By weakness (CWE)

CWE-22: related vulnerabilities

CVEs classified under CWE-22. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

291 published vulnerabilities · page 1 of 3

• CVE-2026-11419HIGH 8.8

  Altium Enterprise Server contains a flaw in how it validates file paths when users upload images. An authenticated attacker can bypass the normal storage location restrictions and write files anywhere on the server's filesystem. This primitive can be weaponized to inject malicious code, take over the service, or crash it entirely. Cloud-hosted Altium 365 deployments are not vulnerable because the vulnerable upload endpoint is not exposed in that architecture.

• CVE-2026-11769HIGH 8.8

  The Grafana Operator, a popular tool for managing Grafana instances in Kubernetes environments, contains a security flaw that allows attackers with dashboard creation permissions to steal the operator's service account token. The vulnerability stems from the operator's support for jsonnet templating—a data definition language evaluated within the operator's pod context—which can be exploited to access sensitive credentials. This affects all versions up to and including 5.23, with version 5.24.0 providing the fix.

• CVE-2026-13492HIGH 8.8

  The UsersWP WordPress plugin contains a file deletion flaw affecting versions up to 1.2.65. Attackers with basic user accounts (Subscriber level or higher) can delete arbitrary files from the web server, including critical WordPress configuration files. The vulnerability exists because the plugin fails to properly validate and restrict file paths during deletion operations, allowing directory-traversal tricks like `../../../` sequences to escape the intended uploads directory and target sensitive system files.

• CVE-2026-25559HIGH 8.8

  OpenBullet2 versions up to 0.3.2 contain a critical file manipulation flaw that lets authenticated users read, write, and delete arbitrary files on the system. An attacker with valid credentials can exploit this to modify or delete system files, potentially gaining complete control of the host. The risk is particularly severe because OpenBullet2 typically runs with root privileges, meaning any file manipulation has system-wide impact.

• CVE-2026-32193HIGH 8.8

  Microsoft Azure Kubernetes Service contains a path traversal vulnerability that allows an authorized user to escape intended directory restrictions and execute code on the host system. Because the attacker must already have legitimate access to the cluster, this is a privilege escalation risk rather than an unauthenticated attack vector. The flaw lets someone with basic user permissions potentially gain broader control over the infrastructure.

• CVE-2026-35082HIGH 8.8

  A vulnerability in MBS Solutions' universal gateway firmware and related products allows an authenticated user to read arbitrary files from the affected system. The ugw-logread method does not properly validate file path inputs, enabling attackers with legitimate user credentials to bypass access controls and retrieve sensitive data they shouldn't be able to access. This is a local file disclosure issue that requires valid user credentials to exploit.

• CVE-2026-36723HIGH 8.8

  Bookcars v8.3 contains a file handling flaw in its user creation API that allows authenticated users to move files around the server using path traversal tricks. An attacker with valid credentials can exploit this to place files in sensitive locations, overwrite important application code, or execute arbitrary code on the server. This is particularly dangerous because it requires only basic authentication—no special privileges or user interaction needed.

• CVE-2026-40521HIGH 8.8

  FrontAccounting versions prior to 2.4.20 contain a vulnerability that allows authenticated users to upload files in a way that bypasses directory protections. By manipulating the file upload parameter with path traversal sequences (such as ../../../), an attacker can place files outside the intended upload folder and directly into the web server's root directory. When combined with a lack of file extension validation, this enables an attacker to upload and execute arbitrary PHP code, effectively taking control of the affected web server.

• CVE-2026-42200HIGH 8.8

  Coolify, an open-source platform for managing servers, applications, and databases, contains a vulnerability in how it handles file paths during PostgreSQL database initialization. An authenticated user can exploit improper path validation to write files outside the intended directory and execute arbitrary commands on the host system. This vulnerability affects all versions prior to 4.0.0-beta.474, where the issue has been remediated.

• CVE-2026-42305HIGH 8.8

  Dulwich, a Python library used to interact with Git repositories, contains a critical flaw in how it validates filenames when cloning or checking out repositories on Windows. An attacker can craft a malicious Git repository with specially crafted filenames that exploit Windows path syntax interpretation, allowing arbitrary files to be written to a system and potentially executing code. The vulnerability affects Dulwich versions 0.10.0 through 1.2.4 on Windows systems. Users on POSIX systems (Linux, macOS) are not directly vulnerable, but can inadvertently propagate malicious repositories to Windows users.

• CVE-2026-45171HIGH 8.8

  CVE-2026-45171 is a high-severity vulnerability in Idira Privileged Session Manager that allows authenticated users with basic (low-privileged) access to execute arbitrary code on affected systems. The flaw stems from incomplete validation of user input combined with overly permissive folder access controls. An attacker who already has login credentials—even with minimal permissions—could exploit this to gain full system control, making it a critical concern for organizations relying on PSM for credential and session management.

• CVE-2026-47932HIGH 8.8

  Adobe ColdFusion versions 2023.19, 2025.8 and earlier contain a path traversal vulnerability that allows attackers to bypass security controls and access files outside their intended boundaries. An attacker must trick a user into opening a malicious file to exploit this flaw, making it a user-interaction-dependent attack. Once exploited, an attacker gains unauthorized access to sensitive data, can modify files, or disrupt system availability—with the ability to impact other systems or users connected to the vulnerable ColdFusion instance.

• CVE-2026-49247HIGH 8.8

  Jellyfin, a self-hosted media server, has a path traversal vulnerability in its client logging feature that allows any logged-in non-admin user to write files to arbitrary locations on the server. An attacker can craft malicious log uploads with specially crafted names containing directory-escape sequences (../) to place files anywhere the Jellyfin process has write access, enabling potential code execution, data corruption, or service disruption. The issue affects versions 10.9.0 through 10.11.9 and is resolved in 10.11.10.

