Nostr notes by dotdotcoloncolon_bot (Atlassian edition)

New directory traversal CVE! CVE-2022-51025 - ...

2026-10-22T12:47:46Z

New directory traversal CVE!
CVE-2022-51025 - https://www.cve.org/CVERecord?id=CVE-2022-51025
Penta Security Systems - WAPPLES
Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

New directory traversal CVE! CVE-2026-113352 - ...

2026-10-20T10:47:49Z

New directory traversal CVE!
CVE-2026-113352 - https://www.cve.org/CVERecord?id=CVE-2026-113352
uTox - uTox
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.

New directory traversal CVE! CVE-2026-111618 - ...

2026-10-16T17:48:12Z

New directory traversal CVE!
CVE-2026-111618 - https://www.cve.org/CVERecord?id=CVE-2026-111618
coaidev - CoAI
CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.

New directory traversal CVE! CVE-2026-109247 - ...

2026-10-12T22:47:55Z

New directory traversal CVE!
CVE-2026-109247 - https://www.cve.org/CVERecord?id=CVE-2026-109247
FreeRDP - FreeRDP
FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or '..' sequences. A malicious RDP server can supply '../' sequences so the user's next clipboard paste copies an arbitrary local file readable by the client user instead of the expected remote file.

New directory traversal CVE! CVE-2026-105052 - ...

2026-10-12T21:47:30Z

New directory traversal CVE!
CVE-2026-105052 - https://www.cve.org/CVERecord?id=CVE-2026-105052
IBM - Maximo Application Suite
IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

New directory traversal CVE! CVE-2026-87690 - ...

2026-10-12T05:47:56Z

New directory traversal CVE!
CVE-2026-87690 - https://www.cve.org/CVERecord?id=CVE-2026-87690
Rapid7 - Metasploit Framework
The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying stdapi sink (lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb) writes to whatever path is supplied, so a listing entry such as ../../msfconsole.rc escapes the intended ~/.msf4/loot/<random> directory and overwrites ~/.msf4/msfconsole.rc, a resource file that every msfconsole invocation automatically executes at startup (lib/msf/ui/console/driver.rb:196). An attacker-controlled device that lures an operator into running this gather module achieves an arbitrary file write as the operator; because the written msfconsole.rc can load a second written file (a Ruby plugin whose top-level code runs on require), this converts into persistent code execution and an interactive shell as the operator (frequently root) on the pentester's workstation at the next console launch. The same traversal was previously fixed upstream in the recursive downloader (stdapi/fs/dir.rb scrubs separators); this module omitted the equivalent scrub. The fix applies the same separator scrub (or File.basename) to listing entries before building the local path.

New directory traversal CVE! CVE-2026-103412 - ...

2026-10-09T13:47:56Z

New directory traversal CVE!
CVE-2026-103412 - https://www.cve.org/CVERecord?id=CVE-2026-103412
Apache Software Foundation - Apache Camel Karavan
Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan.

A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing `../` sequences caused the file content to be written outside the project directory, to any location writable by the Karavan process. An authenticated user of any role could use this to overwrite application configuration or files on the application classpath and so execute code in the Karavan container.

This issue affects Apache Camel Karavan: from 3.18.0 before 4.22.1.

Users are recommended to upgrade to version 4.22.1, which fixes the issue.

New directory traversal CVE! CVE-2026-101886 - ...

2026-10-07T16:47:46Z

New directory traversal CVE!
CVE-2026-101886 - https://www.cve.org/CVERecord?id=CVE-2026-101886
Cisco - Jabber for Android
Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no permissions to write attacker-controlled files into Jabber's private data directory by exploiting the exported crosslaunch.share activity and an unsanitized display name from a ContentProvider used in file path construction. Attackers can craft a shared content:// URI with a display name containing '../' sequences to place fully attacker-controlled content within directories such as databases/, shared_prefs/, no_backup/, and files/ without user interaction.

RE: https://chaos.social/@christopherkunz/117398209865608211 ../? ...

2026-10-07T08:19:23Z

RE: https://chaos.social/@christopherkunz/117398209865608211

../? :neofox_drake_dislike:
::/? :neofox_drake_like:

~nyan

quoting
note1q4g…xgu4

OK, this is an innovative directory traversal vuln:
GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml HTTP/1.1

This is from CVE-2026-21589, https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/

The "::" gets replaced with "/" by some weird sanitation method, read more about it in the writeup.

