By weakness (CWE)

CWE-22: related vulnerabilities

CVEs classified under CWE-22. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

291 published vulnerabilities · page 2 of 3

• CVE-2026-20191HIGH 7.5

  Cisco Catalyst Center contains a flaw that allows someone on the internet to read files from inside the system without needing a password. An attacker sends a specially crafted web request that bypasses security checks, gaining unauthorized access to sensitive data stored within the application's restricted areas. The vulnerability requires no user interaction and can be exploited directly over the network.

• CVE-2026-32847HIGH 7.5

  DeepCode contains a path traversal vulnerability that allows anyone on the internet to read sensitive files from the server without needing to authenticate or provide credentials. An attacker can craft specially-encoded URLs that trick the application into serving files it shouldn't, such as SSH keys, TLS certificates, and application secrets. The vulnerability exists in how the application handles file paths in its web interface, and the encoding bypass makes it straightforward to exploit.

• CVE-2026-36848HIGH 7.5

  Gigamon GigaVUE OS versions 5.16.1 and earlier contain a directory traversal vulnerability in the H-VUE subsystem that allows unauthenticated remote attackers to read sensitive files from the affected system. The flaw does not require any user interaction and can be exploited over the network, making it a meaningful security risk for organizations relying on Gigamon visibility infrastructure.

• CVE-2026-44017HIGH 7.5

  Docling, a document processing library, contains a vulnerability in how it downloads and extracts AI model files. Before version 2.91.0, the software did not properly validate file paths when extracting ZIP archives, allowing an attacker who intercepts or compromises the model download source to write files anywhere on the system where the application has write access. This could lead to remote code execution, persistent backdoors, or data destruction. The vulnerability requires attackers to first compromise the download source—either through supply chain attacks, DNS spoofing, or man-in-the-middle interception—making it a moderately difficult but high-impact attack.

• CVE-2026-44594HIGH 7.5

  esm.sh, a popular CDN for JavaScript development that eliminates the need for build processes, contains a vulnerability in how it processes package metadata. An attacker can publish a malicious npm package that tricks the esm.sh server into reading and exposing sensitive files from its own filesystem. This happens because the service doesn't properly validate how it interprets the 'browser' field in package.json during the build process. While the attacker cannot modify files or crash the service, they can gain unauthorized access to confidential data stored on esm.sh infrastructure.

• CVE-2026-44716HIGH 7.5

  Pipecat, an open-source Python framework for building voice and conversational AI agents, contains a path traversal vulnerability in its development runner. When started with the --folder flag, the runner exposes an unauthenticated file download endpoint that fails to validate user-supplied filenames. An attacker on the network can craft specially-encoded URLs to read files anywhere on the system that the Pipecat process can access—such as SSH keys, API credentials, configuration files, and system files. The vulnerability affects versions 0.0.90 through 1.1.x and has been fixed in version 1.2.0.

• CVE-2026-45017HIGH 7.5

  Python Liquid is a templating engine used to process dynamic content. Versions before 2.2.0 contain a path traversal flaw that lets an attacker with the ability to author templates bypass security restrictions and read arbitrary files from the server. An attacker could use the {% include %} or {% render %} template tags with absolute file paths to access files outside the intended template directory. The compromised files are then processed as templates, potentially exposing their contents. This requires the attacker to have template authoring privileges and targets files readable by the application.

• CVE-2026-47896HIGH 7.5

  Apache Lucene.Net's Lucene.Net.Replicator library contains a path traversal vulnerability that allows an attacker to read files outside the intended directory on affected systems. An unauthenticated remote attacker can exploit this over the network without user interaction, potentially exposing sensitive data. The vulnerability affects beta versions 4.8.0-beta00005 through 4.8.0-beta00017, and a fix is available in version 4.8.0-beta00018.

• CVE-2026-47897HIGH 7.5

  A path traversal vulnerability exists in Apache Lucene.Net's Replicator library (versions 4.8.0-beta00005 through 4.8.0-beta00017) that allows unauthenticated network attackers to write or modify files outside of their intended directory. An attacker can craft requests that bypass directory restrictions, potentially overwriting configuration files, application binaries, or other sensitive data on affected systems. The vulnerability requires no authentication and can be exploited remotely over the network.

• CVE-2026-49061HIGH 7.5

  WPC Product Options for WooCommerce versions 3.2.1 and earlier contain a vulnerability that allows attackers to download arbitrary files from an affected server without authentication. An attacker can exploit this remotely by crafting requests that bypass path validation controls, potentially exposing sensitive configuration files, database backups, source code, or other confidential data stored on the web server. No user interaction or special privileges are required to attempt exploitation.

• CVE-2026-49119HIGH 7.5

  Gradio, a popular open-source library for building machine learning interfaces, contains a flaw in its FileExplorer component that allows attackers to read files outside the intended directory without authentication. By crafting malicious file paths, an attacker can bypass the directory restrictions and access sensitive files anywhere on the system. This is a path traversal vulnerability—a classic technique for escaping sandbox boundaries.

• CVE-2026-49128HIGH 7.5

  Music Player Daemon (MPD) versions before 0.24.11 allow unauthenticated attackers to access files and directories outside the configured music library through specially crafted commands. By exploiting how the application constructs file paths, an attacker can bypass intended boundaries and read arbitrary image files or enumerate directory contents that the MPD process has permission to access. This is a path traversal flaw that turns a music streaming service into an unintended information disclosure vector.