• CVE-2026-4944HIGH 8.8

  vLLM version 0.14.1 contains a critical vulnerability in its model loading mechanism that forces remote code execution to be enabled, regardless of user security settings. Specifically, two model implementation files (NemotronVL and KimiK25) have hardcoded parameters that override a user's explicit decision to disable remote code execution. An attacker can exploit this by hosting a malicious model on HuggingFace and triggering code execution on systems that load these specific models, even when administrators thought they had disabled this risky feature.

• CVE-2026-55607HIGH 8.8

  Claude Code versions 2.1.38 through 2.1.162 contain a sandbox escape vulnerability that allows attackers to execute arbitrary code on a user's machine outside the seatbelt sandbox. The flaw stems from improper handling of git worktrees, which can be manipulated to create directories named ".git" and access files outside the intended sandbox boundaries. An attacker can exploit this by hosting a malicious repository containing prompt injection content; when a user clones the repository and runs Claude Code against it, symlink manipulation and git fsmonitor execution during worktree operations can overwrite critical shell configuration files (such as .zshenv) in the user's home directory, achieving code execution with the user's privileges.

• CVE-2026-56078HIGH 8.8

  PraisonAI versions before 1.5.115 contain a critical flaw in the MultiAgentMonitor component that allows authenticated users to access, modify, or destroy files anywhere on the system. The vulnerability stems from insufficient validation of agent IDs—the text strings that identify different agents in the system. By injecting path traversal sequences (like ../) into an agent ID, an attacker with valid credentials can navigate outside the intended directory and interact with sensitive files. This could lead to data theft, system crashes, or potentially executing malicious code on the affected server.

• CVE-2026-57296HIGH 8.8

  Jenkins users running the External Workspace Manager Plugin versions 1.3.2 and earlier face a critical security gap: the plugin fails to block path traversal attacks in the custom workspace path field. An attacker with permission to configure a Jenkins job can exploit this to read sensitive files from the Jenkins server itself—potentially including credentials, configuration files, and secrets—and in some scenarios escalate to remote code execution. The vulnerability requires valid Jenkins access but poses severe risk to organizations relying on Jenkins for CI/CD automation.

• CVE-2026-48716HIGH 8.7

  A vulnerability exists in nanobot versions 0.1.5.post3 and earlier that allows an attacker to write files anywhere on a system where the WhatsApp bridge is running. When a user receives a document via WhatsApp through nanobot's bridge, the application downloads the file and saves it to disk. An attacker can craft a malicious filename containing path traversal sequences (like `../../../`) to escape the intended media directory and write to sensitive locations, such as SSH configuration directories or system files. Since the attacker controls both the filename and file content, they can potentially overwrite critical system or user files. This requires network access and some knowledge of the target system's directory structure, but does not require user interaction beyond receiving a WhatsApp message.

• CVE-2026-54406HIGH 8.7

  A path traversal vulnerability in self-hosted UniFi Network Application instances allows a high-privilege network-adjacent attacker to write files on the underlying host system, potentially leading to system compromise. While the attacker must already possess elevated credentials and network access, successful exploitation can expand their control beyond the application to the host operating system itself.

• CVE-2024-40646HIGH 8.6

  Vertex, a management tool for private tracker users, contains a path traversal vulnerability that allows remote attackers to access files outside their intended directory. An attacker can craft malicious requests to navigate the file system and read sensitive data without authentication. The vulnerability affects all versions prior to a specific patch commit and carries a high severity rating due to its ease of exploitation and significant impact on confidentiality.

• CVE-2025-69128HIGH 8.6

  CVE-2025-69128 is a path traversal vulnerability in EMV JobCareer versions 7.3 and earlier that allows an attacker to access files and directories outside of their intended scope. An unauthenticated, remotely located threat actor can exploit this without any special permissions or user interaction, potentially disrupting the availability of the affected system. This type of vulnerability is particularly dangerous because it operates over the network and requires no authentication, making it accessible to anyone with network connectivity to the vulnerable application.

• CVE-2026-40769HIGH 8.6

  A vulnerability in Contact Form Extender for Divi (versions 1.0.6 and earlier) allows attackers to delete arbitrary files from affected websites without needing to log in or authenticate. The flaw stems from insufficient access controls on file deletion functionality, meaning anyone with network access to the site can trigger file removal. This poses a significant availability risk, as attackers could disable websites by deleting critical files or data storage.

• CVE-2026-46491HIGH 8.6

  SimpleSAMLphp-casserver versions before 7.0.3 contain a path traversal vulnerability in their file-based ticket storage mechanism. An attacker can manipulate CAS ticket identifiers to read, deserialize, and potentially delete arbitrary files on the server. The vulnerability exists in public-facing CAS validation endpoints that lack proper input sanitization, making it exploitable without authentication.

• CVE-2026-47368HIGH 8.6

  A path traversal vulnerability in UniFi OS allows attackers already present on a network to read sensitive data from affected devices or cloud instances. The attacker doesn't need valid credentials or user interaction—they only need network access to exploit the flaw and potentially extract configuration files, credentials, or other stored information.

• CVE-2026-49991HIGH 8.6

  RustFS 1.0.0-beta.4 contains a critical flaw in its Snowball auto-extract feature that allows authenticated users to bypass multi-tenant isolation. An attacker with only the permission to upload files to their own bucket can manipulate file paths during extraction to write files into other users' buckets, compromising data confidentiality and integrity across the entire system. The vulnerability exploits a chain of three separate validation failures in path handling and permission checking.

