Path traversal.

Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)

• wazuh
• Path traversal

Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion

• wazuh
• Path traversal

MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal

• MAA-AI MaaMCP
• Path traversal

arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal

• arben-adm mcp-sequential-thinking
• Path traversal

RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal

• RooCodeInc Roo-Code
• Path traversal

Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename

• dolibarr
• Path traversal

Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)

• aws diagram-as-code
• Path traversal

Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

• Trilium
• Path traversal
• Denial of service

Duplicate Advisory: Model-artifact APIs bypass pathsec and touch files outside allowed roots

• Path traversal

<=3.10.3 · no fixed version yet

Duplicate Advisory: Downloader.download follows hardlinks and overwrites outside-root files

• Path traversal

<=3.10.2 · no fixed version yet

Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

• Spring Integration
• Path traversal

Arbitrary File Write via Path Traversal in ResourceCacheService

• Spring AI
• Path traversal

Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal

• Unitree Robotics G1 EDU
• Path traversal
• Authentication bypass

libreoffice-convert vulnerable to path traversal / arbitrary file write

• Path traversal

<1.8.2 · fixed in 1.8.2

openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed...

• Path traversal

<1.4.9 · fixed in 1.4.9

openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not de...

• Path traversal

<1.4.9 · fixed in 1.4.9

n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

• Path traversal

<1.0.0 · fixed in 1.0.0

Spring Framework Path Traversal via Backslash in SpringTemplateLoader

• Spring Framework
• Path traversal

Path traversal in Eclipse Foundation Eclipse SW360

• Eclipse Foundation Eclipse SW360
• Path traversal

Arbitrary File Overwrite via Symlink Following in dool project

• scottchiefbaker dool
• Path traversal

Volmarg Personal Management System Path Traversal via get-file Endpoint

• Volmarg personal-management-system
• Path traversal

Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection

• flowintel
• Path traversal
• Code injection

blackms aistack Static File server.ts path traversal

• blackms aistack
• Path traversal

Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing

• flowintel
• Path traversal

WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability

• WP Manage Ninja Fluent Boards Pro
• Path traversal

Local Privilege Escalation in CodeMeter Runtime on Windows

• wibu-systems-ag codemeter-runtime
• Path traversal

Spring Framework Improper Path Limitation in XsltView

• Path traversal

<=5.2.25.RELEASE || >=5.3.0, <=5.3.49 || >=6.0.0, <=6.0.30 || >=6.1.0, <=6.1.28 || >=6.2.0, <=6.2.19 || >=7.0.0, <7.0.9 · fixed in 7.0.9

Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment

• Workeera
• Path traversal

boxpositron with-context-mcp index.ts project_folder path traversal

• boxpositron with-context-mcp
• Path traversal

bsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal

• bsmi021 mcp-file-context-server
• Path traversal

danielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal

• danielpopamd linkedin-ads-mcp
• Path traversal

A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows.

• Path traversal

The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal.

• Path traversal

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any p…

• Path traversal

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator r…

• Path traversal

A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.

• Path traversal

ZipTransformer uses file_name header to build workDirectory path without sanitization

• Spring Integration
• Path traversal

Symlink following in WebPros Plesk Migrator and others

• WebPros Plesk Migrator
• WebPros Plesk Site Import
• Path traversal

Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)

• weblate
• Path traversal
• CWE-693

Mage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser_items Endpoint

• mage-ai
• Path traversal

ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision

• ZLMediaKit
• Path traversal

asyncssh has SCP Path Traversal to Arbitrary File Write

• Path traversal

<2.23.1 · fixed in 2.23.1

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

• Path traversal
• Broken access control

<2.23.1 · fixed in 2.23.1

IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries

• Path traversal

<5.2.7 · fixed in 5.2.7

Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter

• Strategy11 Formidable Charts
• Path traversal

RustDesk Path Traversal via macOS Clipboard File-Paste

• rustdesk
• Path traversal

OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings

• CalcProgrammer1 OpenRGB
• Path traversal

Arbitrary file overwrite and deletion local and remote in OpenRGB

• CalcProgrammer1 OpenRGB
• Path traversal

Improper Validation of File Paths in TeamViewer Desktop Clients

• TeamViewer Full Client, Host, QuickSupport & Portable
• TeamViewer Full Client, Host, QuickSupport & Portable (for Windows 7 & 8)
• Path traversal

Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission

• Directorist: AI-Powered Business Directory, Listings & Classified Ads
• Path traversal

Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax

• Order Tip for WooCommerce
• Path traversal

AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter

• AI Engine
• Path traversal

yx-image-recognition v1.0 is vulnerable to Path Traversal.

• Path traversal

In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnerability:

• Path traversal

Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration.

• Path traversal

TypeBot: Arbitrary server file read via Send Email block attachment path

• baptisteArno typebot.io
• Path traversal
• Information disclosure

DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename

• eosphoros-ai DB-GPT
• Path traversal

Path traversal in NVIDIA OpenShell

• NVIDIA OpenShell
• Path traversal

Symlink following in SonicWall NetExtender

• SonicWall NetExtender
• Path traversal

consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

• Path traversal

<1.1.2 · fixed in 1.1.2