• CVE-2026-49136HIGH 7.5

  Banana Slides version 0.4.0 and earlier contains a path traversal flaw that lets unauthenticated attackers read image files from anywhere on the server, not just the intended uploads folder. An attacker can craft specially formatted markdown in page descriptions to trick the application into opening files from sibling directories. The vulnerability stems from a flawed directory check that doesn't properly validate path boundaries, allowing an attacker to bypass the intended confinement and access sensitive image-format files. This affects all instances of Banana Slides up to version 0.4.0; a fix has been released in commit e8bc490.

• CVE-2026-49233HIGH 7.5

  Routinator, a critical tool for validating BGP route origins, contains a path traversal vulnerability in how it processes rsync module names. An attacker can craft a malicious rsync URI with directory traversal sequences (like ..) in the module component, allowing unauthorized access to files outside the intended cache directory. This could expose the entire rsync cache to an unauthenticated attacker over the network.

• CVE-2026-50234HIGH 7.5

  Lyrion Music Server version 9.2.0 has a path traversal flaw that lets attackers read files they shouldn't have access to. Because the vulnerability doesn't require authentication and can be exploited over the network with minimal complexity, an attacker can craft requests to step outside the intended directory and retrieve sensitive system or application files. The flaw affects confidentiality but does not enable attackers to modify files or disrupt service.

• CVE-2026-50877HIGH 7.5

  Zhoros SuperBin version 1.0.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read files outside the intended directory boundaries. An attacker can craft specially-named files containing path traversal sequences (such as '../' characters) to navigate the file system and access sensitive files. This requires no special privileges or user interaction, making it a straightforward attack to execute remotely.

• CVE-2026-52726HIGH 7.5

  Dulwich, a Python library that implements Git functionality, contains a critical flaw in how it handles submodules from untrusted repositories. When cloning a repository with submodules enabled, or when explicitly updating submodules, the library fails to validate where those submodules are being placed. An attacker can craft a malicious repository with a `.gitmodules` file that points a submodule to a path like `.git/hooks/`, causing arbitrary files to be written into your repository's hook directory. Since Git automatically runs hooks during normal operations, this allows the attacker to execute code on your system. The vulnerability affects Dulwich versions 0.23.2 through 1.2.4.

• CVE-2026-52844HIGH 7.5

  Caddy, a popular web server platform, has a flaw in how it handles file paths on Windows systems. When a client requests a file using mixed path separators (like /private\secret.txt), Caddy's security rules incorrectly think the request is outside a protected directory, but the actual file serving code resolves it to the correct file anyway. This means an attacker can bypass authentication or access denial rules that are meant to protect sensitive files. The issue only affects Windows deployments running Caddy before version 2.11.4.

• CVE-2026-53571HIGH 7.5

  Vite, a popular JavaScript frontend build tool, has a vulnerability on Windows systems that allows attackers to read sensitive files—like environment variables and SSL certificates—that should be blocked. The vulnerability exploits Windows-specific file path features (NTFS Alternate Data Streams and 8.3 short filenames) that Vite's security checks don't properly handle. An unauthenticated attacker on the network can request these files directly from the dev server and receive their contents, bypassing the intended protections.

• CVE-2026-53779HIGH 7.5

  WebP Server Go version 0.14.4 and earlier contains a path traversal vulnerability that allows attackers to read files outside the intended image directory on Windows systems. An attacker can craft specially formatted web requests using percent-encoded backslashes to bypass security checks and access arbitrary files that the web server process can reach. This affects Windows deployments specifically, where the vulnerability exploits how Go's path handling differs from Windows' native file system behavior.

• CVE-2026-53872HIGH 7.5

  picklescan versions before 0.0.35 contain a critical flaw in how they handle pickled data. An attacker can craft a malicious pickle file that chains together Python's file I/O and URL libraries to read files from the server (like /etc/passwd) and send them to an external attacker-controlled location. No authentication is required, and the attack works over the network. While the vulnerability is sometimes described as RCE-focused, this specific chain achieves data exfiltration—reading and stealing sensitive files rather than executing arbitrary commands.

• CVE-2026-54066HIGH 7.5

  SiYuan, an open-source personal knowledge management system, contains a path traversal vulnerability in its publish mode that allows unauthenticated attackers to read sensitive files from the server. The vulnerability exists because a previous patch for a similar issue only fixed one route (/export/) but left the same weakness in another route (/assets/). By using double-URL-encoding to bypass sanitization, an attacker can download configuration files containing credentials, database files, and logs—all without needing to log in. This affects versions prior to 3.7.0.

• CVE-2026-54094HIGH 7.5

  File Browser, a file management interface used for uploading, deleting, previewing, renaming, and editing files, contains a symlink-following vulnerability that allows attackers to escape the intended directory scope. Before version 2.63.14, the HTTP file handlers do not validate symlink targets before serving or accessing files. This means a user with restricted access to a specific directory—or even an unauthenticated user with public-share permissions—can craft a symlink with a path that appears to be within their allowed scope but actually points to files outside that boundary. An attacker can exploit this to read, write, or enumerate sensitive files outside the intended scope.

• CVE-2026-54293HIGH 7.5

  NLTK, a popular Python library for natural language processing, contains a path traversal vulnerability in its file-loading mechanism. When using the special `nltk:` URL scheme to load data, an attacker can read arbitrary files from a vulnerable system by encoding path traversal sequences (like forward slashes and dots) as URL hex codes. This bypasses NLTK's documented security checks because the library validates the path before decoding these hex sequences, leaving a window for manipulation. The vulnerability affects all versions before 3.10.0-rc1.