• CVE-2026-54403HIGH 8.6

  A path traversal vulnerability in Ubiquiti's UniFi OS allows an attacker with network access to bypass authentication on affected UniFi devices and controllers. The flaw does not require user interaction or special privileges to exploit, meaning an attacker positioned on the same network could potentially gain unauthorized access to UniFi OS instances without valid credentials. This is a serious issue because UniFi devices are commonly used to manage enterprise and residential networks, and compromised access could lead to network reconnaissance, configuration changes, or lateral movement.

• CVE-2026-55117HIGH 8.6

  A network-accessible vulnerability in UniFi Access Application allows an unauthenticated attacker to read arbitrary files from the host system through path traversal. An attacker positioned on the network can craft requests that bypass directory restrictions, potentially exposing sensitive configuration files, credentials, or application data without requiring any user interaction or prior access privileges.

• CVE-2026-58192HIGH 8.6

  Appium, a popular cross-platform automation framework used for testing mobile and web applications, contains a critical path traversal vulnerability in its storage plugin. An unauthenticated attacker can send specially crafted requests to bypass the storage directory boundary using directory traversal sequences (../) and delete arbitrary files or directories on the affected system. The vulnerability exists in versions prior to 1.1.6 and has been patched in the latest release.

• CVE-2026-52797HIGH 8.5

  Gogs, a self-hosted Git platform, contains a path traversal vulnerability affecting versions before 0.14.0. An authenticated user can manipulate input passed to the git diff command to write comparison results to arbitrary file locations outside the intended repository directory. This allows an attacker with valid credentials to overwrite or create files on the server, potentially compromising system integrity and availability.

• CVE-2026-45482HIGH 8.4

  A path traversal vulnerability in GitHub Copilot and Visual Studio Code allows an attacker to bypass a local security feature by manipulating file paths. An unauthorized party can exploit this flaw on a compromised or shared machine without requiring special privileges or user interaction, potentially gaining unauthorized access to sensitive files or directories that should be restricted.

• CVE-2026-49238HIGH 8.4

  Canonical Multipass before version 1.16.3 contains a path validation flaw that allows a user with root access inside a guest virtual machine to escape the sandbox and read files on the host system. The vulnerability exists in the SFTP server component that bridges file sharing between the guest and host. An attacker can craft specially formatted file access requests containing path traversal sequences that bypass the intended directory boundaries, giving them access to sensitive files on the host machine with the privileges of the root process managing the file share.

• CVE-2026-58302HIGH 8.4

  LinuxCNC's rtapi_app component, which runs with root privileges, loads software modules based on user input without properly validating the file path. An attacker without special privileges can exploit path traversal techniques to point the application toward a malicious library file they control, causing the privileged process to load and execute it. This results in immediate root-level compromise of the system. The vulnerability affects LinuxCNC versions before 2.9.9.

• CVE-2026-56233HIGH 8.3

  Capgo versions before 12.128.2 contain a path traversal vulnerability that allows authenticated users with build permissions to upload files to unintended locations on the server. By manipulating the upload path with traversal sequences (like `../`), attackers can bypass upload restrictions and access internal administrative endpoints. This grants them privileged API access that should only be available to administrators, leading to server-level privilege escalation. The vulnerability requires prior authentication and build permissions, but once exploited, results in significant system compromise.

• CVE-2026-58170HIGH 8.3

  Vibe-Trading versions before 0.1.10 contain a path traversal vulnerability in how they handle trading proposal identifiers. An authenticated attacker can craft a proposal identifier with path traversal sequences (like '../') to load an arbitrary JSON file from the server as a live trading mandate. When combined with the file upload capability, an attacker can upload a malicious JSON file to a predictable location, then use path traversal to make the application load it as an authoritative trading instruction. Because the application skips validation of trading ceilings when they are absent from the JSON, the attacker gains full control over the committed trading mandate—potentially executing unauthorized trades or modifying trading parameters.

• CVE-2026-43624HIGH 8.2

  F5-TTS versions up to 1.1.20 contain a path traversal vulnerability in their finetune Gradio interface that lets unauthenticated attackers write files anywhere on the server's filesystem. The flaw stems from inadequate validation of project names before they're used in file system operations. An attacker can bypass the intended directory boundary by supplying absolute paths (like /tmp/EVIL) and create malicious files with arbitrary content in locations the web server can access. No authentication is required to exploit this.

• CVE-2026-44705HIGH 8.2

  The tmp package for Node.js, used to create temporary files and directories, has a path traversal flaw in versions before 0.2.6. If an application passes user-supplied input to tmp's prefix, postfix, or dir options without validation, an attacker can use path traversal sequences like '../' to write files outside the intended temporary directory. This means an attacker can potentially place malicious files in arbitrary locations on the system where the Node.js process has write permissions, which could lead to code execution, configuration tampering, or denial of service depending on what gets written and where.

• CVE-2026-49982HIGH 8.2

  The tmp Node.js library, versions up to 0.2.6, contains a path traversal vulnerability that allows attackers to create files or directories outside the intended temporary directory. The vulnerability exists because the library's path validation only checks string inputs for the '..' substring, but fails to properly validate non-string inputs like Arrays, Buffers, and objects. When these objects are converted to strings during file creation, they can contain path traversal sequences that bypass the check. An attacker can exploit this by sending malicious data through application parameters (such as JSON fields or query strings) that get passed to tmp functions, potentially creating files or directories anywhere on the system with the privileges of the running process.

• CVE-2026-52868HIGH 8.2

  An unauthenticated attacker can bypass access controls to read worklist records that should remain isolated to specific departments or clinical areas. In healthcare deployments with multiple separate organizational units (AEs), an attacker could potentially cross data boundaries and access sensitive patient information belonging to other departments. No authentication is required, and exploitation is straightforward over the network.

