Base de CVEs

CVE-2026-33989 Média · 6.5 CWE-22 27/03/2026

@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.

CVE-2026-5027 Alta · 8.8 Exploit público CWE-22 27/03/2026

Langflow - Path Traversal Arbitrary File Write via upload_user_file

The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').

CVE-2026-33748 Alta · 7.5 CWE-22 27/03/2026

BuildKit Git URL subdir component can cause access to restricted files

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.

CVE-2026-29871 Alta · 7.5 CWE-22 27/03/2026

Path Traversal em Theunwindai Awesome Llm Apps

A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19) in the Beifong AI News and Podcast Agent backend in FastAPI backend, stream-audio endpoint, in file routers/podcast_router.py, in function stream_audio. The stream-audio endpoint accepts a user-controlled path parameter that is concatenated into a filesystem path without proper validation or restriction. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files from the server filesystem, potentially disclosing sensitive information such as configuration files and credentials.

CVE-2026-4619 Crítica · 9.8 CWE-22 27/03/2026

Path Traversal vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to wtite over...

Path Traversal vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to wtite over any file via network.

CVE-2026-0394 Média · 5.3 CWE-22 27/03/2026

When dovecot has been configured to use per-domain passwd files, and they are placed one path...

When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. This allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains passwords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear valid users. Upgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can also ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d. No publicly available exploits are known.

CVE-2026-33747 Crítica · 9.8 CWE-22 26/03/2026

Path traversal no Moby BuildKit via frontend personalizado malicioso

BuildKit é um conjunto de ferramentas para converter código-fonte em artefatos de build de forma eficiente, expressiva e repetível. Antes da versão 0.28.1, ao usar um frontend personalizado do BuildKit, o frontend pode criar uma mensagem de API que faz com que arquivos sejam gravados fora do diretório de estado do BuildKit para o contexto de execução. O problema foi corrigido na v0.28.1. A vulnerabilidade exige o uso de um frontend do BuildKit não confiável definido com “#syntax” ou “--build-arg BUILDKIT_SYNTAX”. Usar essas opções com uma imagem de frontend conhecida, como “docker/dockerfile”, não é afetado.

CVE-2026-33945 Crítica · 9.6 CWE-22 26/03/2026

Travessia de caminho na opção de credenciais systemd do Incus permite escrita arbitrária de arquivos

O Incus é um gerenciador de contêineres de sistema e máquinas virtuais. Instâncias do Incus possuem uma opção para fornecer credenciais ao systemd no guest. Para contêineres, isso é feito por meio de um diretório compartilhado. Antes da versão 6.23.0, um invasor pode definir uma chave de configuração com nome semelhante a `systemd.credential.../../../../../../root/.bashrc` para fazer o Incus escrever fora do diretório `credentials` associado ao contêiner. Isso se aproveita do fato de que a sintaxe do Incus para essas credenciais é `systemd.credential.XYZ`, em que `XYZ` pode conter mais pontos. Embora não seja possível ler dados dessa forma, é possível escrever em arquivos arbitrários como root, permitindo escalonamento de privilégios e ataques de negação de serviço. A versão 6.23.0 corrige o problema.

CVE-2026-28786 Média · 4.3 CWE-22 26/03/2026

Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an unsanitized filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a `FileNotFoundError` whose message — including the server's absolute `DATA_DIR` path — is returned verbatim in the HTTP 400 response body, confirming information disclosure on all default deployments. Version 0.8.6 patches the issue.

CVE-2026-33686 Alta · 8.8 CWE-22 26/03/2026

Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.

CVE-2026-33670 Alta · 7.5 CWE-22 26/03/2026

SiYuan has directory traversal within its publishing service

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook. Version 3.6.2 patches the issue.

CVE-2026-33645 Alta · 8.1 CWE-22 26/03/2026

Fireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked`

Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerability in Fireshare’s chunked upload endpoint allows an attacker to write arbitrary files outside the intended upload directory. The `checkSum` multipart field is used directly in filesystem path construction without sanitization or containment checks. This enables unauthorized file writes to attacker-chosen paths writable by the Fireshare process (e.g., container `/tmp`), violating integrity and potentially enabling follow-on attacks depending on deployment. Version 1.5.2 fixes the issue.

CVE-2026-0964 Média · 6.3 CWE-22 26/03/2026

Libssh: improper sanitation of paths received from scp servers

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

CVE-2026-33529 Alta · 8.8 CWE-22 26/03/2026

Zoraxy: Authenticated Path Traversal in Config Import leads to RCE

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue.