• CVE-2026-55092HIGH 7.5

  Trivy, a popular container security scanner, has a path traversal vulnerability in versions before 0.71.1. When Trivy downloads container images (OCI artifacts), it reads a label called 'org.opencontainers.image.title' from the image metadata and uses it as a filename without checking whether that filename could escape the intended directory. An attacker who controls a container image can craft this label to include path traversal sequences (like '../'), tricking Trivy into writing downloaded content to arbitrary locations on the host system. This could allow an attacker to overwrite critical files or place malicious content where it will be executed.

• CVE-2026-55111HIGH 7.5

  A path traversal vulnerability in Ubiquiti's UniFi Protect Floodlight devices allows someone with network access to read files stored on the device itself. An attacker cannot modify or delete files, only view them. This is a network-based vulnerability requiring no special privileges or user interaction to exploit.

• CVE-2026-55677HIGH 7.5

  Echo, a popular Go web framework, has a critical path-handling flaw where its URL router and static file handler interpret encoded paths differently. An attacker can craft URLs with encoded forward slashes (%2F) to bypass access controls and read files that should be protected. The mismatch means the router approves the request, but the file handler decodes the path and serves content it shouldn't. This affects versions before 4.15.3 and 5.2.0.

• CVE-2026-55760HIGH 7.5

  Handlebars.java is a templating library that lets developers create dynamic content using Mustache templates. Before version 4.5.2, if an application allows user input to determine which template file gets loaded—through URL parameters, form fields, or similar mechanisms—an attacker can exploit this to read arbitrary files from the server's filesystem. The vulnerability exists because the library doesn't properly validate template file paths, allowing traversal sequences (like `../`) to escape the intended template directory. An unauthenticated attacker can exploit this over the network without any special privileges.

• CVE-2026-56122HIGH 7.5

  Winstone Servlet Engine versions through 0.9.10 have a path traversal flaw that allows anyone on the network to read files outside the intended web directory. By crafting HTTP requests with specially formed paths (containing sequences like '../'), an attacker can retrieve sensitive files from the server without needing credentials. The severity depends on what files the servlet engine process can access—if it runs with elevated privileges, system-level configuration files and credentials become exposed.

• CVE-2026-57872HIGH 7.5

  A remote attacker can read files from affected GeoVision IP cameras without authentication by exploiting a directory traversal flaw in the get_fcont.cgi script. By crafting requests with path manipulation sequences (like '../'), an attacker can bypass intended file access restrictions and retrieve sensitive configuration files, credentials, or other data stored on the device. No authentication or user interaction is required.

• CVE-2026-58467HIGH 7.5

  Cockpit CMS versions up to 2.14.0 contain a flaw that allows attackers to read sensitive files from the server without logging in. By crafting specially formatted URLs with path traversal sequences (like "../"), an attacker can escape the intended directory boundaries and access files outside the application's designated spaces. In certain server configurations, this can escalate to executing arbitrary PHP code, making it a serious confidentiality and integrity risk for affected deployments.

• CVE-2026-8023HIGH 7.5

  Zephyr's HTTP server has a path-traversal vulnerability in its static file serving feature. When configured to serve files from a specific directory, the server fails to properly validate request paths, allowing an attacker to use sequences like ../../ to escape the intended directory and read arbitrary files on the system. An unauthenticated remote attacker can exploit this over the network without encryption or authentication—they simply craft a specially-formed HTTP request to retrieve sensitive files they shouldn't have access to.

• CVE-2026-9290HIGH 7.5

  The WP User Manager plugin for WordPress contains a flaw that allows anyone on the internet to include and run arbitrary PHP files from the server. An attacker doesn't need a login or any special access—they can craft a request that tricks the plugin into loading a PHP file and executing whatever code is inside it. If the server already has a malicious PHP file (from a previous upload or misconfiguration), this vulnerability turns it into a direct path to taking over the site or stealing data. The vulnerability affects all versions through 2.9.17.

• CVE-2026-9690HIGH 7.5

  A security flaw in WP Media folder Addon version 4.0.1 and earlier allows attackers to download arbitrary files from affected WordPress installations without needing to log in. The vulnerability stems from insufficient access controls on file download functionality, enabling an unauthenticated actor to retrieve sensitive files such as configuration data, database backups, or other protected assets directly from the server.

• CVE-2026-9776HIGH 7.5

  ATEN Unizon contains a directory traversal flaw that allows unauthenticated attackers to read sensitive files from the system. The vulnerability exists in a file-handling function that doesn't properly validate user-supplied file paths before accessing them. An attacker can exploit this over the network to retrieve files with SYSTEM-level privileges, potentially exposing passwords, configuration data, or other confidential information stored on the affected device.

• CVE-2026-12198HIGH 7.3

  Microweber, a website builder platform, contains a path traversal vulnerability in its API endpoint that handles image thumbnail requests. An attacker can manipulate a cache path parameter to access files outside the intended directory structure, potentially reading sensitive data, modifying files, or disrupting service. The vulnerability affects Microweber versions up to 2.0.20 and can be exploited remotely without authentication. Public exploit code is available, increasing the practical risk.

• CVE-2026-13528HIGH 7.3

  A path traversal vulnerability exists in the file upload functionality of RuoYi-Vue-Pro, an open-source application framework. An attacker can craft a malicious file upload request that bypasses directory restrictions, allowing them to write files outside the intended upload directory. This could lead to unauthorized file creation, modification, or access to sensitive application files. The vulnerability requires no authentication and can be triggered remotely over the network.

• CVE-2026-14635HIGH 7.3

  A path traversal vulnerability has been discovered in the Ecommerce-CodeIgniter-Bootstrap project that allows remote attackers to manipulate file paths through the vendor multi-image upload feature. By altering the folder parameter sent to the AddProduct.php controller, an attacker can access files and directories outside the intended upload location. The vulnerability requires no authentication and can be exploited over the network. Public exploit code is available, increasing the risk of active exploitation.