• CVE-2026-53906HIGH 8.2

  MCO (MyComplianceOffice) contains a vulnerability in its file handling system that allows attackers to write files to unintended locations on the server and discover sensitive path information through error messages. The flaw stems from inadequate validation of filenames during data export and upload operations. An attacker with network access can exploit this without authentication to alter file placement or gather reconnaissance data about the server's directory structure.

• CVE-2026-55667HIGH 8.2

  File Browser, a multi-tenant file management system, contains a critical authorization bypass vulnerability in versions prior to 2.63.16. An authenticated user with only basic file creation permissions can delete arbitrary files outside their assigned scope—including other tenants' data and the application's own database—by exploiting a symlink following flaw in the failed-upload cleanup routine. The vulnerability exists because the RemoveAll operation skips symlink validation that other file operations enforce, allowing a low-privilege user to chain directory escape and deletion in a single attack.

• CVE-2026-59195HIGH 8.2

  pnpm, a widely-used Node.js package manager, contains a path traversal vulnerability in how it processes lockfile configuration dependencies. When a developer runs pnpm install on a project with a malicious pnpm-lock.yaml file, an attacker can craft dependency names that bypass directory restrictions and create symlinks outside the intended node_modules/.pnpm-config location. This allows an attacker to write files to arbitrary locations on the developer's system, potentially overwriting critical files or injecting malicious code into the project. The vulnerability requires user interaction (running pnpm install), but affects development environments across multiple operating systems.

• CVE-2026-11416HIGH 8.1

  MoviePilot, a media download application, has a critical flaw in how it handles files downloaded from cloud storage services like AliPan, U115, and Rclone. When a file is downloaded, the application takes the filename provided by the cloud service and directly uses it to determine where to save the file locally. An attacker who compromises or manipulates the cloud storage metadata can craft a filename containing path traversal sequences (like ../) to trick MoviePilot into writing files outside the intended download directory. This could allow overwriting sensitive application files, configuration files, or plugins, potentially compromising the entire system.

• CVE-2026-11816HIGH 8.1

  Keras, a widely-used machine learning library, contains a path traversal vulnerability in its archive extraction functions that can allow attackers to write files outside the intended extraction directory. The vulnerability affects Keras versions before 3.14.0 and stems from validation logic that checks paths against the wrong directory reference—the process's current working directory instead of where files are actually being extracted. In common environments like Docker containers and Jupyter notebooks where the working directory is set to the filesystem root, this check becomes ineffective. An attacker can craft a malicious archive that, when extracted by a vulnerable Keras application, overwrites critical files on the system or injects malicious code into machine learning pipelines.

• CVE-2026-11846HIGH 8.1

  CVE-2026-11846 is a file deletion flaw in IEI Integration Corp's iVEC-IEI Virtualization Edge Computer that lets authenticated users remotely delete arbitrary files or folders on affected systems. An attacker with valid credentials can weaponize this to destroy data, corrupt configurations, or crash services. The vulnerability carries a CVSS score of 8.1 (HIGH) because it requires authentication but enables substantial operational damage.

• CVE-2026-44973HIGH 8.1

  Billy is a Go library that provides an abstraction layer for filesystem operations. Versions before 5.9.0 contain path traversal vulnerabilities that allow attackers with authenticated access to bypass directory restrictions using specially crafted paths (such as those containing ".." sequences). An attacker could potentially read or modify files outside the intended directory boundaries. Applications that depend on Billy for filesystem isolation are at risk of exposing sensitive files on the system.

• CVE-2026-45233HIGH 8.1

  HTMLy CMS versions up to and including 3.1.1 contain a file manipulation vulnerability affecting authenticated users. An attacker with login credentials can exploit an admin autosave endpoint to move files to unintended locations on the server by crafting requests with path traversal sequences. Since the endpoint fails to properly validate or restrict file paths, an authenticated attacker could relocate sensitive application or configuration files to web-accessible directories or other locations that could lead to information disclosure or system compromise.

• CVE-2026-45565HIGH 8.1

  Roxy-WI, a web management interface for popular open-source load balancers and reverse proxes, contains a flaw in how it validates user input across dozens of fields—including SSH credentials and server descriptions. An attacker with login credentials can bypass security checks by appending certain shell metacharacters to a path traversal payload, allowing them to read or modify files outside the intended scope. The vulnerability affects versions 8.2.6.4 and earlier, with no public patches available at publication.

• CVE-2026-45569HIGH 8.1

  Roxy-WI, a web-based control panel for managing HAProxy, Nginx, Apache, and Keepalived servers, contains a path-traversal vulnerability in versions 8.2.6.4 and earlier. A security patch was attempted but contained a critical logic error: it checks whether the string '..' appears as an exact match in a list of values, rather than checking whether '..' appears anywhere within a file path. This means attackers can still bypass the check using common path-traversal payloads like '../../etc/passwd' or '..\..\/etc/passwd'. An authenticated user can exploit this to read, modify, or delete arbitrary configuration files on the server.

• CVE-2026-46402HIGH 8.1

  Microsoft UFO, an open-source framework for intelligent automation, contains a path traversal vulnerability in version 3.0.1-4-ge2626659. An authenticated user can manipulate task names to write log files and directories outside the intended logs directory, potentially overwriting critical files or gaining unauthorized file system access on the affected system.

• CVE-2026-46484HIGH 8.1

  Headplane, a web interface for managing Headscale VPN infrastructure, contains a path traversal and authorization bypass flaw in how it handles node and user rename operations. An authenticated attacker can exploit this to access or modify resources they should not be permitted to touch, potentially affecting the integrity and availability of the VPN management system. Versions 0.6.3 and 0.7.0-beta.3 contain the fix.

