Base de CVEs

CVE-2026-11420 Crítica · 9.8 CWE-22 05/06/2026

Travessia de Diretório no Altium Enterprise Server NIS Permite Escrita e Leitura Arbitrárias de Arquivos Sem Autenticação

Duas vulnerabilidades de travessia de diretório no Network Installation Service (NIS) do Altium Enterprise Server permitem que um atacante de rede não autenticado grave arquivos arbitrários em qualquer local gravável do sistema de arquivos do servidor e leia arquivos de pacotes armazenados no servidor. Não são necessárias autenticação, sessão ou credenciais. Como arquivos controlados pelo conteúdo podem ser gravados em diretórios acessíveis via web ou usados para sobrescrever binários da aplicação ou arquivos de configuração, a exploração pode evoluir para execução remota de código no contexto da conta de serviço e pode expor o conteúdo dos pacotes de implantação. Implantações na nuvem Altium 365 não são afetadas, pois o Network Installation Service não faz parte da oferta em nuvem.

CVE-2026-11419 Alta · 8.8 CWE-22 05/06/2026

Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded, allowing arbitrary files to be written to any location on the server filesystem writable by the service account. Because content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, this can be escalated to remote code execution, service takeover, or denial of service. Altium 365 cloud deployments are not affected, as the affected endpoint is not reachable and the cloud storage architecture mitigates the file-write primitive.

CVE-2026-11414 Crítica · 9.8 CWE-22 05/06/2026

Vault do Altium Enterprise Server: exfiltração de arquivos sem autenticação via chave fixa e path traversal

Uma chave criptográfica fixa (hard-coded) é usada pelo Altium Enterprise Server para assinar URLs de download no serviço Vault. Como a chave é idêntica em todas as instalações, um atacante de rede não autenticado que consiga alcançar o servidor pode forjar assinaturas de download válidas e recuperar arquivos da área de armazenamento do Vault, sem qualquer autenticação, sessão ou credenciais. Uma vulnerabilidade separada de path traversal no mesmo endpoint de download permite escapar da raiz de armazenamento configurada, possibilitando a leitura de arquivos arbitrários do sistema de arquivos do servidor. Combinadas, essas falhas permitem que um atacante não autenticado obtenha configurações sensíveis do servidor e material de chaves, o que pode levar ao comprometimento total do servidor. A vulnerabilidade pode ser encadeada com o CVE-2026-9152 para enumerar e baixar em massa o conteúdo armazenado. Implantações na nuvem do Altium 365 não são afetadas na prática, pois o armazenamento de arquivos utiliza armazenamento de objetos em vez do sistema de arquivos local.

CVE-2026-36500 Crítica · 9.1 CWE-22 05/06/2026

An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows…

An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request.

CVE-2026-50234 Alta · 7.5 CWE-22 05/06/2026

Lyrion Music Server 9.2.0 Path Traversal File Read

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.

CVE-2026-7774 Média · 6.9 CWE-22 04/06/2026

tarfile.data_filter path traversal bypass allows writing outside the extraction directory

tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.

CVE-2026-40605 Média · 5.7 CWE-22 04/06/2026

Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal vulnerability in the cache deletion endpoint allows authenticated API access to delete directories outside the configured cache path. This can cause arbitrary data loss and service disruption. Version 2.17.1 fixes the issue.

CVE-2019-25740 Média · 6.5 CWE-22 04/06/2026

Joomla com_jsjobs 1.2.6 Arbitrary File Deletion

Joomla com_jsjobs 1.2.6 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating custom userfield parameters. Attackers can send POST requests to the job.savejob task with path traversal sequences in the field_2 parameter to delete arbitrary files accessible to the web server.

CVE-2019-25734 Média · 4.0 CWE-22 04/06/2026

Contact Form by WD 1.13.1 CSRF to Local File Inclusion

Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.

CVE-2019-25727 Crítica · 9.8 CWE-22 04/06/2026

Plugin WordPress Ad Manager WD: download arbitrário de arquivos (CVE-2019-25727)

O plugin WordPress Ad manager wd 1.0.11 contém uma vulnerabilidade de download arbitrário de arquivos que permite que atacantes não autenticados baixem arquivos sensíveis manipulando o parâmetro path. Atacantes podem enviar requisições GET ao endpoint edit.php com export=export_csv e um parâmetro path malicioso para ler arquivos arbitrários, como wp-config.php, acessíveis ao servidor web.

CVE-2026-50207 Alta · 7.8 CWE-22 04/06/2026

Local Modem Manipulation via Binder Interfaces

The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connectivity.

CVE-2024-47273 Média · 4.3 CWE-22 03/06/2026

Path Traversal em Synology Hyper Backup

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors.

CVE-2024-47263 Média · 4.1 CWE-22 03/06/2026

Path Traversal em Synology Hyper Backup

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors.

CVE-2026-35082 Alta · 8.8 CWE-22 03/06/2026

Local file inclusion vulnerability and deletion in ugw-logread method

The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.

