Total
143 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-82092 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-16 | N/A | 8.8 HIGH |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability. | |||||
| CVE-2025-70820 | 2026-09-15 | N/A | 3.5 LOW | ||
| Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder. | |||||
| CVE-2026-89009 | 2026-09-15 | N/A | 9.1 CRITICAL | ||
| WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise. | |||||
| CVE-2026-68487 | 2026-09-10 | N/A | 9.9 CRITICAL | ||
| Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. | |||||
| CVE-2026-88288 | 2026-09-10 | N/A | 6.5 MEDIUM | ||
| GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service. | |||||
| CVE-2026-47243 | 2026-09-09 | N/A | N/A | ||
| Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to host-root escape. In this configuration, Kata runs the host virtiofsd as root with --sandbox none --seccomp none, so an attacker with root-equivalent access inside the guest can bypass the guest virtio-fs client entirely by taking over the virtio-fs PCI device and building a virtqueue in userspace to submit raw FUSE requests directly to the host virtiofsd. A crafted FUSE_SYMLINK request whose new symlink name is an absolute host path is honored outside the configured shared directory, allowing guest root to create root-owned symlinks in sensitive host locations such as /etc/cron.d. By pointing such a symlink at a guest-controlled crontab payload reachable through a live runtime process's mount namespace, the attacker causes the host cron daemon to execute that payload as host root, crossing the Kata isolation boundary. This issue is fixed in version 3.31.0. | |||||
| CVE-2026-68896 | 2026-09-09 | N/A | 7.8 HIGH | ||
| Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69612 | 2026-09-09 | N/A | 7.8 HIGH | ||
| Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-54202 | 2026-09-07 | N/A | N/A | ||
| Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folders in arbitrary locations, including sensitive directories such as C:\Windows or for different users. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. | |||||
| CVE-2026-47606 | 2 Linux, Nvidia | 2 Linux Kernel, Triton Inference Server | 2026-09-02 | N/A | 6.5 MEDIUM |
| NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure. | |||||
| CVE-2026-47630 | 2 Linux, Nvidia | 2 Linux Kernel, Triton Inference Server | 2026-09-01 | N/A | 5.5 MEDIUM |
| NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution. | |||||
| CVE-2026-13346 | 1 Pypa | 1 Pip | 2026-08-20 | N/A | 6.5 MEDIUM |
| pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time. | |||||
| CVE-2026-46345 | 2026-08-17 | N/A | 8.4 HIGH | ||
| compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue. | |||||
| CVE-2018-20250 | 1 Rarlab | 1 Winrar | 2026-08-13 | 6.8 MEDIUM | 7.8 HIGH |
| In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path. | |||||
| CVE-2026-61891 | 1 Eclipse | 1 Theia | 2026-08-07 | N/A | 7.5 HIGH |
| In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests, so these endpoints are reachable without a valid token. As a result an unauthenticated client can read any file readable by the backend process, including files outside the opened workspace (for example `/etc/hosts`, SSH keys, or tokens). Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path. | |||||
| CVE-2026-13189 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-08-06 | N/A | 7.5 HIGH |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests. | |||||
| CVE-2026-20834 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-07-30 | N/A | 4.6 MEDIUM |
| Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack. | |||||
| CVE-2026-7217 | 2026-07-24 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A security vulnerability has been detected in Deepractice PromptX up to 2.4.0. The affected element is the function read_docx/read_xlsx/read_pptx/list_xlsx_sheets/read_pdf of the file packages/mcp-office/src/index.ts of the component Document File Handler. Such manipulation of the argument path leads to absolute path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-10075 | 2026-07-21 | N/A | 5.3 MEDIUM | ||
| DreamMaker developed by Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to read file names under arbitrary path by exploiting an Absolute Path Traversal vulnerability. | |||||
| CVE-2026-10044 | 2026-07-21 | N/A | 7.5 HIGH | ||
| Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts/{filename} endpoint on Windows deployments that allows unauthenticated remote attackers to read arbitrary files by supplying absolute Windows paths or backslash-based traversal sequences. Attackers can bypass the incomplete path traversal guard, which only blocks forward slashes and '..', by providing absolute paths such as Windows system file locations, causing os.path.join to discard the intended prompts directory prefix and expose files accessible to the application process. | |||||