• CVE-2026-49297HIGH 8.1

  Apache Airflow's Google Cloud Storage integrations contain a path traversal vulnerability that allows malicious object naming to write files outside their intended destination. If your DAGs ingest data from GCS buckets controlled by external partners, service accounts, or public sources, an attacker could craft object names with `..` sequences to overwrite files on SFTP servers or worker machines. The risk is elevated in multi-tenant or federated data environments where bucket write permissions are granted to less-trusted principals.

• CVE-2026-49340HIGH 8.1

  Gonic, a free-software music streaming server that implements the Subsonic API, contains a vulnerability in how it handles playlist creation and updates. Any authenticated user—not just administrators—can exploit a flaw in the playlist write function to place files anywhere on the server's filesystem and create directories with overly permissive access controls. This was patched in version 0.21.0.

• CVE-2026-53777HIGH 8.1

  Perry, a build or artifact management tool, has a path traversal vulnerability affecting versions before 0.5.1159. When a malicious build server sends specially crafted messages to a Perry client, it can trick the client into writing files to unintended locations on the system. This could allow an attacker controlling the server to overwrite important files or steal sensitive data from the client machine. The vulnerability requires user interaction—the client must be actively connected to and communicating with the compromised server—but once exploited, the impact is significant.

• CVE-2026-54591HIGH 8.1

  AsyncSSH, a Python library that enables secure shell connections, contains a flaw that allows a malicious SSH server to write files anywhere on a user's computer. When an AsyncSSH client connects to a compromised or hostile server, that server can trick the client into saving files outside the intended download directory by embedding path-traversal sequences (like '../') in filenames. This happens because the library doesn't properly validate where files are being written. The vulnerability affects all versions before 2.23.1 and requires user interaction—the user must initiate an SCP (secure copy) operation against an untrusted server.

• CVE-2026-56258HIGH 8.1

  Crawl4AI, a web scraping and automation framework, contains a flaw that allows attackers to write files anywhere on a system without authentication. The vulnerability exists in features that take screenshots and generate PDFs. Attackers can exploit this by manipulating file path parameters and using symlinks (shortcuts to files and directories) to bypass safety checks, potentially leading to system compromise if the application runs with elevated privileges.

• CVE-2026-56876HIGH 8.1

  extract-zip, a popular Node.js package for unzipping files, fails to validate symlink targets during extraction. An attacker can craft a malicious zip archive containing symlinks with path traversal sequences (e.g., '../../../../etc/passwd') that point outside the intended extraction directory. When the library extracts these symlinks without validation, it creates links to arbitrary filesystem locations. Depending on the application's usage pattern and file permissions, this could enable an attacker to read sensitive files or overwrite critical data.

• CVE-2026-58372HIGH 8.1

  SeaweedFS, a distributed file system and cloud storage solution, contains a critical authorization bypass flaw in its S3-compatible gateway. An authenticated user with write access to one S3 bucket can exploit a path traversal weakness to delete files in completely different buckets belonging to other tenants. The vulnerability stems from the system validating bucket authorization at the URL level but failing to inspect the contents of deletion request bodies, where attackers can inject directory-traversal sequences (../) to escape the intended bucket boundary and reach objects they should not be able to access.

• CVE-2026-7311HIGH 8.1

  The TinyPNG compression plugin for WordPress contains a dangerous flaw that lets authenticated users with author-level permissions delete any file on the web server. An attacker exploits this by manipulating image metadata during the attachment deletion process, allowing them to target critical files like wp-config.php. Deleting the right file can give the attacker full control of the WordPress installation. The vulnerability affects all versions up to and including 3.6.13.

• CVE-2026-8442HIGH 8.1

  The WP Review Slider Pro WordPress plugin contains a file deletion vulnerability that allows attackers with subscriber-level account access to delete arbitrary files from the web server. The flaw stems from incomplete authorization checks and insufficient validation of file paths in the plugin's AJAX handlers. An attacker could exploit this to remove critical site files, potentially creating conditions for further compromise such as remote code execution. The vulnerability affects all versions up to and including 12.6.8.

• CVE-2026-9843HIGH 8.1

  A critical vulnerability affects popular WordPress form plugins—Database for Contact Form 7, WPforms, and Elementor forms—in versions up to 1.5.1. Attackers can craft malicious form entries that, when viewed or edited by a site administrator, trigger deletion of arbitrary files from the server. This includes sensitive configuration files like wp-config.php, which can lead to site takeover or complete compromise. The attack requires no authentication from the attacker and exploits a gap in how file paths are validated before deletion.

• CVE-2026-22926HIGH 7.8

  Omnissa Workspace ONE Assist for macOS contains a local privilege escalation vulnerability that allows an authenticated user with standard privileges to gain elevated system access. An attacker already present on a macOS system could exploit this flaw to escalate their permissions without requiring user interaction, potentially compromising the entire system and its data.

• CVE-2026-22927HIGH 7.8

  Omnissa Workspace ONE Tunnel for Windows contains a local privilege escalation vulnerability that allows a logged-in user to gain elevated system permissions. An attacker with standard user access can exploit this flaw without requiring user interaction or network access, making it a direct path to administrative control of affected Windows systems. This is particularly concerning in environments where Workspace ONE is deployed for secure remote access and device management.

• CVE-2026-50207HIGH 7.8

  A flaw in how the Acer Connect M6E 5G processes cellular commands allows local applications to bypass security controls and send unverified AT commands directly to the device's baseband modem. This creates a pathway for local attackers to extract sensitive baseband files or interfere with cellular connectivity. The vulnerability requires local access and unprivileged application-level execution, making it a risk in multi-app environments where untrusted code can run.

