Base de CVEs

CVE-2026-103884 Média · 6.5 CWE-22 01/10/2026

Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read

A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash.

CVE-2026-101889 Média · 6.5 CWE-22 01/10/2026

Prime Mover < 2.2.1 Path Traversal via wprime-config.json

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tar_root_folder values in wprime-config.json. Attackers can exploit insufficient path validation in computeExtractVariables() and validateImportedSiteVsPackage() to cause primeMoverDoDelete() to remove directories outside the intended extraction path, potentially deleting critical WordPress directories such as wp-admin and rendering the site inoperable.

CVE-2026-101888 Alta · 7.2 CWE-22 01/10/2026

Prime Mover < 2.2.1 Zip Slip Path Traversal File Write

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.

CVE-2026-94620 Crítica · 9.4 CWE-22 01/10/2026

Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones each student's assignment repository and then writes autograde artifacts (`result.json` and `results.json`) into the just-cloned working tree. The write followed symlinks, so a student who committed `result.json` or `results.json` as a **symlink** (materialized verbatim by `git clone`) could redirect the teacher's write to an arbitrary path — e.g. `~/.zshrc`, `~/.ssh/authorized_keys`, a cron file, or an in-clone `.git/hooks/*` file that git subsequently executes. The written bytes are attacker-controlled (the student's uploaded release asset for `result.json`; student-chosen submit-tag names for `results.json`). This is an arbitrary file write leading to code execution as the teacher, whose `gh` token carries `admin:org`, `repo`, and `workflow` across the entire classroom organization. Version 1.11.0 contains a patch. Some workarounds are available. Avoid running `gh teacher download` against untrusted student repositories, or run it inside a disposable sandbox / container with no access to sensitive host files or credentials. Inspect cloned trees for symlinked, hardlinked, or special (`result.json`/`results.json`) entries before allowing the artifact-refresh step to run.

CVE-2026-95588 Alta · 8.6 CWE-22 01/10/2026

WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.

CVE-2024-58388 Alta · 7.5 CWE-22 01/10/2026

Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html

Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installed_emanual_down.html endpoint. Attackers can supply directory traversal sequences such as path=/manual/../../../<path> to access files outside the intended manual directory, including /etc/passwd, coredump files containing credentials, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30.

CVE-2026-103754 Média · 5.9 CWE-22 01/10/2026

Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory

A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod() and utime() to an unsanitized filesystem path derived from the archive member name. A crafted archive processed by a worker that consumes attacker-influenced input can create files, create symbolic links, or change permissions outside the intended target directory, which can be leveraged toward code execution.

CVE-2026-103257 Alta · 7.7 CWE-22 01/10/2026

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.

CVE-2026-103254 Média · 6.3 CWE-22 01/10/2026

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot access by exploiting unresolved traversal sequences in caller-controlled node IDs, enabling cross-project approval forgery.

CVE-2026-78249 Média · 6.8 CWE-22 01/10/2026

Path Traversal em FUJIFILM Business Innovation Corp. Apeos 3060 / 2560 / 1860 Japan model

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a specially crafted, malicious request, it may trigger unintended processing.

CVE-2025-41753 Crítica · 9.8 CWE-22 01/10/2026

Path traversal in dynamically created BACnet File Objects

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.

CVE-2026-76147 Média · 5.9 CWE-22 01/10/2026

Genians, Inc Genian NAC/ZTNA Remote Code Execution

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code

CVE-2026-103533 Média · 4.1 CWE-22 01/10/2026

David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schema_name results in path traversal. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 1.7.2 will fix this issue. You should upgrade the affected component.

CVE-2026-51864 Crítica · 9.1 CWE-22 30/09/2026

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload…

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.

CVE-2026-51860 Alta · 7.5 CWE-22 30/09/2026

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in…

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.

CVE-2026-51862 Crítica · 9.1 CWE-22 30/09/2026

DB-GPT 0.8.0 contains directory traversal in skill_upload…

DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.

CVE-2026-51859 Crítica · 9.1 CWE-22 30/09/2026

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in…

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).

CVE-2026-51853 Alta · 7.5 CWE-22 30/09/2026

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in…

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction.

CVE-2026-51570 Alta · 8.1 CWE-22 30/09/2026

modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.

CVE-2026-51852 Alta · 7.5 CWE-22 30/09/2026

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in…

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.

CVE-2026-51568 Alta · 8.1 CWE-22 30/09/2026

modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.

CVE-2026-102123 Alta · 7.4 CWE-22 30/09/2026

Kiteworks Core Path Traversal

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering it unavailable until an operator intervenes. Exploitation requires network access to the affected interface, which is not reachable on a fully configured appliance in its default configuration; reaching it depends on either the transient window while an appliance is first being provisioned or a non-default appliance configuration.

CVE-2026-102116 Alta · 7.2 CWE-22 30/09/2026

Kiteworks Email Protection Gateway Path Traversal

-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account.

CVE-2026-102119 Alta · 7.2 CWE-22 30/09/2026

Kiteworks Email Protection Gateway Path Traversal

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system.

CVE-2026-102099 Alta · 7.2 CWE-22 30/09/2026

Kiteworks Core arbitrary file write

Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on the underlying host, potentially leading to command execution on the appliance. Exploitation requires an existing, authenticated administrative account with access to the affected export function.