tag
Path-Traversal
UniFi OS -- Unauthenticated Command Injection RCE (CVE-2026-34910)
CVE-2026-34910 is an unauthenticated command injection vulnerability in Ubiquiti UniFi OS Server, rated CVSS 10.0 and listed in CISA KEV. The nginx auth layer treats any request whose raw URI starts with /api/auth/validate-sso/ as public, but routes by the…
Microsoft SCCM — AdminService CAB Extraction Path-Traversal to SYSTEM RCE (CVE-2026-47301)
CVE-2026-47301 is a remote code execution vulnerability in Microsoft Configuration Manager (SCCM) that chains four weaknesses: broken access control on the AdminService UploadExtensionInChunks endpoint (any domain user, no RBAC check), CAB extraction…
Docker — CopyEscape: Container-to-Host Escape via docker cp Race Condition (CVE-2026-17106)
CVE-2026-17106, nicknamed CopyEscape, is a race condition in Docker's docker cp command that allows a malicious running container to escape and write arbitrary files on the Docker host. The vulnerability exists in how Docker's archive producer walks the…
Oracle E-Business Suite Pre-Authentication RCE Chain (CVE-2025-61882)
CVE-2025-61882 is an unauthenticated remote code execution chain in Oracle E-Business Suite 12.2.3 through 12.2.14. An attacker POSTs an XML document to the unauthenticated /OAHTML/configurator/UiServlet endpoint; the servlet extracts a returnurl element from…
Microweber CMS Unauthenticated Path Traversal → Arbitrary File Read (CVE-2026-65694)
Microweber CMS exposes an unauthenticated GET /userfiles/{path} route intended to serve files from its userfiles/ upload directory. The controller reads the path via $request->path — a Laravel magic-property accessor that falls back to the request's…
Adobe ColdFusion RDS Path Traversal → Arbitrary File Read/Write → RCE (CVE-2026-48282)
Adobe ColdFusion's Remote Development Service (RDS), a legacy feature that lets IDEs like Dreamweaver remotely browse, read, and write files on a ColdFusion server, is reachable via the /CFIDE/main/ide.cfm endpoint using a simple length-prefixed text…
Crawl4AI Docker API Server Arbitrary File Write via `output_path` (CVE-2026-56260)
Crawl4AI's Docker API server exposes /screenshot and /pdf endpoints that accept an outputpath parameter specifying where the rendered output should be saved. The parameter is passed straight into a file-write call with no validation whatsoever — no check for…
ZKTeco BioTime v8.5.5 Unauthenticated Path Traversal / Arbitrary File Read via iclock API (CVE-2023-38950)
ZKTeco BioTime v8.5.5 exposes the iclock device-communication API endpoint (/iclock/file) without authentication. The url query parameter, which is meant to reference firmware/log filenames pulled by physical biometric terminals, is concatenated into a…
Samsung MagicINFO 9 Server Unauthenticated Path Traversal to RCE (CVE-2025-4632)
Samsung MagicINFO 9 Server's SWUpdateFileUploader servlet, which handles firmware/content update uploads from signage devices, fails to properly sanitize the fileName parameter, allowing directory traversal sequences (../../) to break out of the intended…
Python tarfile `filter="data"` Bypass via PATH_MAX/realpath Confusion (CVE-2025-4517)
Python's tarfile module added extraction filters (filter="data"/"tar", PEP 706, enabled by default since Python 3.12 and backported) specifically to prevent unsafe archive extraction — path traversal, symlink escapes, and writes outside the destination…
Pterodactyl Panel Unauthenticated Path Traversal via locale.json Leaking Database Credentials (CVE-2025-49132)
Pterodactyl Panel prior to version 1.11.11 exposes a /locales/locale.json endpoint that accepts attacker-controlled locale and namespace query parameters without a required integrity/hash check, allowing an unauthenticated attacker to traverse outside the…
Mitel MiCollab Path Normalization Bypass to Internal Endpoints (CVE-2025-52913)
Mitel MiCollab fails to properly normalize URL paths before applying access-control checks on its NPM (Network Protocol Manager) web endpoints. By appending crafted traversal sequences such as ..;/..;/ after seemingly-legitimate, unauthenticated-facing…
FortiWeb `cgi-bin/fwbcgi` Path Traversal Authentication Bypass Leading to Rogue Admin Creation (CVE-2025-64446)
FortiWeb exposes an internal CGI handler (cgi-bin/fwbcgi) that is reachable through the authenticated cmdb REST API path by appending a relative path-traversal sequence (../) after a request to a nonexistent object (admin%3f). Because path handling for the…