• CVE-2026-52752HIGH 7.8

  Ghidra, the NSA's open-source reverse-engineering framework, contains a flaw in how it handles user-installed extensions. When you install an extension (a ZIP file that adds features), the software doesn't properly check whether filenames inside that ZIP are trying to escape the extension directory using path-traversal tricks like '../'. A malicious actor can create a specially crafted extension that, when installed, writes files anywhere on your system where Ghidra has write access—potentially including executable locations that would let them run arbitrary code with the same privileges as your user account.

• CVE-2026-52755HIGH 7.8

  Ghidra, the NSA's reverse-engineering and binary analysis framework, contains a vulnerability in its theme import feature that allows an attacker to write files anywhere on a user's system, not just in the theme directory. An attacker can craft a malicious theme file—distributed as a ZIP archive—with specially crafted filenames that escape the intended directory. When a user imports this theme, files get written to unexpected locations, potentially allowing code execution or modification of critical system files like SSH keys or shell initialization scripts. This requires the user to actively import the malicious theme, but once triggered, the impact is severe.

• CVE-2026-53925HIGH 7.8

  Glances, a popular open-source system monitoring tool, contains a vulnerability in versions 4.0.8 through 4.5.4 that allows local attackers with configuration file access to execute arbitrary commands or write to arbitrary files. The issue stems from improper handling of shell metacharacters (>, |, &&) in command configurations. When Glances loads monitoring commands from its configuration file, it fails to validate or escape these special characters, enabling an attacker to redirect output to sensitive files, chain malicious commands, or pipe data to unauthorized programs. This is a local attack requiring file modification privileges but poses significant risk in multi-user or containerized environments.

• CVE-2026-55878HIGH 7.8

  Symfony UX, a JavaScript framework for Symfony developers, contains a path traversal vulnerability in its ux:install command. When installing recipe kits, the command copies files based on a list provided by the kit. An attacker who creates a malicious kit or compromises an existing one can exploit insufficient path validation to write files anywhere on the system or read sensitive files outside the intended recipe directory. The vulnerability affects versions 2.32.0 through 2.36.0 and 3.0.0 through 3.1.x, and is resolved in versions 2.36.1 and 3.2.0.

• CVE-2025-60223HIGH 7.7

  WPBot Pro, a WordPress chatbot plugin, contains a vulnerability that allows subscribers (low-privilege users) to delete arbitrary files from a WordPress installation. This affects versions 13.6.5 and earlier. The flaw does not require user interaction and can be exploited remotely by any authenticated subscriber, making it a direct threat to site integrity and availability.

• CVE-2026-14468HIGH 7.7

  HashiCorp Terraform Enterprise has a path traversal vulnerability in how it processes modules from version control systems. An authenticated user can craft a malicious module that escapes the intended repository boundaries and includes files from elsewhere on the server—such as configuration files or credentials—then download those files. The vulnerability affects Terraform Enterprise versions prior to v2.0.4 and v1.2.4.

• CVE-2026-42129HIGH 7.7

  A vulnerability in Grafana's Loki data source plugin allows users with basic read-only (Viewer) permissions to bypass intended access controls and reach administrative endpoints they should not access. By crafting malicious file paths, an authenticated attacker can retrieve sensitive backend configuration details and internal service information that would normally be restricted to administrators. This is a path traversal flaw—a classic technique for escaping intended directory boundaries.

• CVE-2026-45807HIGH 7.7

  Kestra, an open-source workflow orchestration platform, contains a path traversal vulnerability in versions before 1.0.43 and 1.3.19. An authenticated user can craft a specially encoded request using %2E%2E (URL-encoded dots) to bypass the platform's path validation guard. Once the request reaches the file-reading logic, the encoded dots are decoded back to .. and allow navigation outside intended directories. An attacker with valid credentials can read sensitive files on the host system—including /etc/passwd, environment secrets, and other users' execution data—that the Kestra process has permission to access. The vulnerability requires authentication and affects the confidentiality of data stored on the server.

• CVE-2026-47179HIGH 7.7

  Arcane, a container management interface for Docker, has a path-traversal vulnerability that allows authenticated users to read arbitrary files from the server. An attacker can craft a malicious Docker Compose configuration file with include directives pointing to sensitive system files—such as /etc/passwd or Arcane's own database—and then retrieve the contents through the project file API. Since Arcane stores password hashes and API keys in its SQLite database, successful exploitation can lead to account takeover and remote code execution on the host system. The issue affects all versions prior to 1.19.4.

• CVE-2026-49465HIGH 7.7

  n8n workflow automation platform contains a path traversal vulnerability affecting versions before 1.123.48, 2.21.8, and 2.22.4. An authenticated user with workflow creation or modification permissions can bypass file sandbox restrictions by supplying a local filesystem path in Git node operations. This allows an attacker to read the contents of any git repository accessible to the n8n process, even if those paths are normally blocked by the N8N_RESTRICT_FILE_ACCESS_TO sandbox configuration. The vulnerability requires authentication and workflow modification privileges but could expose sensitive repository data to unauthorized access.

• CVE-2026-49957HIGH 7.7

  Hermes WebUI versions before 0.51.296 contain a flaw in how they validate workspace boundaries for remote terminal sessions. An attacker who has legitimate access to the system can trick the application into accepting a system directory like /etc as a valid workspace root, bypassing security checks designed to prevent this. Once bypassed, the attacker can read sensitive files from the system through the workspace file-read features, effectively escaping the intended sandbox that should contain their access to user-specific directories.

• CVE-2026-49984HIGH 7.7

  Kestra, an open-source workflow orchestration platform, contains a path-traversal vulnerability that allows authenticated users to read files anywhere on the server filesystem. The flaw exists because Kestra checks user-supplied file paths for directory traversal attacks using forward slashes, but an attacker can bypass this check by using Windows-style backslashes instead. After the validation passes, the backslashes are converted to forward slashes, enabling the traversal. Any user with the ability to view a workflow execution—the lowest privilege level in Kestra—can exploit this to escape the storage sandbox and read sensitive files across all tenants and namespaces, including databases, secrets, and system credentials.