• CVE-2026-50015HIGH 7.3

  pnpm, a popular package manager, has a path traversal vulnerability in its patch application system that allows malicious actors to write or delete files outside the intended package directory. An attacker can exploit this by submitting a pull request with a specially crafted .patch file containing directory traversal sequences (../../). When another developer runs pnpm install, the malicious patch executes with their privileges, potentially compromising the system. The vulnerability affects versions prior to 10.34.0 and 11.4.0, where it has been patched.

• CVE-2026-13054HIGH 7.2

  WatchGuard Firebox firewalls running Fireware OS contain a flaw in their web-based management interface that allows someone with administrative access to upload or write files to unexpected locations on the device. An attacker with valid admin credentials could exploit this to place malicious files, modify configurations, or compromise the firewall's integrity. The vulnerability requires prior authentication, which limits exposure but remains serious given admin accounts' sensitivity.

• CVE-2026-39276HIGH 7.2

  Emlog Pro v2.6.9 contains a path traversal flaw in its template upload feature that allows authenticated administrators to upload malicious files and execute arbitrary PHP code on the server. An attacker with admin credentials can craft a specially crafted ZIP archive with directory traversal sequences (such as '../') in filenames to escape the intended upload directory, overwrite legitimate template files, or inject malicious code that gets executed by the web server. This is a post-authentication vulnerability, meaning the attacker must already have admin access to the Emlog installation.

• CVE-2026-49506HIGH 7.2

  Dell Wyse Management Suite versions before 5.5 HF1 contain a path traversal vulnerability that allows a highly privileged remote attacker to bypass directory restrictions and execute arbitrary code on the system. Path traversal flaws occur when an application fails to properly sanitize file path inputs, allowing attackers to access files and directories outside the intended scope. In this case, the vulnerability is particularly dangerous because it leads directly to remote code execution in the hands of someone with elevated privileges.

• CVE-2026-9777HIGH 7.2

  ATEN Unizon contains a directory traversal vulnerability in its restoreDB functionality that allows authenticated users to bypass normal file access restrictions and execute arbitrary code with SYSTEM-level privileges. An attacker with valid credentials can craft a malicious file path that traverses the directory structure, allowing them to place and execute code outside of intended boundaries. This is a post-authentication attack, meaning the attacker must already have login access to the system.

• CVE-2026-9778HIGH 7.2

  A directory traversal vulnerability in ATEN Unizon's ImportDeviceList function allows authenticated attackers to execute arbitrary code with SYSTEM-level privileges. The vulnerability stems from insufficient validation of file paths before they are used in file operations, enabling an attacker to traverse the directory structure and load malicious code. While authentication is required to exploit this flaw, the ability to escalate from an authenticated user to SYSTEM-level code execution represents a significant post-authentication privilege escalation risk.

• CVE-2026-14372HIGH 7.1

  Bit Form, a widely-deployed WordPress form builder plugin, contains a critical flaw that lets anyone with a basic subscriber account delete arbitrary files from a website's server. The vulnerability stems from weak validation of file paths in the deletion function, meaning an attacker can target sensitive files like wp-config.php. Removing the right file can grant an attacker complete control of the site. The issue affects all versions up to 3.1.1.

• CVE-2026-3840HIGH 7.1

  A path traversal vulnerability in Kedro 1.2.0 allows an authenticated local attacker to break out of the intended dataset directory structure by injecting specially crafted version strings. The flaw exists in how the data pipeline tool constructs file paths when versioning datasets, enabling unauthorized access to files outside the expected scope. This can be exploited both programmatically and via the command-line interface, potentially allowing attackers to read sensitive files or inject malicious data into shared environments.

• CVE-2026-40987HIGH 7.1

  A vulnerability in Spring Integration allows a malicious or compromised remote file server (FTP, SFTP, or SMB) to write files anywhere on a client machine's filesystem, bypassing intended directory restrictions. An attacker controlling or compromising the remote server can place arbitrary files with attacker-chosen content on the victim's system, enabling code execution, configuration tampering, or other post-exploitation activities. The vulnerability requires the attacker to either compromise a legitimate server the client connects to or convince a user to connect to an attacker-controlled server, making it a supply-chain and social-engineering risk vector.

• CVE-2026-48827HIGH 7.1

  Apache MINA SSHD's sshd-git module contains a path traversal vulnerability that allows SSH-authenticated users to access git repositories and perform git operations (upload-pack, receive-pack, and others) outside the configured git server root directory. An attacker with valid SSH credentials can escape the intended directory boundary and potentially read or modify repositories they should not have access to. This affects only applications explicitly using the sshd-git component; standard SSHD deployments without sshd-git are unaffected.

• CVE-2026-49339HIGH 7.1

  Gonic, a free software Subsonic server implementation, contains a path traversal vulnerability that undermines a previously-patched access control check. An authenticated user can craft a malicious playlist ID containing path traversal sequences to bypass ownership verification, allowing them to read, delete, or probe other users' playlists and arbitrary files on the server. The vulnerability was introduced when the maintainer attempted to fix a related issue by checking playlist ownership—but failed to sanitize the playlist ID parameter itself, leaving the door open to directory traversal attacks. Version 0.21.0 and later contain the fix.

• CVE-2026-50181HIGH 7.1

  Langroid is a framework that helps developers build applications powered by large language models (LLMs). Versions before 0.64.0 contain a path traversal vulnerability in the file reading and writing tools. While these tools are meant to restrict file operations to a specified directory, they fail to properly validate file paths. An attacker with access to trigger tool calls can use path traversal sequences like `../` to read sensitive files outside the intended directory or write malicious files in unexpected locations. This is particularly concerning when Langroid applications expose these tools directly to LLM agents or accept user-controlled instructions, as the safety boundary meant to isolate file access can be completely bypassed.

