Path traversal.

Path traversal in Blinko

• Blinko
• Path traversal

bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal

• bleenco abstruse
• Path traversal

pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link

• ph7software ph7builder
• Path traversal

thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs

• thClaws
• Path traversal

mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec

• EricLBuehler mistral.rs
• Path traversal

MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer

• modu-ai moai-adk
• Path traversal

answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding

• QingYunA answer-me-with-html
• Path traversal

InstantSoft icms2 Image image.php files_delete_file path traversal

• InstantSoft icms2
• Path traversal

Lippu Docx Reader Office Viewer App path traversal

• Lippu Docx Reader Office Viewer App
• Path traversal

ag2ai ag2 UserProxyAgent os.path.join path traversal

• ag2
• Path traversal

ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter

• C4illin ConvertX
• Path traversal

slide-maker through 5.8.0 Path Traversal via generate_images_openai.py

• addsumtech slide-maker
• Path traversal

WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability

• Chimpstudio FoodBakery
• Path traversal

WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability

• Presto Player Pro
• Path traversal

WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability

• PeepSo
• Path traversal

open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink

• open-multi-agent
• Path traversal

Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass

• pulseaiclub phi
• Path traversal

Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction

• cohere-ai cohere-python
• Path traversal

InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool

• innocommerce InnoShop
• Path traversal

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability

• rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress
• Path traversal

argocd-mcp through 0.9.0 Path Traversal via delete_application Tool

• argoproj-labs argocd-mcp
• Path traversal

Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter

• webilia Listdom: AI-powered Business Directory with Classifieds Ads Listings
• Path traversal

Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter

• Divi Essential Divi Plus
• Path traversal

PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter

• themeisle PPOM – Product Addons & Custom Fields for WooCommerce
• Path traversal

SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)

• gpriday SiteOrigin Widgets Bundle
• Path traversal

W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import

• W3 Total Cache
• Path traversal

Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json

• wpazleen Post Export Import with Media
• Path traversal

Shiny for Python has path traversal in bookmark restore

• Path traversal

>=1.4.0, <1.6.4 · fixed in 1.6.4

Contao: Path traversal in the images controller

• Path traversal

>=4.1.0, <5.3.50 || >=5.4.0-RC1, <5.7.12 · fixed in 5.3.50, 5.7.12

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

• Path traversal
• Unrestricted file upload

<=0.5.0b3.dev101 · no fixed version yet

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

• Path traversal
• CWE-61

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074146-a467ed652591 · fixed in 1.9.10-0.20260728074146-a467ed652591

Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix

• Red Hat Hardened Images
• Red Hat Enterprise Linux 6
• Path traversal

plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert

• mynaparrot plugNmeet-server
• Path traversal

LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json

• netease-youdao LobsterAI
• Path traversal

KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction

• kalcaddle KodExplorer
• Path traversal

Apache Camel Karavan: project file name path traversal when committing a project to Git

• Apache Software Foundation Apache Camel Karavan
• Path traversal

WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability

• add-ons.org PDF for Contact Form 7
• Path traversal

WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability

• ZealousWeb Generate PDF using Contact Form 7
• Path traversal

Path traversal in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• Path traversal

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

• Red Hat Build of Podman Desktop
• Red Hat Certification Program for Red Hat Enterprise Linux 9
• Path traversal

Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

• Path traversal

<2.5.1 · fixed in 2.5.1

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

• Path traversal
• Command injection

<4.6.78 · fixed in 4.6.78

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

• Red Hat Migration Toolkit for Applications 8
• Red Hat Migration Toolkit for Virtualization
• Path traversal

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

• IBM Guardium Data Protection
• Path traversal

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Path traversal

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Path traversal

Satel Netco Design Relative Path Traversal

• Satel Netco Design
• Path traversal

Satel Netco Design Relative path traversal

• Satel Netco Design
• Path traversal

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Security Verify Access
• IBM Verify Identity Access
• Path traversal

Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction

• Intego Antivirus
• Path traversal

Improper link resolution in asset bundling output handling in aws-cdk-lib

• aws-cdk-lib
• Path traversal

IBM Guardium Data Protection Path Traversal

• IBM Guardium Data Protection
• Path traversal

PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

• Path traversal
• Information disclosure

<4.6.78 · fixed in 4.6.78

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

• Path traversal

>=0.59.0, <0.81.0 · fixed in 0.81.0

PraisonAI: Project custom command templates can read outside-workspace files into model prompts

• Path traversal
• Information disclosure

<4.6.78 · fixed in 4.6.78

Bower decompress-zip has a path traversal vulnerability

• decompress-zip
• Path traversal

PraisonAI: SkillTools Executes Scripts Without Path Containment Validation

• Path traversal
• Command injection

<1.6.78 · fixed in 1.6.78

PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

• Path traversal
• Information disclosure

<1.6.78 · fixed in 1.6.78

PraisonAI: Project config can auto-save agent output outside the project root

• Path traversal

<1.6.78 · fixed in 1.6.78

Go-getter vulnerable to a path traversal in S3/GCS directory download handling

• HashiCorp Shared library
• Path traversal