• CVE-2026-50567HIGH 7.7

  Fission, an open-source serverless framework for Kubernetes, contains a path traversal vulnerability in its archive extraction logic. When Fission fetches and extracts archives (zip files) from URLs specified in Package or Deployment configurations, it fails to validate that extracted files remain within the intended destination directory. An attacker who controls the archive URL can craft a malicious zip file with entries using relative path sequences like `../../` to write files outside the target directory. This allows unauthorized file writes to sensitive locations including other tenants' package directories, mounted secrets, configuration volumes, or even the fetcher process's own binary. The vulnerability exists in versions prior to 1.25.0 and affects the fission-fetcher sidecar that runs in each environment pod.

• CVE-2026-54017HIGH 7.7

  Open WebUI, a self-hosted AI platform, contains a path traversal vulnerability in its terminal-server reverse proxy. An authenticated user with terminal access can manipulate the request path using encoded traversal sequences (like `../`) to bypass intended boundaries and reach files or endpoints they shouldn't access on the terminal server or connected internal services. The vulnerability affects versions before 0.9.6 and requires valid user authentication to exploit, but no special privileges beyond terminal access.

• CVE-2026-55874HIGH 7.7

  SeaweedFS, a distributed storage system, contains a path traversal vulnerability in its S3 API gateway that allows authenticated users to bypass bucket isolation. An attacker with valid credentials scoped to one bucket can use manipulated copy-source headers to read objects stored in other buckets. The flaw stems from insufficient validation of dot-dot (..) path segments in the X-Amz-Copy-Source header during CopyObject and UploadPartCopy operations. This breaks a fundamental security boundary in multi-tenant storage systems. The vulnerability affects all versions prior to 4.34.

• CVE-2026-58460HIGH 7.7

  A vulnerability in react-native-receive-sharing-intent, a library that handles file sharing on Android, allows a malicious app installed on the same device to overwrite files in another app's private storage. An attacker can craft a specially formatted file name containing path traversal sequences (like "../") and use Android's file sharing mechanism to trick the vulnerable app into writing files outside its intended cache directory. This could result in corrupted databases, modified configuration files, or poisoned cached data that alters the app's behavior.

• CVE-2026-59221HIGH 7.7

  Open WebUI, a self-hosted AI platform, contains a path traversal vulnerability in its terminal routing that allows authenticated users to access files and directories outside the intended sandbox. The vulnerability exists because the application only decodes percent-encoded URL paths eight times during normalization, but an attacker can craft a payload with nine levels of encoding to bypass this check and reach sensitive files on the server.

• CVE-2026-59832HIGH 7.7

  SiYuan is an open-source note-taking and knowledge management application. Before version 3.7.1, an authenticated user could exploit improper path handling in the snippets feature to read sensitive files from the application's configuration and database directories. The vulnerability allows an attacker who has valid SiYuan credentials to bypass directory containment checks and access workspace secrets and the document database by crafting specially-formed requests with path traversal sequences.

• CVE-2026-6961HIGH 7.6

  Mattermost has a path traversal vulnerability in how it processes filenames from federated servers during shared channel file synchronization. An attacker controlling a federated Mattermost instance can craft malicious filenames with directory traversal sequences (e.g., ../../../) to write files to unintended locations on a target server's filesystem. This could allow an attacker to overwrite configuration files, inject malicious content, or degrade system availability.

• CVE-2016-20076HIGH 7.5

  The WordPress Simple-Backup plugin version 2.7.11 is vulnerable to unauthorized file access and deletion attacks. An attacker without any login credentials can manipulate specific parameters in the plugin's backup tool to either download sensitive files like database configurations and backups, or delete critical files such as .htaccess. The vulnerability stems from inadequate validation of user input, allowing attackers to navigate the server's directory structure and target files outside the intended backup folder.

• CVE-2016-20081HIGH 7.5

  HB Audio Gallery Lite version 1.0.0 contains a critical flaw that allows attackers to download any file from a website where the plugin is installed—including sensitive configuration files—without needing to log in or authenticate. The vulnerability exists in how the plugin handles file download requests, specifically in the audio-download.php endpoint. By manipulating the file path parameter with directory traversal sequences (e.g., '../'), attackers can escape the intended gallery directory and access files like wp-config.php, which contains database credentials and security keys.

• CVE-2017-20248HIGH 7.5

  Apptha Slider Gallery version 1.0 contains a path traversal flaw that lets attackers download any file from the server without needing to log in. By crafting requests with directory-traversal sequences (such as ../) in the imgname parameter sent to asgallDownload.php, an attacker can escape the intended image directory and retrieve sensitive files like configuration files, database backups, or source code. This is a remote attack that requires no authentication or user interaction.

• CVE-2017-20250HIGH 7.5

  Mac Photo Gallery version 3.0 has a path traversal vulnerability in its download functionality that allows anyone on the internet to retrieve arbitrary files from the affected server without authentication. By crafting specially formatted requests to the macdownload.php script and manipulating the albid parameter with directory traversal sequences (such as ../), an attacker can escape the intended plugin directory and download sensitive files like WordPress configuration files. This is a straightforward but serious flaw because it requires no special privileges, no user interaction, and no authentication to exploit.

• CVE-2018-25408HIGH 7.5

  A vulnerability in Open ISES Project version 3.30A allows anyone on the internet to download files from an affected server without needing to log in. An attacker can craft a specially formatted request to the ajax/download.php endpoint that uses path traversal techniques (such as ../ sequences) to escape the intended download directory and retrieve sensitive files like configuration files, database backups, or system files. The vulnerability requires no authentication, no special user interaction, and can be exploited over the network.