• CVE-2026-55700HIGH 7.1

  pnpm, a widely-used JavaScript package manager, contains a path traversal vulnerability in its download staging feature that could allow an attacker to overwrite files outside the intended download directory. By crafting a malicious package manifest with specially designed name and version fields, an attacker could trick pnpm into writing files to unintended locations on a developer's machine. This affects versions 11.3.0 through 11.5.2. The fix validates and sanitizes both the package name and version before deriving a safe filename, then verifies the destination path before writing any files.

• CVE-2026-57346HIGH 7.1

  Epiphyt Embed Privacy versions up to 1.12.3 contain a path traversal vulnerability that allows authenticated users to access files and directories outside of intended boundaries. An attacker with login credentials can manipulate file path inputs to read or write to sensitive locations on the server, potentially causing service disruption or data integrity issues. The vulnerability requires authentication to exploit, reducing immediate risk from external attackers but creating a meaningful insider threat.

• CVE-2026-59194HIGH 7.1

  pnpm, a widely-used Node.js package manager, contains a path traversal vulnerability in its patch-removal functionality. An attacker can craft a malicious patch entry that points outside the intended patches directory, allowing deletion of arbitrary files accessible to the user running pnpm. This occurs when using the `pnpm patch-remove` command with a compromised or attacker-controlled patch configuration. The vulnerability affects versions before 10.34.4 and 11.7.0.

• CVE-2026-59196HIGH 7.1

  pnpm, a widely-used Node.js package manager, contains a lockfile parsing vulnerability that allows a specially crafted lockfile to create directory traversal or reserved directory overwrites. An attacker who controls a lockfile (via a malicious package, compromised repository, or supply chain attack) can manipulate how pnpm installs dependencies, potentially writing files to unexpected locations or overwriting critical pnpm internal directories. The vulnerability requires user interaction—specifically, running pnpm on a malicious lockfile—but no authentication is required. Versions prior to 10.34.4 and 11.7.0 are affected.

• CVE-2026-9154HIGH 7.1

  A vulnerability in Rapid7 InsightConnect's Sed Plugin allows authenticated users to write malicious files to any location on Linux systems. An attacker with valid credentials can exploit the 'expression' parameter to place arbitrary content at arbitrary file paths, potentially overwriting critical system or application files. This is a file-write vulnerability rather than code execution, but the impact depends heavily on what files an attacker targets.

• CVE-2026-59948HIGH 7.0

  Composer, the widely-used PHP dependency manager, contains a vulnerability that allows attackers to place malicious files anywhere on a developer's system during package installation or updates. An attacker who controls a third-party repository can craft a package with an invalid name that bypasses validation checks, letting them write files outside the intended vendor directory. This is a local-impact vulnerability requiring user interaction (installing or updating packages), but the consequences are severe: an attacker can modify system files, inject code into projects, or disrupt operations. The issue affects all versions of Composer before 2.2.29 and 2.10.2.

• CVE-2026-39468MEDIUM 6.8

  A vulnerability in Meta Box, a popular WordPress custom fields framework, allows contributors with limited account privileges to delete arbitrary files from an affected website. The flaw exists in versions 5.11.1 and earlier. While an attacker would need contributor-level access or higher to exploit this, successful exploitation can lead to website unavailability, data loss, or system instability if critical files are deleted. This is a path traversal issue that bypasses normal file permission checks.

• CVE-2026-45775MEDIUM 6.8

  Discourse, a popular open-source discussion platform, contains a path traversal vulnerability in its backup handling system that could allow an authenticated site administrator to access backup files from other sites within the same multisite deployment. The vulnerability affects versions 2026.1.0 through 2026.1.3, 2026.3.0, and 2026.4.0. An attacker with admin privileges on one Discourse site could craft a specially crafted backup download request to retrieve sensitive backup data from a different site hosted on the same infrastructure. This requires existing administrative authentication and only impacts deployments where backups are stored locally on the same server. The issue has been resolved in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

• CVE-2026-55201MEDIUM 6.8

  Evil-WinRM versions through 3.9 contain a path traversal flaw in how they handle file downloads from Windows servers. When a user downloads files from a remote Windows machine using Evil-WinRM, a compromised or rogue server can trick the client into writing files outside the intended download folder by embedding special directory-traversal sequences (like "../") in filenames. An attacker controlling the remote server could exploit this to overwrite important files on the client machine—such as SSH keys or shell configuration files—potentially gaining persistent access or escalating privileges on the client system.

• CVE-2018-25393MEDIUM 6.5

  Navigate CMS version 2.8.5 contains a flaw that allows authenticated users to download files they shouldn't have access to by manipulating the download request. An attacker with valid login credentials can craft specially-formed requests to the navigate_download.php component using directory traversal patterns (such as ../../../) to sidestep folder boundaries and retrieve sensitive system files like configuration files outside the application's normal download directory.

• CVE-2018-25421MEDIUM 6.5

  Open STA Manager version 2.3 has a security flaw that allows authenticated users to download files they shouldn't have access to. An attacker with valid login credentials can manipulate web requests to trick the application into retrieving sensitive system files, such as configuration files or data stored outside the intended application directory. The vulnerability exists in the backup module and exploits how the application handles file path requests.

• CVE-2019-25740MEDIUM 6.5

  A vulnerability in Joomla's com_jsjobs extension version 1.2.6 allows authenticated users to delete files from the web server. An attacker who has valid login credentials can craft a malicious request that exploits how the extension handles file path parameters, bypassing intended restrictions and removing files the web server can access. This is a path traversal flaw that turns file upload/management functionality into an unauthorized deletion mechanism.