Cisco ASA/FTD WebVPN File-Handler Heap Buffer Overflow Exposure Scanner (CVE-2025-20333)
CVE-2025-20333 is a critical heap-based buffer overflow in the WebVPN file-upload handler of Cisco Secure ASA and FTD devices, which can lead to remote code execution as root when successfully exploited (typically after first bypassing authentication via the…
ZimaOS Arbitrary File Write via Unvalidated File API Path — CVE-2026-28286
ZimaOS exposes a file-management REST API endpoint (/v21/files/file) that accepts a user-supplied file path without canonicalizing it or restricting it to a base directory. Because this is a web-facing REST API rather than a local system call, an attacker…
WPvivid Backup & Migration Unauthenticated Arbitrary File Upload RCE (CVE-2026-1357)
The WPvivid Backup & Migration plugin's remote migration/"send to site" feature decrypts an incoming session key with opensslprivatedecrypt(). When decryption fails, the function returns boolean false instead of the code aborting, and that false is passed…
Veno File Manager Path Traversal to Arbitrary File Read (CVE-2026-37066)
Veno File Manager Project 4.4.9 contains a path traversal vulnerability in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php that allows an authenticated attacker with the superadmin role to disclose sensitive information via two specially crafted HTTP…
UnPoller Path Traversal / Arbitrary File Read via file:// Password Prefix (CVE-2026-36851)
UnPoller supports a file:// prefix convention for its UniFi controller password configuration value, intended to read the password from a file on disk. However, the path following the file:// prefix is not restricted, allowing path traversal to read arbitrary…
TP-Link Tapo C260 Unauthenticated-to-Root RCE Chain — CVE-2026-0651
This PoC chains three vulnerabilities in the TP-Link Tapo C260 camera to go from unauthenticated (or guest-level) access to root command execution. First, a path traversal flaw in the HTTP GET handler allows arbitrary local file disclosure. Second, a…
Tandoor Recipes Authenticated Local File Disclosure via Recipe Import (CVE-2026-25964)
CVE-2026-25964 is a path traversal / arbitrary file read vulnerability in Tandoor Recipes' recipe-import workflow. The /api/recipe-import/ endpoint lets an authenticated user set an arbitrary filepath and storage backend on a RecipeImport object without…
Snow Monkey Forms — Unauthenticated Arbitrary File Deletion via Path Traversal (CVE-2026-1056)
Snow Monkey Forms' REST API route handler (SnowMonkey\Plugin\Forms\App\Rest\Route\View.php) contains a logic flaw where supplying method=input causes the handler to skip its CSRF token validation entirely and jump straight to the send() cleanup routine. That…
Simple File List Plugin Unauthenticated File Modification / Path Traversal — CVE-2026-11912
The Simple File List plugin registers its simplefilelisteditjob AJAX action on both the wpajax and wpajaxnopriv hooks, meaning it is reachable by unauthenticated visitors. The authorization check inside eeSFLFileEditor() relies on isadmin(), which always…
Perfmatters WordPress Plugin Arbitrary File Deletion (CVE-2026-4350)
CVE-2026-4350 is a path traversal vulnerability in the Perfmatters WordPress performance plugin that allows arbitrary file deletion. The plugin's perfmattersdelete AJAX action (reachable via wp-admin/admin-ajax.php) takes a delete parameter and passes it to a…
OpenPLC_v3 glue_generator Path Traversal — CVE-2026-31156
gluegenerator.cpp is a code-generation utility used in the OpenPLCv3 build pipeline to parse a variable-definition header file and emit corresponding glue-code source. The tool accepts input and output file paths as command-line arguments without validating…
OpenEMR EtherFax Module Authenticated Arbitrary File Read (CVE-2026-24849)
OpenEMR's Fax/SMS module ships an EtherFax integration whose disposeDoc() handler (in EtherFaxActions.php) takes an attacker-controlled filepath request parameter, checks only that the file exists, and passes it directly to readfile() with no canonicalization…
Node.js `tar` Package Symlink Path Traversal — CVE-2026-29786
The tar package's extraction engine does not sufficiently validate destination paths when an archive entry is of type symlink. An attacker can craft a tarball containing a symlink entry that points outside the intended extraction directory (e.g. to…
node-tar Hardlink/Symlink Path Traversal Arbitrary File Overwrite (CVE-2026-23745)
