Path Traversal (CVE-2025-6218)
This PoC demonstrates CVE-2025-6218 in WinRAR, where a crafted archive extraction path can place files outside the intended destination directory. The provided batch script builds a ZIP archive that writes a .bat file into the current user's Startup folder.…