CVE Database

CVE-2026-111093 High · 7.5 CWE-23 Oct 15, 2026

Relative Path Traversal in Jetbrains Datalore

In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files

CVE-2026-103508 High · 7.3 CWE-23 Oct 15, 2026

Path traversal via logging configuration in P4Search

P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier. Perforce resolved it in 2026.4.3.

CVE-2026-41545 High · 8.6 CWE-23 Oct 15, 2026

WebSocket timelapse path traversal and command injection

A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later

CVE-2026-39993 High · 8.7 CWE-23 Oct 15, 2026

Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter

A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later

CVE-2026-76519 Critical · 9.8 KEV High · 60 CWE-23 Oct 14, 2026

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

CVE-2026-110690 High · 7.5 CWE-23 Oct 14, 2026

Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack

Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

CVE-2026-83923 High · 8.8 CWE-23 Oct 13, 2026

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.

CVE-2026-83873 High · 7.8 CWE-23 Oct 13, 2026

Windows Shell Elevation of Privilege Vulnerability

Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.

CVE-2026-83865 Medium · 4.7 CWE-23 Oct 13, 2026

Windows Internet (wininet.dll) Tampering Vulnerability

Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.

CVE-2026-70222 High · 7.8 CWE-23 Oct 13, 2026

Windows Shell Elevation of Privilege Vulnerability

Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.

CVE-2026-69968 Medium · 6.5 CWE-23 Oct 13, 2026

Windows libarchive Tampering Vulnerability

Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering over a network.

CVE-2026-105275 Medium · 4.3 CWE-23 Oct 8, 2026

Satel Netco Design Relative Path Traversal

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could access file paths outside the intended directory and use observable application responses to determine whether files exist on the host system.

CVE-2026-101024 High · 8.8 CWE-23 Oct 8, 2026

Satel Netco Design Relative path traversal

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations accessible to the application service. Successful exploitation could result in unauthorized file creation or modification and, under certain conditions, arbitrary code execution.

CVE-2026-103663 Critical · 9.4 CWE-23 Oct 8, 2026

Path Traversal leading to Remote Code Execution in Ollama

Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root. This issue was fixed in version 0.35.0.

CVE-2026-76454 Critical · 9.1 CWE-23 Oct 7, 2026

Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.

CVE-2026-90466 Medium · 6.5 CWE-23 Oct 7, 2026

Apache Impala: Path traversal executes JARs outside trusted paths

Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'. The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trusted_jar_paths' have a non-empty value configured by the Impala admin. Users are recommended to upgrade to version 4.5.3, which fixes this issue.

CVE-2026-106552 Medium · 6.5 CWE-23 Oct 6, 2026

Relative Path Traversal in Openbsd Openssh

In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.

CVE-2026-103278 High · 7.3 CWE-23 Oct 1, 2026

Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through improper input validation.

CVE-2026-10739 High · 8.5 CWE-23 Sep 30, 2026

Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.

CVE-2026-8066 Critical · 9.1 CWE-23 Sep 29, 2026

Relative Path Traversal in Hitachi Energy RTU500 series CMU firmware

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.

CVE-2026-93537 Medium · 6.5 CWE-23 Sep 28, 2026

Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory

A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material that the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured. This affects Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, 0.13 before 0.13.16, 0.12 before 0.12.20 and potentially older unsupported versions.

CVE-2026-93468 High · 7.5 CWE-23 Sep 18, 2026

HGiga｜OAKlouds - Arbitrary File Read

The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files.

CVE-2026-76424 High · 7.2 CWE-23 Sep 16, 2026

Cisco ISE Arbitrary File Access Vulnerability

A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a crafted path. A successful exploit could allow the attacker to upload files to arbitrary locations and execute arbitrary commands as root on the affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVE-2026-76440 Critical · 9.8 CWE-23 Sep 14, 2026

Cisco Secure Email Gateway Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76440 are related to path traversal issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-23.

CVE-2026-82768 High · 8.1 CWE-23 Sep 14, 2026

Relative Path Traversal in Contec SGA1000

Path traversal vulnerability exists in SGA1000. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker who can access the product via FTP.