node-tar fails to sanitize absolute paths supplied in the linkpath field of hardlink and symlink tar entries. In src/unpack.ts, the library resolves the link target with path.resolve(this.cwd, String(entry.linkpath)), but path.resolve() ignores the base cwd…
Nezha Dashboard Path Traversal → JWT Secret Leak → Token Forgery — CVE-2026-53519
The Nezha Dashboard improperly normalizes its routing paths, allowing a crafted request such as /dashboard../data/config.yaml to escape the intended static-file root and read arbitrary files served by the dashboard process. The PoC uses this path traversal…
MindsDB — Handler Path Traversal to Remote Code Execution (CVE-2026-27483)
MindsDB exposes a /api/handlers/ endpoint that lists available integration handlers, some of which are registered but not actually installed. By selecting one of these available-but-uninstalled handler names, an attacker can abuse a path traversal flaw in the…
mcp-atlassian Path Traversal via confluence_upload_attachment (CVE-2026-27825)
The confluenceuploadattachment MCP tool in mcp-atlassian passes its filepath argument straight into open(filepath, "rb") with no path validation, letting an attacker read arbitrary files on the server's filesystem and exfiltrate them via a multipart upload to…
LiquidJS Template Engine Path Traversal — CVE-2026-30952
LiquidJS's layout, render, and include tags can resolve absolute file paths even when a root directory restriction is configured, because the library's fallback path-resolution logic does not properly verify that the resolved path stays within the configured…
Langflow Knowledge Base Path Traversal / Arbitrary Directory Deletion (CVE-2026-42048)
Langflow's DELETE /api/v1/knowledgebases bulk-delete endpoint accepts a list of kbnames values and builds a filesystem path for each by joining it onto the current user's Knowledge Base directory, without normalizing or validating that the resulting path…
iOS App Intents Path Traversal — CVE-2026-28995
Apple's App Intents framework insufficiently validates file paths supplied to an intent's handler, allowing a malicious app to read arbitrary files outside its normal app sandbox. The PoC defines an AppIntent whose readCve(path:) function prepends a long…
InvoicePlane Unauthenticated Path Traversal in Guest Controller (CVE-2026-23491)
InvoicePlane v1.6.3's Guest module exposes a getfile controller action that serves uploaded customer files. The action urldecode()s the requested filename and concatenates it directly onto a fixed base directory (uploads/customerfiles/) before passing the…
Gravity Forms Path Traversal → Arbitrary File Deletion (CVE-2026-48866)
Gravity Forms stores the URL of uploaded files in a form entry via the gformuploadedfiles parameter without stripping ../ sequences (escurlraw() and isvalidurl() both accept path-traversal payloads). When an entry containing such a URL is later deleted —…
Gogs Wiki Arbitrary File Deletion via Path Traversal (CVE-2026-24135)
Gogs, a self-hosted Git service written in Go, contains a path traversal flaw in the updateWikiPage function used when editing wiki pages. The function sanitizes the new page title before writing the updated file but never sanitizes the previous ("old") title…
Gogs Organization-Name Path Traversal to RCE via Git Hooks — CVE-2026-52813
Gogs fails to properly sanitize the organization name supplied at organization-creation time, allowing an authenticated attacker to embed path-traversal sequences (../../...) in the name so that it resolves outside the intended organization directory and into…
FUXA SCADA/HMI — Unauthenticated Path Traversal to Remote Code Execution (CVE-2026-25895)
FUXA's POST /api/upload endpoint (server/api/projects/index.js:193) is registered without the middleware chain applied to every other project-management route, so it bypasses both the JWT/API-key check and the admin permission gate — even when the…
EspoCRM Authenticated RCE via Formula ACL Bypass + Attachment Path Traversal — CVE-2026-33656
EspoCRM's Formula scripting engine (Formula/action/run) can be abused by an admin-authenticated user to bypass access controls and directly rewrite the sourceId field of an Attachment record, redirecting where uploaded chunk data is written on disk via path…
Centreon Multi-Vector RCE — Path Traversal, Command Injection & Blind SQLi (CVE-2026-2749)