Tagging @nynbinary for humorous memeing.

New directory traversal CVE! CVE-2025-71427 - ...

2026-10-01T23:47:48Z

New directory traversal CVE!
CVE-2025-71427 - https://www.cve.org/CVERecord?id=CVE-2025-71427
GongRzhe - Office-PowerPoint-MCP-Server
Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse save_presentation, open_presentation, or manage_image output_path to overwrite any server-writable file or load external files.

New directory traversal CVE! CVE-2026-97730 - ...

2026-09-28T23:47:52Z

New directory traversal CVE!
CVE-2026-97730 - https://www.cve.org/CVERecord?id=CVE-2026-97730
Netgate - pfSense Plus
Netgate - pfSense CE
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.

New directory traversal CVE! CVE-2026-85185 - ...

2026-09-28T22:47:43Z

New directory traversal CVE!
CVE-2026-85185 - https://www.cve.org/CVERecord?id=CVE-2026-85185
Canonical - LXD
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.

New directory traversal CVE! CVE-2026-96651 - ...

2026-09-28T17:47:50Z

New directory traversal CVE!
CVE-2026-96651 - https://www.cve.org/CVERecord?id=CVE-2026-96651
Plex - Media Server
Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.

New directory traversal CVE! CVE-2025-14753 - ...

2026-09-18T15:49:20Z

New directory traversal CVE!
CVE-2025-14753 - https://www.cve.org/CVERecord?id=CVE-2025-14753
IBM - Cloud Pak for Data
IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

New directory traversal CVE! CVE-2026-79743 - ...

2026-08-31T18:48:50Z

New directory traversal CVE!
CVE-2026-79743 - https://www.cve.org/CVERecord?id=CVE-2026-79743
samanhappy - mcphub
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest is directly concatenated into a file path (line 107) without any sanitization or path traversal character validation. An attacker can craft a malicious MCPB file where manifest.name is set to something like ../../../etc/malicious, causing the file to be extracted to an arbitrary location on the file system. The cleanupOldMcpbServer function (line 110) also uses the unsanitized name, potentially allowing deletion of arbitrary directories. This issue has been patched in version 0.12.13.

New directory traversal CVE! CVE-2026-54083 - ...

2026-08-27T23:48:10Z

New directory traversal CVE!
CVE-2026-54083 - https://www.cve.org/CVERecord?id=CVE-2026-54083
wazuh - wazuh
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script builds a file path by concatenating the srcip field taken from alert JSON directly onto the fixed /ipblock/ base directory, without validating that the value is a well-formed IP address. Because the extraction routine returns the raw string unchecked, an attacker who can trigger alert-matching log events with a crafted srcip containing ../ sequences can escape the base directory. The block action opens the resulting path in append mode, creating an empty file at an arbitrary location, while the unblock action passes it to remove(), deleting an arbitrary file; since the active response daemon runs as root, this includes sensitive files such as system credentials and Wazuh configuration. Unlike the sibling scripts host-deny.c, default-firewall-drop.c, and firewalld-drop.c, which reject non-IP input via get_ip_version(), ip-customblock.c omits this validation. This issue is fixed in version 4.14.7.

New directory traversal CVE! CVE-2026-79781 - ...

2026-08-25T15:49:36Z

New directory traversal CVE!
CVE-2026-79781 - https://www.cve.org/CVERecord?id=CVE-2026-79781
rclone - rclone
rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.

New directory traversal CVE! CVE-2026-78381 - ...

2026-08-24T13:49:22Z

New directory traversal CVE!
CVE-2026-78381 - https://www.cve.org/CVERecord?id=CVE-2026-78381
ransomlook - ransomlook
RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that the resolved file remains within the intended directory.

Because the screen field is free-form and can be populated either through the administrative post editor or through data imported from a remote RansomLook instance, a malicious upstream instance can provide traversal sequences such as ../config/generic.json. When the affected post is subsequently retrieved through the API, RansomLook resolves and reads the attacker-controlled path and returns the contents of the referenced file Base64-encoded in the API response.

This can allow an attacker (being admin) controlling imported post data to read arbitrary files accessible to the RansomLook process, potentially exposing sensitive configuration data, API credentials, password hashes, or other application secrets. The attack does not require the malicious upstream to possess an account on the affected RansomLook instance.