• CVE-2026-11367MEDIUM 6.5

  The PixMagix – WordPress Image Editor plugin contains a directory traversal vulnerability that allows authenticated users with author-level permissions to write malicious files anywhere on the server. When users upload or manipulate images through the plugin, an attacker can inject path traversal sequences (like '../../') into image parameters to escape the intended upload folder and place files in sensitive locations. This is particularly concerning because author-level access is granted by default after plugin activation, making exploitation straightforward for any author-role user on an affected WordPress site.

• CVE-2026-11442MEDIUM 6.5

  Allegra contains a directory traversal vulnerability in its report export function that allows authenticated users to read files outside their intended access scope. An attacker with valid credentials can manipulate the file path parameter to traverse the directory structure and access sensitive information stored on the server, including files belonging to the application service account. This requires authentication but poses a meaningful information disclosure risk.

• CVE-2026-12568MEDIUM 6.5

  CVE-2026-12568 is a path traversal vulnerability in the postman_download module that allows attackers to write arbitrary files to a user's system. The flaw stems from improper handling of workspace names retrieved from the Postman API. When a workspace name contains special characters designed to traverse directories (such as ../ sequences), the module fails to sanitize the input before using it to construct file paths. An attacker who controls a malicious Postman workspace can craft a name that causes files to be written outside the intended directory, potentially overwriting or injecting malicious content into the user's system.

• CVE-2026-24717MEDIUM 6.5

  A path traversal vulnerability in QNAP operating systems allows an attacker who already has administrator credentials to read files and system data they shouldn't have access to. While the attacker needs valid admin account access first, once obtained, they can bypass file access restrictions to view sensitive information. QNAP has released patched versions across multiple OS lines to fix this issue.

• CVE-2026-31978MEDIUM 6.5

  motionEye, a web-based video surveillance interface, contains a path traversal vulnerability in its preview and movie API endpoints that allows authenticated users to read files they shouldn't access. An attacker with a basic motionEye account could exploit this to extract sensitive files such as system credentials, configuration files with passwords, SSH keys, and footage from other cameras. The vulnerability affects all versions before 0.44.0 and requires only user-level privileges to exploit—no special admin access is needed.

• CVE-2026-35718MEDIUM 6.5

  VIVOTEK FD8136 network cameras running firmware version 0300a contain a path traversal vulnerability in their administrative media download function. An authenticated attacker can craft requests to the vulnerable endpoint to read files anywhere on the device, potentially exposing sensitive configuration data, credentials, or system files. This requires valid login credentials but does not require user interaction to exploit.

• CVE-2026-40084MEDIUM 6.5

  Cacti versions 1.2.30 and earlier contain a path traversal vulnerability in the report functionality that allows authenticated users to read arbitrary files from the server. The flaw stems from insufficient validation of user-supplied file paths when generating reports. An attacker with valid Cacti credentials can craft a malicious report format parameter to escape the intended directory and access sensitive system files.

• CVE-2026-40724MEDIUM 6.5

  A vulnerability in CP Client's Portal (Pro) version 5.6.2 and earlier allows authenticated users to download arbitrary files from the server without proper authorization. An attacker with valid login credentials can bypass access controls to retrieve sensitive files that should be restricted, potentially exposing confidential business data, configuration files, or other protected assets. This is a path traversal vulnerability that does not require special privileges beyond basic authentication.

• CVE-2026-42679MEDIUM 6.5

  CVE-2026-42679 is a path traversal vulnerability in Mamunur Rashid Classified Listing that allows authenticated users to read sensitive files outside the application's intended directory structure. An attacker with valid login credentials can craft specially formatted file path requests to access restricted files on the server, potentially exposing configuration data, database backups, or other confidential information. The vulnerability affects Classified Listing versions up through 5.3.8.

• CVE-2026-42867MEDIUM 6.5

  Langflow, a platform for building AI-powered agents and workflows, contains a path traversal vulnerability in its Knowledge Bases API that allows authenticated users to write files anywhere on the server. The flaw exists because user-provided knowledge base names are not properly validated before being used to construct file paths. An attacker with valid credentials can exploit this to create arbitrary directories and files, potentially compromising server integrity. The issue is resolved in version 1.9.0.

• CVE-2026-43732MEDIUM 6.5

  A path handling flaw in Apple's Safari browser and related operating systems could allow an attacker to trick users into visiting a malicious website that discloses sensitive information stored on their device. The vulnerability requires user interaction—specifically clicking a link or visiting a crafted page—but does not allow attackers to modify data or crash systems. Apple has patched this across Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

• CVE-2026-45454MEDIUM 6.5

  A path traversal vulnerability in Microsoft SharePoint Server allows an authenticated user to access files and data outside intended boundaries, potentially leading to unauthorized code execution across the network. An attacker with valid credentials can manipulate file paths to reach restricted directories and execute arbitrary code—a serious concern in multi-tenant or shared SharePoint environments where user trust is assumed but not absolute.

• CVE-2026-46397MEDIUM 6.5

  HAX CMS, a content management system for building microsite networks, contains a flaw that lets authenticated users read files they shouldn't have access to. An attacker with a valid login (even a low-privilege account) can manipulate how the system saves site configuration data, causing it to expose sensitive files like system passwords, API keys, or database credentials stored on the web server. This is a classic file inclusion attack that works over the network without requiring special browser interaction. The vendor has patched this in version 26.0.0.