CVE-2026-41412 Média · 4.9 CWE-22 02/06/2026

alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the alf.io extension sandbox injects a fully-functional HTTP client (`simpleHttpClient`) into every extension script's scope. The `postFileAndSaveResponse()` method accepts an arbitrary filesystem path as its `file` parameter and reads the file contents using `new FileInputStream(file)` with no path validation, directory restriction, or allowlist. A malicious extension script can read any file accessible to the JVM process user and exfiltrate it to an attacker-controlled server via HTTP POST. Version 2.0-M5-2606 patches the issue.

CVE-2026-49144 Média · 6.5 CWE-22 02/06/2026

BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.

CVE-2026-35718 Média · 6.5 CWE-22 02/06/2026

Path Traversal em Vivotek Fd8136 Firmware

A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated attackers to read any file on the device via sending a crafted request.

CVE-2026-43965 Média · 5.6 CWE-22 02/06/2026

Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion

Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml by LocalPackages::read_from_disc are passed without validation to paths.build_packages_package(), which constructs a filesystem path by joining the project build directory with the attacker-controlled key. The resulting path is then passed to fs::delete_directory (which calls remove_dir_all). No check is performed to ensure the path remains within the intended build/packages/ directory. Both absolute paths and relative traversal sequences (e.g. ../) are accepted as package keys, allowing deletion of arbitrary directories. An attacker who can cause a victim to run gleam deps download on a project containing a malicious build/packages/packages.toml (e.g. by committing the normally-gitignored file to a repository) can cause arbitrary directories on the victim's system to be recursively deleted. This issue affects Gleam from 0.18.0-rc1 until 1.17.0.

CVE-2026-32685 Média · 4.6 CWE-22 02/06/2026

Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write

Path traversal vulnerability in Gleam's handling of custom documentation pages allows arbitrary file read and file write outside the intended documentation output directory. The documentation.pages entries from gleam.toml are incorporated into filesystem paths without sufficient validation or confinement to the intended project and documentation output directories. The documentation.pages[].path field can be used to write generated documentation files outside the intended build/dev/docs/<package>/ output directory. The documentation.pages[].source field can be used to read files outside the project directory and embed their contents into generated documentation output. An attacker who can convince a victim to run gleam docs build on an untrusted project, or with untrusted gleam.toml content, can cause local files readable by the victim to be included in generated documentation artifacts, and can cause generated documentation files to be written outside the intended docs output directory. This issue affects Gleam from 1.16.0 until 1.17.0.

CVE-2026-0055 Média · 6.2 CWE-22 01/06/2026

Path Traversal em Google Android

In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid directory due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-49136 Alta · 7.5 CWE-22 01/06/2026

Banana Slides 0.4.0 Path Traversal via generate_image() in ai_service.py

Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerability in the generate_image() function within the AI service backend that allows unauthenticated attackers to read arbitrary image-format files outside the intended uploads directory by exploiting an incomplete path prefix check using os.path.startswith() without a trailing separator. Attackers can supply crafted markdown image references in user-controlled page descriptions that resolve to sibling directories whose names share the uploads folder prefix, bypassing the directory confinement check and causing the application to read files from unintended locations via PIL Image.open().

CVE-2026-45727 Alta · 8.8 CWE-22 01/06/2026

CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

CloakBrowser is a tool to bypass bot detection tests. Prior to version 0.3.28, the cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted fingerprint value containing path traversal sequences to resolve user_data_dir outside the configured data_dir. When Chrome fails to start or the process is cleaned up, shutil.rmtree() deletes the traversed path, resulting in arbitrary directory deletion. Additionally, cloakserve bound to 0.0.0.0 by default, making it network-exposed. This issue has been patched in version 0.3.28.

CVE-2026-45279 Média · 6.5 CWE-22 01/06/2026

Nextcloud: Limited path traversal via template API if using `{lang}` in config

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal. It is recommended that the Nextcloud Server is upgraded to 32.0.4, 31.0.14. It is recommended that the Nextcloud Enterprise Server is upgraded to 32.0.4, 31.0.14, 30.0.17.7, 29.0.17.12, 28.0.14.15

CVE-2026-43624 Alta · 8.2 CWE-22 01/06/2026

F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project()

F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing unsanitized user-supplied project names directly to os.path.join() without validating the resulting path stays within the intended base directory. Attackers can supply absolute path arguments such as /tmp/EVIL to override the base directory entirely and create arbitrary directories with attacker-controlled JSON content at any filesystem path writable by the server process.

CVE-2026-10278 Média · 6.3 CWE-22 01/06/2026

ishayoyo excel-mcp read_file/write_file index.ts path traversal

A vulnerability was determined in ishayoyo excel-mcp up to 1.0.2. Impacted is an unknown function of the file src/index.ts of the component read_file/write_file. Executing a manipulation of the argument filePath/outputPath can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.