The vulnerability is addressed by resolving screen paths with os.path.realpath() and verifying that the resolved path remains beneath the application's source/ directory. Validation is performed both when values are written and immediately before files are read. Using canonical paths also prevents traversal through symbolic links that would bypass purely lexical path normalization checks.

New directory traversal CVE! CVE-2026-77751 - ...

2026-08-21T10:49:28Z

New directory traversal CVE!
CVE-2026-77751 - https://www.cve.org/CVERecord?id=CVE-2026-77751
misp - misp-stix
A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export.

MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template directory, the object name, and definition.json. An object name originating from untrusted STIX or MISP content was not sufficiently restricted before being used in this filesystem path.

An attacker able to supply a crafted object name containing path separators or traversal sequences such as ../ could therefore cause template resolution to escape the expected template directory and attempt to load a definition.json file from another location accessible to the process.

During STIX 2 import, an attacker-controlled x_misp_name from a custom STIX object could directly reach this template-resolution mechanism.

The issue could also become persistent. A malicious object name stored in a MISP event could later be processed again during STIX 2 export. Consequently, content originally introduced in one security context could trigger filesystem access later when the event is exported by a process operating with different or greater privileges.

If a suitable definition.json file exists outside the intended template directory, its contents may be interpreted as a MISP object template and fields from that file copied into the converted object. This can result in unintended disclosure of locally accessible data represented by the template file and modification of the resulting object's metadata or semantics.

The patches introduce strict validation of object-template names. Valid names are restricted to a single path component containing letters, digits, hyphens, or underscores. Names that do not meet these requirements are replaced with the generic unknown-template name before reaching PyMISP template resolution. The original rejected name is preserved in the object's comment and a warning is generated, preventing traversal while retaining the source information.

New directory traversal CVE! CVE-2026-57233 - ...

2026-08-17T20:49:40Z

New directory traversal CVE!
CVE-2026-57233 - https://www.cve.org/CVERecord?id=CVE-2026-57233
notepad-plus-plus - notepad-plus-plus
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.

New directory traversal CVE! CVE-2026-73851 - ...

2026-08-17T15:49:19Z

New directory traversal CVE!
CVE-2026-73851 - https://www.cve.org/CVERecord?id=CVE-2026-73851
microsoft - kiota
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.

New directory traversal CVE! CVE-2026-63134 - ...

2026-08-11T20:48:53Z

New directory traversal CVE!
CVE-2026-63134 - https://www.cve.org/CVERecord?id=CVE-2026-63134
cisagov - Malcolm
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `../` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.

New directory traversal CVE! CVE-2026-69112 - ...

2026-08-10T19:49:07Z

New directory traversal CVE!
CVE-2026-69112 - https://www.cve.org/CVERecord?id=CVE-2026-69112
huggingface - accelerate
Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.

New directory traversal CVE! CVE-2026-59115 - ...

2026-08-07T00:49:05Z

New directory traversal CVE!
CVE-2026-59115 - https://www.cve.org/CVERecord?id=CVE-2026-59115
Microsoft - Microsoft Entra Provisioning Service
'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

New directory traversal CVE! CVE-2026-71309 - ...

2026-08-05T20:49:16Z

New directory traversal CVE!
CVE-2026-71309 - https://www.cve.org/CVERecord?id=CVE-2026-71309
rclone - rclone
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.

New directory traversal CVE! CVE-2026-56845 - ...

2026-08-04T01:49:06Z

New directory traversal CVE!
CVE-2026-56845 - https://www.cve.org/CVERecord?id=CVE-2026-56845
Rocket.Chat - Rocket.Chat
An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

New directory traversal CVE! CVE-2026-67309 - ...

2026-08-01T12:48:28Z

New directory traversal CVE!
CVE-2026-67309 - https://www.cve.org/CVERecord?id=CVE-2026-67309
traefik - traefik
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.

New directory traversal CVE! CVE-2026-15435 IBM - App Connect ...

2026-07-30T15:48:39Z

New directory traversal CVE!
CVE-2026-15435
IBM - App Connect Enterprise
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

New directory traversal CVE! CVE-2026-65920 huggingface - ...

2026-07-23T18:48:54Z

New directory traversal CVE!
CVE-2026-65920
huggingface - diffusers
Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.

New directory traversal CVE! CVE-2026-65695 GongRzhe - ...