• CVE-2026-47277MEDIUM 6.5

  Runtipi, a personal homeserver orchestrator, contains a vulnerability that allows unauthenticated users to read arbitrary files from the host system through its app marketplace logo endpoint. When Runtipi clones third-party app repositories, an attacker can craft a malicious app store that includes a symbolic link disguised as a logo file. Since the logo endpoint doesn't properly validate symlink targets, requesting this logo causes Runtipi to follow the symlink and return sensitive files like environment variables, JWT secrets, or application logs to the requester. This affects Runtipi versions 4.9.1 through 4.9.3 and has been patched in version 4.10.0.

• CVE-2026-48129MEDIUM 6.5

  Kestra, an open-source workflow orchestration tool, contains a path traversal vulnerability in its task file handling. When flows process untrusted data (from webhooks or external sources) as file names in the `inputFiles` feature, attackers can inject directory-traversal sequences like `../` to write or overwrite files outside the intended task directory on worker systems. This could allow an attacker to place malicious files in sensitive locations or corrupt existing files, depending on worker permissions and file system layout.

• CVE-2026-48314MEDIUM 6.5

  Adobe ColdFusion contains a path traversal vulnerability that allows an attacker to read and write files outside intended directory boundaries. Versions 2025.9, 2023.20 and earlier are affected. No user interaction is required for exploitation—an attacker can trigger the flaw remotely and directly access or modify sensitive files. The impact is classified as medium severity because while file access is limited, both confidentiality and integrity can be compromised.

• CVE-2026-48944MEDIUM 6.5

  A flaw in the K2 component for Joomla allows authenticated users with Author privileges to read sensitive files from the server. By manipulating a form field during article uploads, an attacker can copy files like configuration.php or system files into a publicly accessible directory, then download them to extract credentials, database details, or other secrets. The vulnerability requires valid site credentials but poses a significant confidentiality risk.

• CVE-2026-49133MEDIUM 6.5

  Typemill, a content management system, contains a path traversal flaw in versions prior to 2.24.0 that allows authenticated users with Author-level permissions to read files stored outside the intended content directory. An attacker can craft malicious file paths containing traversal sequences (like ../ patterns) to bypass safety checks and access sensitive files on the server. This requires valid credentials but does not require user interaction, making it a concern for organizations where Author accounts may be compromised or granted to untrusted users.

• CVE-2026-49144MEDIUM 6.5

  BrowserStack Runner versions up to 0.9.5 contain a path traversal flaw that allows attackers on the same network to read sensitive files from affected systems. The vulnerability exists in an unauthenticated HTTP server that runs by default, giving attackers a direct avenue to escape the intended project directory and access files elsewhere on the filesystem. No special privileges or user interaction are required to exploit this issue.

• CVE-2026-49818MEDIUM 6.5

  A path traversal flaw in Apache Airflow's Samba provider allows attackers to write files to unintended locations on Samba file shares. The vulnerability exists in the `GCSToSambaOperator`, which copies objects from Google Cloud Storage to Samba without validating that the destination path remains within the configured boundary. An attacker who can upload files to the source GCS bucket (a common scenario when external data producers have write access) could craft object names using directory traversal sequences like `../` to escape the intended destination and write files anywhere on the target Samba system. This is particularly dangerous in shared data pipelines where the GCS bucket is not exclusively controlled by the DAG author.

• CVE-2026-53825MEDIUM 6.5

  OpenClaw versions prior to 2026.4.7 contain a file-reading vulnerability in the memory-wiki ingest feature. Users with operator.write permissions can exploit this to read files from the local system that fall outside the intended ingest sources, potentially accessing sensitive configuration files, credentials, or other protected data. The vulnerability requires authenticated access and operator-level permissions, limiting its reach but increasing risk for multi-tenant or federated deployments where gateway operators may be less trusted.

• CVE-2026-54468MEDIUM 6.5

  Dell Unisphere for PowerMax versions 10.3.0.5 and earlier contain a flaw that allows an authenticated attacker with basic network access to bypass file path restrictions and read files they should not be able to access. The vulnerability requires valid credentials but does not need user interaction to trigger, making it a concern for organizations with untrusted internal users or compromised service accounts.

• CVE-2026-55699MEDIUM 6.5

  pnpm, a widely-used Node.js package manager, contains a path-traversal vulnerability in how it handles global package installation and removal. Specifically, malicious package manifests can specify bin names (executable entry points) that bypass pnpm's validation checks—using names like ".", "..", or empty strings. When a user installs such a package globally and later removes, updates, or adds a replacement, pnpm incorrectly derives these malicious bin names and attempts to delete files at unintended locations. A bin name of "." would target the entire global bin directory; ".." would target its parent directory. An attacker distributing a malicious package could potentially delete or corrupt critical files in the global bin environment on a user's system.

• CVE-2026-56273MEDIUM 6.5

  Flowise versions before 3.1.0 contain a security flaw that allows authenticated users with valid API tokens to write data to unintended locations on the server's filesystem. An attacker exploiting this vulnerability could direct vector store data (embeddings and related metadata) to arbitrary paths, potentially overwriting critical files or achieving code execution on the affected system. The vulnerability stems from insufficient validation of file path parameters, a common pattern known as path traversal. Because exploitation requires a valid API token, the risk is limited to threats from compromised credentials or malicious insiders with legitimate access.

• CVE-2026-56394MEDIUM 6.5

  Craft CMS versions from 4.0.0-RC1 onward contain a weakness in how it handles file requests through its icon endpoint. An attacker who has valid login credentials can manipulate the file path parameter to read SVG files they shouldn't normally access on the server. The vulnerability stems from insufficient validation of the file extension before the system checks whether files exist, allowing an authenticated user to bypass intended access controls and retrieve sensitive local files.

