Path traversal.

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes

• lxc incus
• Path traversal

Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

• lepture mistune
• Path traversal

Mistune before 3.3.0 Path Traversal via include Directive

• lepture mistune
• Path traversal

Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Path traversal

ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory

• github.com/checkmarx/ast-cli
• Path traversal

virtualenv: Generated files can follow existing destination links

• Path traversal

<21.14.9 · fixed in 21.14.9

draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)

• jgraph drawio-desktop
• Path traversal
• Information disclosure

Storybook dev server vulnerable to code injection from the local network

• Path traversal
• Code injection

>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6 · fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6

JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore

• JetBackup
• Path traversal

nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc

• Path traversal

>=5.4.0, <7.17.2 · fixed in 7.17.2

Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE

• rsyslog
• Path traversal

YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId

• YouDataSum CPAS Audit Management System
• Path traversal

Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer

• Penta Security Systems WAPPLES
• Path traversal

Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint

• Kareadita Kavita
• Path traversal

YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint

• liukuo362573 YiShaAdmin
• Path traversal

OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi

• OrbiTeam BSCW Server
• Path traversal

JeeWMS Path Traversal via showOrDownByurl.do

• erzhongxmu JeeWMS
• Path traversal

FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer

• FanRuan FineReport
• Path traversal

Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload

• Weaver Network Co., Ltd. E-cology
• Path traversal

WooThemes Diarise 1.5.9 Local File Disclosure via download.php

• WooThemes Diarise
• Path traversal

MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter

• MetInfo
• Path traversal

Intermesh Group-Office < 3.5.5 Path Traversal via compress.php

• Intermesh Group-Office
• Path traversal

Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter

• Javo Themes Javo Spot
• Path traversal

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability

• ACF Extended
• Path traversal

Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

• Drupal Media Library Importer
• Path traversal

Path traversal in Roundcube Webmail

• Roundcube Webmail
• Path traversal

virtualenv: Builtin creation follows linked environment directories

• Path traversal

<21.14.9 · fixed in 21.14.9

virtualenv: Deletion recovery can change a symlink target's mode

• Path traversal

<21.14.9 · fixed in 21.14.9

EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion

• EKKOLearnAI ekko-studio
• Path traversal

leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal

• leomoon-studios wiki-go
• Path traversal

leomoon-studios wiki-go API editor.go SourceHandler path traversal

• leomoon-studios wiki-go
• Path traversal

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

• Path traversal

>=4.1.11, <4.1.12 || >=5.0.0-rc.2, <5.0.3 · fixed in 4.1.12, 5.0.3

leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal

• leomoon-studios wiki-go
• Path traversal

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage

• Apache Software Foundation Apache Pulsar
• Path traversal

gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

• flipped-aurora gin-vue-admin
• Path traversal

pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images

• bpampuch pdfmake
• Path traversal

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

• Path traversal
• Code injection

>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6 · fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6

djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

• Path traversal

>=0.9.0, <1.0.10 || >=1.1.0, <1.1.7 || >=1.2.0.dev0, <1.2.4 || >=1.3.0.dev0, <1.3.0rc8 · fixed in 1.0.10, 1.1.7, 1.2.4, 1.3.0rc8

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability

• BusyBox
• Path traversal

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

• Path traversal
• Broken access control

<6.4.4 || >=7.0.0, <7.3.7 || >=8.0.0, <8.1.6 || >=8.2.0, <8.2.4 || >=8.3.0, <8.3.3 · fixed in 6.4.4, 7.3.7, 8.1.6, 8.2.4, 8.3.3

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

• Path traversal
• Information disclosure

>=8.2.0, <8.2.4 || >=8.3.0, <8.3.3 · fixed in 8.2.4, 8.3.3

Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities

• Cisco TelePresence Video Communication Server (VCS) Expressway
• Path traversal

Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities

• Cisco Emergency Responder
• Cisco Unified Communications Manager
• Path traversal

Arbitrary File Read via Symlink in Velneo vServer HTTP Server

• Velneo vServer
• Path traversal

Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Enterprise Linux 8
• Path traversal

oretnom23 file-management-system-php index.php include file inclusion

• oretnom23 file-management-system-php
• Path traversal

WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability

• Bold Grid weForms
• Path traversal

Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload

• polonel trudesk
• Path traversal

Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API

• polonel trudesk
• Path traversal

Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof

• Apache Software Foundation Apache bRPC
• Path traversal
• Denial of service

DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal

• DT42 BerryNet
• Path traversal

Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries

• Path traversal

* · no fixed version yet

Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal

• Tenstorrent tt-metal
• Path traversal

Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints

• triggerdotdev trigger.dev
• Path traversal

SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

• sveltejs kit
• Path traversal

Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

• astral-sh uv
• Path traversal

R6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal

• R6410418 Jackrong-llm-finetuning-guide
• Path traversal

R6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal

• R6410418 Jackrong-llm-finetuning-guide
• Path traversal