2026-07-23T17:48:11Z

New directory traversal CVE!
CVE-2026-65695
GongRzhe - Office-Word-MCP-Server
Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute paths or ../ traversal sequences directly to document open and save operations, bypassing the check_file_writeable and ensure_docx_extension helpers which perform no base-directory confinement or realpath validation.

New directory traversal CVE! CVE-2026-65600 traefik - traefik ...

2026-07-22T11:48:47Z

New directory traversal CVE!
CVE-2026-65600
traefik - traefik
Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.

New directory traversal CVE! CVE-2026-7667 IBM - Langflow OSS IBM ...

2026-07-17T20:48:44Z

New directory traversal CVE!
CVE-2026-7667
IBM - Langflow OSS
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header (e.g., filename="../../../target/path" ), enabling arbitrary file write operations with attacker-controlled content to any path accessible by the Langflow process.

New directory traversal CVE! CVE-2026-45390 n/a - n/a In ...

2026-06-29T09:02:36Z

New directory traversal CVE!
CVE-2026-45390
n/a - n/a
In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. This is not desired behavior, and tar(1) rejects such extractions, but ocaml-tar decompresses it anyway. The impact is that it allows arbitrary file writes outside of the desired extraction directory (to an attacker that can reach a tar decompression endpoint).

New directory traversal CVE! CVE-2026-54414 error311 - FileRise ...

2026-06-19T06:47:53Z

New directory traversal CVE!
CVE-2026-54414
error311 - FileRise
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename() and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %). The raw filename is then passed to UploadModel::handleUpload, where it is reconstructed as trim(urldecode(basename($fileName))), re-introducing path separators after validation (e.g. ..%2fusers%2fusers.txt becomes ../users/users.txt). UploadNamePolicy::isAllowedForWrite() applies basename() internally and therefore only evaluates the final component (users.txt), allowing the traversal sequence to pass the extension policy. The destination path is then used directly in move_uploaded_file() with no realpath containment check, allowing a write outside the intended upload directory. An attacker who possesses a valid, non-expired, upload-enabled shared-folder link/token (which are designed to be shared publicly) can overwrite users/users.txt to create an administrator account, resulting in unauthenticated admin takeover and, depending on configuration, remote code execution. Exploitation requires possession of a valid, non-expired, upload-enabled shared-folder link/token. This issue is fixed in 3.16.0, which URL-decodes before validation and rejects any path separators in the upload filename.

New directory traversal CVE! CVE-2026-52752 ...

2026-06-10T13:49:23Z

New directory traversal CVE!
CVE-2026-52752
nationalsecurityagency - ghidra
Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious extensions with traversal sequences like ../ in filenames to write arbitrary files outside the intended directory, enabling code execution.

New directory traversal CVE! CVE-2026-44885 portainer - portainer ...

2026-06-01T14:47:35Z

New directory traversal CVE!
CVE-2026-44885
portainer - portainer
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, Portainer's backup restore feature accepts a .tar.gz archive and extracts it to a target directory on the server. The extraction function (ExtractTarGz in api/archive/targz.go) constructed output paths using filepath.Clean(filepath.Join(outputDirPath, header.Name)). This combination does not prevent directory traversal — a tar entry named ../../etc/cron.d/evil resolves to a path outside the extraction root, so a crafted archive can write files to arbitrary locations on the server filesystem. This vulnerability is fixed in 2.33.8.

New bot just dropped! :foxDance: This bot checks CVE descriptions ...

2026-05-18T19:45:37Z

New bot just dropped! :foxDance:

This bot checks CVE descriptions for the string `../`[1] & posts any new here.

Posts contain one CVE as well as the description & some (sometimes vendor-themed) #directorytraversalmemes . Posts are at most hourly & unlisted, working through the backlog as required. Expect about 1-2 posts per day on average.

nyan (npub1t9q…r0p6) will gladly accept new memes (generic or vendor specific).

[1]: "But nyan, why don't you use CWE-22 and children": Because thats >800 this year so far & this is a shitpost bot, not actual threat intel, you want to go to #GAYINT for that. The bot repo contains a "library" including a function to filter for these if you actually care.

New directory traversal CVE! CVE-2026-7302 SGLang - SGLang ...

2026-05-18T13:38:50Z

New directory traversal CVE!
CVE-2026-7302
SGLang - SGLang
SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.