• CVE-2026-58173MEDIUM 6.5

  Vibe-Trading versions before 0.1.10 contain a path traversal flaw in the persistent memory feature. An authenticated attacker can craft a malicious memory_type parameter to write arbitrary Markdown files to locations outside the intended application directory. This allows an attacker to potentially overwrite sensitive files or inject content in unintended places on the server filesystem.

• CVE-2026-58451MEDIUM 6.5

  Horde IMP versions before 7.0.1 contain a vulnerability that allows attackers with valid login credentials to read sensitive files directly from the server's filesystem. An attacker can craft malicious email with specially formatted image links that trick the application into retrieving arbitrary files instead of legitimate images. These stolen files can then be sent out as email attachments, exposing confidential data. Additionally, an attacker without credentials can exploit this if a legitimate user is currently logged in, using a technique called CSRF (cross-site request forgery) to perform the attack on their behalf.

• CVE-2026-59149MEDIUM 6.5

  Mockoon is a tool used by developers to create and test mock APIs locally. A flaw in versions before 9.7.0 allows an attacker to read files from outside the intended mock API directory by crafting specially-formatted file requests. Because the validation check for file paths doesn't properly enforce directory boundaries, an attacker can use path-traversal tricks to escape the sandbox and access other files on the server. This vulnerability requires user interaction (the victim must visit a malicious link or request) but no authentication, and it exposes sensitive data rather than modifying or deleting it.

• CVE-2026-59820MEDIUM 6.5

  LiteLLM, a proxy server used to standardize API calls to various large language models, contains a path traversal vulnerability in its skill upload feature. An authenticated user who has permission to upload skills can craft a malicious ZIP file that extracts files outside the intended directory, potentially overwriting system files or placing malicious content in sensitive locations. This requires existing API access and doesn't directly cause data theft or system crashes, but enables an attacker to modify files on the server.

• CVE-2026-9145MEDIUM 6.5

  A vulnerability in the Database for Contact Form 7 WordPress plugin allows unauthenticated attackers to copy arbitrary files from a server when Elementor Pro is active. The issue stems from the plugin's form entry handler trusting user-supplied input without validating whether it came from a legitimate file upload. An attacker can manipulate form submissions to point the plugin's file-copying function at sensitive files on the server or even remote sources, potentially exposing configuration files, credentials, or other sensitive data. The vulnerability requires Elementor Pro to be installed but does not require authentication.

• CVE-2026-9153MEDIUM 6.5

  A vulnerability in the Rapid7 InsightConnect Sed Plugin allows authenticated users on Linux systems to read files they shouldn't have access to. The flaw exists because the plugin doesn't properly validate input in the expression parameter, enabling attackers to craft malicious commands that bypass restrictions and access sensitive files on the server.

• CVE-2026-9774MEDIUM 6.5

  A directory traversal vulnerability in ATEN Unizon allows authenticated users with high-level privileges to delete arbitrary files on the system. The flaw exists in the updateLicense function, which fails to properly validate file paths before performing deletion operations. While authentication is required to exploit this issue, a compromised or malicious administrator account could use this to destroy critical system files, disable services, or trigger a denial-of-service condition.

• CVE-2026-9775MEDIUM 6.5

  ATEN Unizon contains a directory traversal vulnerability in its uploadSSL method that allows authenticated attackers to delete arbitrary files from the system. By bypassing path validation checks, an attacker with valid credentials can manipulate file paths to target and remove critical files, potentially disrupting system operations or triggering a denial-of-service condition.

• CVE-2026-10732MEDIUM 6.4

  The decompress package contains a critical flaw that allows attackers to write files anywhere on a system by uploading a specially crafted ZIP archive. The vulnerability exploits a race condition in how the library processes ZIP entries: when a ZIP contains two entries with identical paths—first a symlink pointing to an arbitrary location, then a regular file—the library writes the file's contents through the symlink to a location outside the intended extraction folder. This bypasses protections added in previous fixes, potentially enabling remote code execution if an attacker can control ZIP uploads or extraction workflows.

• CVE-2026-10278MEDIUM 6.3

  A path traversal vulnerability exists in the excel-mcp project (versions up to 1.0.2) that allows authenticated users to access files and directories outside the intended scope by manipulating file path parameters. An attacker with valid credentials can read or write files on the affected system by crafting malicious file path arguments, potentially exposing sensitive data or modifying system files. The vulnerability has been publicly disclosed, increasing the risk of active exploitation.

• CVE-2026-11470MEDIUM 6.3

  A path traversal vulnerability exists in the hsweb-framework file upload component that allows authenticated users to manipulate filenames and access files outside the intended upload directory. An attacker with valid credentials can exploit this flaw to read or write arbitrary files on the affected system by crafting malicious filename parameters. Public disclosure means this vulnerability has been shared in security communities, increasing the likelihood of active exploitation attempts.

• CVE-2026-12821MEDIUM 6.3

  FlowiseAI Flowise versions up to 3.1.2 contain a path traversal vulnerability in the S3 Document Loader component. An authenticated attacker can manipulate input to the S3.ts file to access files outside the intended directory structure, potentially exposing sensitive data or interacting with unauthorized resources on the S3 backend. The vulnerability requires valid user credentials but no special privileges to exploit.

• CVE-2026-13509MEDIUM 6.3

  RAGapp versions up to 0.1.5 contain a path traversal vulnerability in its file upload and removal functions. An authenticated attacker can manipulate file paths to read, write, or delete files outside the intended knowledge base directory, potentially compromising sensitive data or system integrity. The vulnerability requires login credentials but no special user privileges, and can be exploited over the network.