This repository bundles three distinct, authenticated vulnerabilities in Centreon that were disclosed together. CVE-2026-2749 is a path traversal flaw in the Open Tickets upload feature that allows arbitrary file write, which can be escalated to remote code…
Casdoor Authenticated Path Traversal to Arbitrary File Write (CVE-2026-6815)
Casdoor's Local File System storage provider fails to properly sanitize the pathPrefix configuration and fullFilePath parameter during resource uploads. An authenticated administrator (or equivalent privileged user) can use directory traversal sequences to…
BoidCMS — Authenticated File Upload to RCE via Template Injection (CVE-2026-39387)
BoidCMS (<= 2.1.2) combines two weaknesses to reach remote code execution from an authenticated admin account. First, its media upload endpoint only checks the declared MIME type (e.g. image/gif) rather than actual file contents, allowing PHP code embedded in…
BetterDocs Pro Unauthenticated Local File Inclusion to RCE — CVE-2026-7515
BetterDocs Pro <= 3.8.0 passes the unauthenticated docstyle POST parameter from its loadmoredocssection/loadmoredocs AJAX actions (registered via wpajaxnopriv) directly into a file-include/view-loading sink (views->get("layouts/encyclopedia/$docstyle")),…
ApostropheCMS Import — Malicious Tar Archive Path Traversal (CVE-2026-32731)
ApostropheCMS supports importing a site/content archive (.tar.gz) containing aposDocs.json and aposAttachments.json metadata files. The import handler does not validate that entries extracted from the archive stay within the intended extraction directory,…
Apktool Resource Table Path Traversal — Malicious APK Builder (CVE-2026-39973)
Apktool decodes an APK's resources.arsc to reconstruct resource file paths during decompilation, and a security regression (commit e10a045, PR #4041) removed the BrutIO.detectPossibleDirectoryTraversal() check that previously validated the fully-built output…
AdonisJS bodyparser Path Traversal to Arbitrary File Write (CVE-2026-21440)
CVE-2026-21440 is a path-traversal vulnerability in @adonisjs/bodyparser's MultipartFile.move() method. When an application calls file.move(location) without explicitly supplying a sanitized name option, the library falls back to the client-supplied original…
Docker cp Copy-Out Destination Escape via Symlink Race
docker cp copy-out operations are vulnerable to a time-of-check/time-of-use race: the daemon walks the container's source path with filepath.WalkDir and builds a tar stream, but if a container process changes a directory entry (e.g., swaps it for a symlink)…
WinRAR Windows Path Traversal via NTFS Alternate Data Streams (CVE-2025-8088)
CVE-2025-8088 is a path traversal vulnerability in the Windows version of WinRAR. A specially crafted RAR archive abuses NTFS Alternate Data Streams (ADS) combined with ..\ traversal sequences so that, when opened or extracted by a vulnerable WinRAR build,…
Cisco Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20262)
CVE-2026-20262 is an authenticated remote arbitrary file write vulnerability in the web UI of Cisco Catalyst SD-WAN Manager. Improper validation of user-supplied input during a file upload process enables path traversal, letting an authenticated attacker…
Ubiquiti UniFi OS Unauthenticated RCE Chain (CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910)
A three-CVE unauthenticated RCE chain in Ubiquiti UniFi OS Server ≤ 5.0.6 allows a remote attacker to achieve root-level command execution with no credentials. CVE-2026-34908 and CVE-2026-34909 (improper access control + path traversal) are chained to bypass…
Palo Alto PAN-OS GlobalProtect Unauthenticated RCE (CVE-2024-3400)
CVE-2024-3400 is an unauthenticated command injection vulnerability in PAN-OS GlobalProtect that can be reached over the network when specific features are enabled. Public reporting showed chained abuse via arbitrary file creation and command execution as…
Palo Alto PAN-OS Management Interface Authentication Bypass (CVE-2025-0108)
CVE-2025-0108 is an authentication bypass in the PAN-OS management interface that can allow unauthorized administrative access. The PoC uses a crafted path traversal style request to reach sensitive management functionality without a valid login session.…
WinRAR Archive Extraction Path Traversal (CVE-2025-6218)
This PoC demonstrates CVE-2025-6218 in WinRAR, where a crafted archive extraction path can place files outside the intended destination directory. The provided batch script builds a ZIP archive that writes a .bat file into the current user's Startup folder.…