Base de CVEs

CVE-2026-103533 Média · 4.1 CWE-22 01/10/2026

David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schema_name results in path traversal. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 1.7.2 will fix this issue. You should upgrade the affected component.

CVE-2026-51864 Crítica · 9.1 CWE-22 30/09/2026

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload…

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.

CVE-2026-51860 Alta · 7.5 CWE-22 30/09/2026

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in…

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.

CVE-2026-51862 Crítica · 9.1 CWE-22 30/09/2026

DB-GPT 0.8.0 contains directory traversal in skill_upload…

DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.

CVE-2026-51859 Crítica · 9.1 CWE-22 30/09/2026

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in…

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).

CVE-2026-51853 Alta · 7.5 CWE-22 30/09/2026

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in…

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction.

CVE-2026-51570 Alta · 8.1 CWE-22 30/09/2026

modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.

CVE-2026-51852 Alta · 7.5 CWE-22 30/09/2026

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in…

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.

CVE-2026-51568 Alta · 8.1 CWE-22 30/09/2026

modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.

CVE-2026-102123 Alta · 7.4 CWE-22 30/09/2026

Kiteworks Core Path Traversal

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering it unavailable until an operator intervenes. Exploitation requires network access to the affected interface, which is not reachable on a fully configured appliance in its default configuration; reaching it depends on either the transient window while an appliance is first being provisioned or a non-default appliance configuration.

CVE-2026-102116 Alta · 7.2 CWE-22 30/09/2026

Kiteworks Email Protection Gateway Path Traversal

-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account.

CVE-2026-102119 Alta · 7.2 CWE-22 30/09/2026

Kiteworks Email Protection Gateway Path Traversal

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system.

CVE-2026-102099 Alta · 7.2 CWE-22 30/09/2026

Kiteworks Core arbitrary file write

Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on the underlying host, potentially leading to command execution on the appliance. Exploitation requires an existing, authenticated administrative account with access to the affected export function.

CVE-2026-102097 Alta · 7.2 CWE-22 30/09/2026

Kiteworks Email Protection Gateway remote code execution

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could potentially allow arbitrary commands to be executed on the affected gateway.

CVE-2026-102089 Alta · 7.2 CWE-22 30/09/2026

Kiteworks Email Protection Gateway path traversal

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.

CVE-2024-58387 Alta · 7.5 CWE-22 30/09/2026

Inspur HCM Cloud Arbitrary File Read via file/download Endpoint

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as /api/model_report/file/download?index=/&ext=<path> to traverse the filesystem and disclose sensitive files including /etc/passwd, application database files, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-04 .

CVE-2023-54403 Alta · 7.5 CWE-22 30/09/2026

Yonyou U8 CRM Arbitrary File Read via getemaildata.php

Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this flaw to read sensitive files outside the web application directory, including configuration files containing database or service credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

CVE-2026-102991 Média · 6.5 CWE-22 30/09/2026

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpath to absorb the traversal segments before the leading dot-dot check, while posixpath resolution can escape the configured template directory. An application that passes attacker-controlled template names or include paths can disclose process-readable files on the same volume, and a targeted file containing Mako template syntax may also be parsed and executed as a template. Raw URL paths are generally normalized before reaching this form, but query strings, form or JSON bodies, route parameters, and dynamic include expressions can preserve it. This issue is fixed in version 1.4.2.

CVE-2026-101885 Alta · 7.8 CWE-22 30/09/2026

ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution.

CVE-2026-55224 Alta · 8.7 CWE-22 30/09/2026

MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands. This issue has been patched in version 3.2.0-alpha.2.

CVE-2026-101295 Alta · 7.3 CWE-22 30/09/2026

Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.

CVE-2026-97242 Média · 6.8 CWE-22 30/09/2026

WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability

Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.

CVE-2026-96824 Média · 6.8 CWE-22 30/09/2026

WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability

Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.

CVE-2026-94123 Alta · 7.5 CWE-22 30/09/2026

WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

CVE-2026-75098 Alta · 7.5 CWE-22 30/09/2026

Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.