• CVE-2024-32729HIGH 7.5

  CVE-2024-32729 is a path traversal vulnerability in QuantumCloud Conversational Forms for ChatBot that allows attackers to access files and directories outside the intended restricted folder. An attacker with network access can exploit this flaw to read sensitive files from the application's host system without authentication. The vulnerability affects all versions of the product through version 1.1.8, and the attack requires only network connectivity—no special privileges or user interaction are needed.

• CVE-2025-69131HIGH 7.5

  A critical flaw in the WordPress & WooCommerce Scraper Plugin (versions 1.0.7 and earlier) allows attackers to download arbitrary files from affected servers without authentication. An attacker can exploit this remotely by making a specially crafted request, potentially exposing sensitive data such as configuration files, database backups, or other confidential information stored on the web server.

• CVE-2025-70796HIGH 7.5

  WTI (Wireless Technology, Inc.) version 3.5.0 released May 24, 2024 contains a path traversal flaw in its web management interface that does not require authentication to exploit. An attacker can send crafted HTTP requests with directory traversal sequences (such as '../' patterns) to read files outside the intended web root, potentially exposing sensitive system files, configuration data, credentials, and other confidential information. The vulnerability is remotely exploitable over the network with no special access or user interaction required.

• CVE-2026-0270HIGH 7.5

  Palo Alto Networks Cortex XSOAR running on Linux contains a flaw that lets an attacker on the same network write files to the server if they can intercept and modify network traffic in transit. The vulnerability requires the attacker to be positioned to perform a man-in-the-middle attack, but once they are, they can exploit the path traversal weakness to place arbitrary files on the host system. This is a significant risk in environments where XSOAR is exposed to untrusted network segments or where network security controls may be incomplete.

• CVE-2026-10108HIGH 7.5

  xiaomusic version 0.5.7 contains an unauthenticated vulnerability that allows attackers to download files from anywhere on the server, not just the music directory. The flaw exists in how the application validates file paths when serving content. An attacker can craft special requests that bypass this validation to read sensitive files—such as configuration files, private keys, or application source code—without needing any credentials. The vulnerability affects any exposed xiaomusic instance running the affected version.

• CVE-2026-11911HIGH 7.5

  The Simple File List WordPress plugin contains a critical flaw that allows anyone on the internet to delete files from a website's server without logging in. Because the vulnerable code lacks proper validation of file paths, an attacker can target sensitive files like wp-config.php—the configuration file that contains database credentials and security keys. Deleting such files can crash the website or create an opening for the attacker to take over the server entirely. The vulnerability exists in all versions up to and including 6.3.7.

• CVE-2026-12243HIGH 7.5

  NLTK 3.9.4 contains a path traversal vulnerability that allows an attacker to read files from the server by crafting specially-encoded resource names. The vulnerability exists because the security check looks for obvious traversal patterns (like `../`) but misses percent-encoded variations (like `..%2f`). When the validation passes, a decoding step reveals the actual path traversal sequence, giving attackers access to sensitive files that the Python process can read. Any application using NLTK to load data from user-controlled input is at risk.

• CVE-2026-13251HIGH 7.5

  A directory traversal vulnerability in the Perfmatters WordPress plugin allows attackers to read files they shouldn't have access to. An attacker can request arbitrary files on a server by manipulating a parameter in a specially crafted request, potentially exposing passwords, configuration files, or other sensitive data. The vulnerability affects all versions up to 2.6.4 and requires three specific conditions: the Local Google Fonts feature must be enabled, WordPress pretty permalinks must be active, and RSS feed links must remain enabled in plugin settings. No authentication is needed to exploit this flaw.

• CVE-2026-13347HIGH 7.5

  The Hide My WP Lite WordPress plugin up to version 1.3 contains a flaw that allows anyone on the internet to read sensitive files from affected websites without logging in. An attacker can exploit path traversal weaknesses in how the plugin handles file requests to download configuration files, database credentials, and other protected content. The vulnerability is triggered through specific URL parameters when Elementor integration is enabled, making this a serious information disclosure risk for any site running the vulnerable plugin with Elementor active.

• CVE-2026-13369HIGH 7.5

  The Ninja Forms – File Uploads plugin for WordPress contains a flaw that allows unauthenticated attackers to read sensitive files from the web server. The vulnerability exists in how the plugin handles file attachments when users interact with form progress-saving features. By manipulating a request parameter, an attacker can bypass security checks and trick the plugin into treating arbitrary server files as email attachments, exposing their contents. This affects all versions up to and including 3.3.29.

• CVE-2026-14244HIGH 7.5

  The Jssor Slider plugin for WordPress contains a directory traversal vulnerability that allows unauthenticated attackers to read files from the server. An attacker can manipulate the 'url' parameter to access sensitive files outside the intended directory, potentially exposing database credentials, configuration files, and other confidential data. This affects all versions up to and including 3.1.24.

• CVE-2026-14327HIGH 7.5

  A directory traversal vulnerability exists in the AR for WordPress plugin affecting all versions through 8.40. Unauthenticated attackers can read arbitrary files from the server by exploiting publicly accessible AJAX handlers to obtain a nonce and encryption key, then using those credentials to access files via a crafted 'file' parameter. This could expose sensitive configuration files, database credentials, and other confidential data. The vulnerability is practical to exploit on default installations where no license key is configured.

• CVE-2026-14352HIGH 7.5

  The AR for WooCommerce plugin—used by WordPress sites to add augmented reality features to product pages—contains a path traversal flaw that allows anyone on the internet to read sensitive files from affected servers. An attacker needs only to craft a malicious request; no login is required. The vulnerability bypasses three separate security controls, including a broken nonce system and a weak encryption mechanism, making it straightforward to exploit in practice.