CVE-2026-33528 Média · 6.5 CWE-22 26/03/2026

GoDoxy has a Path Traversal Vulnerability in its File API

GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at `/api/v1/file/content` is vulnerable to path traversal. The `filename` query parameter is passed directly to `path.Join(common.ConfigBasePath, filename)` where `ConfigBasePath = "config"` (a relative path). No sanitization or validation is applied beyond checking that the field is non-empty (`binding:"required"`). An authenticated attacker can use `../` sequences to read or write files outside the intended `config/` directory, including TLS private keys, OAuth refresh tokens, and any file accessible to the container's UID. Version 0.27.5 fixes the issue.

CVE-2026-3112 Média · 4.9 CWE-22 26/03/2026

Arbitrary File Read via Advanced Logging Support Packet

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to validate Advanced Logging file target paths which allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in support packet generation. Mattermost Advisory ID: MMSA-2025-00562

CVE-2026-32846 Alta · 7.5 CWE-22 26/03/2026

OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read

OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit incomplete validation and the allowBareFilename bypass to reference files outside the intended application sandbox, resulting in disclosure of sensitive information including system files, environment files, and SSH keys.

CVE-2025-41368 Alta · 8.1 CWE-22 26/03/2026

Multiple vulnerabilities in Small HTTP server by Smallsrv

Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permissions outside the document root configured on the server.

CVE-2026-33183 Crítica · 9.1 CWE-22 25/03/2026

Biblioteca Saloon (PHP): Travessia de Diretório por Nome de Fixture (CWE-22)

A Saloon é uma biblioteca PHP que oferece ferramentas para construir integrações de API e SDKs. Antes da versão 4.0.0, os nomes de fixtures eram usados para construir caminhos de arquivos no diretório de fixtures configurado, sem validação. Um nome contendo segmentos de caminho (por exemplo, ../traversal ou ../../etc/passwd) resultava em um caminho fora desse diretório. Quando a aplicação lia uma fixture (por exemplo, para simulação) ou gravava uma (por exemplo, ao registrar respostas), ela podia ler ou gravar arquivos em qualquer local ao qual o processo tivesse acesso. Se o nome da fixture fosse derivado de entrada controlada por usuário ou atacante (por exemplo, parâmetros de requisição ou configuração), isso constituía uma vulnerabilidade de travessia de diretório e podia levar à divulgação de arquivos sensíveis ou à sobrescrita de arquivos críticos. A correção na versão 4.0.0 adiciona validação na camada de fixtures (rejeitando nomes com /, \, .., ou bytes nulos, e restringindo a um conjunto seguro de caracteres) e defesa em profundidade na camada de armazenamento (garantindo que o caminho resolvido permaneça sob o diretório base antes de qualquer leitura ou gravação).

CVE-2026-4758 Alta · 8.8 CWE-22 25/03/2026

WP Job Portal <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via Resume Custom File Field

The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'WPJOBPORTALcustomfields::removeFileCustom' function in all versions up to, and including, 2.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CVE-2026-30976 Alta · 7.5 CWE-22 25/03/2026

Sonarr Path Traversal vulnerability

Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (containing API keys and database credentials), Windows system files, and any user-accessible files on the same drive This issue only impacts Windows systems; macOS and Linux are unaffected. Files returned from the API were not limited to the directory on disk they were intended to be served from. This problem has been patched in 4.0.17.2950 in the nightly/develop branch or 4.0.17.2952 for stable/main releases. It's possible to work around the issue by only hosting Sonarr on a secure internal network and accessing it via VPN, Tailscale or similar solution outside that network.

CVE-2025-70952 Alta · 7.5 CWE-22 25/03/2026

Path Traversal em Pf4j Project Pf4j

pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.

CVE-2025-67030 Alta · 8.8 CWE-22 25/03/2026

Path Traversal em Codehaus-plexus Plexus-utils

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

CVE-2026-32567 Média · 6.8 CWE-22 25/03/2026

WordPress YML for Yandex Market plugin < 5.3.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in icopydoc YML for Yandex Market yml-for-yandex-market allows Path Traversal.This issue affects YML for Yandex Market: from n/a through < 5.3.0.

CVE-2026-32522 Alta · 8.6 CWE-22 25/03/2026

WordPress WooCommerce Support Ticket System plugin < 18.5 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-ticket-system allows Path Traversal.This issue affects WooCommerce Support Ticket System: from n/a through < 18.5.