Base de CVEs

CVE-2026-108980 Alta · 8.8 CWE-24 11/10/2026

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via...

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.

CVE-2026-92533 Alta · 7.1 CWE-24 07/10/2026

Path Traversal in BugTracker.NET

Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successful exploitation could allow the attacker to read system files accessible to the account used by the application.

CVE-2026-105314 Alta · 7.5 CWE-24 05/10/2026

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal…

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.

CVE-2026-44942 Média · 6.5 CWE-24 18/06/2026

libzypp .repo files can have an optional path which can lead to path traversal attacks

A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.

CVE-2026-49103 Crítica · 9.4 CWE-24 27/05/2026

Webmin before 2.640 does not safely construct a filename for saving of an attachment…

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.

CVE-2026-22810 Alta · 7.3 CWE-24 18/05/2026

Joplin: Path traversal in OneNote importer allows overwriting arbitrary files

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it's possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file. This issue has been patched in version 3.5.7.

CVE-2026-33431 Média · 6.5 CWE-24 20/04/2026

Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config/<service>/show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and its contents returned to the caller. The existing path traversal guard only inspects the base directory variable (which is never user-controlled) and entirely ignores the user-supplied configver value. An authenticated attacker can supply a configver value containing `../` sequences to escape the intended directory and read arbitrary files accessible to the web application process. Version 8.2.6.4 contains a patch for the issue.

CVE-2026-40318 Alta · 8.5 CWE-24 16/04/2026

SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

CVE-2026-39813 Crítica · 9.8 CWE-24 14/04/2026

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through…

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests.

CVE-2024-43035 Média · 5.8 CWE-24 05/03/2026

Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via…

Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.

CVE-2025-67364 Alta · 7.5 CWE-24 07/01/2026

fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in…

fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability arises from improper path validation that fails to resolve symbolic links to their actual physical paths. The safePath and isPathAllowed functions use path.resolve() which does not handle symlinks, allowing attackers to bypass directory access restrictions by creating symlinks within allowed directories that point to restricted system paths. When these symlinks are accessed through valid path references, the validation checks are circumvented, enabling access to unauthorized files.

CVE-2026-21436 Média · 5.5 CWE-24 01/01/2026

eopkg has Path Traversal: '../filedir' vulnerability

eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `--destdir`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be installed in the path given by `--destdir`, but on a different location on the host. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.

CVE-2025-68430 Média · 4.3 CWE-24 19/12/2025

CVAT vulnerable to directory traversal via mounted share listing

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT instance is able to retrieve the contents of any file system directory accessible to the CVAT server. The exposed information is names of contained files and subdirectories. The contents of files are not accessible. Version 2.53.0 contains a patch. No known workarounds are available.

CVE-2025-67845 Média · 5.4 CWE-24 18/12/2025

A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify…

A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing path traversal sequences.

CVE-2025-61318 Crítica · 9.1 CWE-24 08/12/2025

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems…

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.

CVE-2025-51661 Alta · 7.5 CWE-24 19/11/2025

A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary…

A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use local filesystem storage. SystemFileStorage.save_file method in core/storage.py uses filenames from user input without validation to construct save_path and save files. This allows remote attackers to perform arbitrary file writes outside the intended directory by sending crafted POST requests with malicious traversal sequences to /share/file/ upload endpoint, which does not require any authorization.

CVE-2025-63298 Alta · 8.2 CWE-24 30/10/2025

A path traversal vulnerability was identified in SourceCodester Pet Grooming Management…

A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php component. An authenticated user with administrative privileges can leverage this flaw by submitting a specially crafted POST request, enabling the deletion of arbitrary files on the web server or underlying operating system.

CVE-2023-53691 Alta · 8.3 CWE-24 22/10/2025

Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through…

Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as exploited in the wild in 2024 and 2025.

CVE-2025-60344 Alta · 8.6 CWE-24 21/10/2025

A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows…

A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution (e.g., via sequences such as “../”). Successful exploitation may allow access to files outside of the intended directory, potentially exposing sensitive system or configuration files. The issue results from insufficient validation or sanitization of user-supplied input. Affected Products include: DSR-150, DSR-150N, and DSR-250N v1.09B32_WW.

CVE-2025-57618 Alta · 7.3 CWE-24 14/10/2025

A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker…

A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to read arbitrary files on the server. By leveraging this vulnerability, it is possible to access the application's configuration files, which contain the secret key used to sign JSON Web Tokens as well as existing JTIs. With this information, an attacker can forge valid JWTs, impersonate the root user, and achieve remote code execution in privileged context via authenticated endpoints.

CVE-2025-57563 Média · 6.5 CWE-24 14/10/2025

A path traversal in StarNet Communications Corporation FastX v.4 through v4.1.51 allows…

A path traversal in StarNet Communications Corporation FastX v.4 through v4.1.51 allows unauthenticated attackers to read arbitrary files.

CVE-2025-27920 Alta · 8.8 KEV Alta · 56 CWE-24 05/05/2025

Srimax Output Messenger Directory Traversal Vulnerability

Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.