CVE Database

CVE-2026-88136 High · 8.8 CWE-41 Oct 13, 2026

Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability

Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.

CVE-2026-70184 High · 7.8 CWE-41 Oct 13, 2026

Windows Backup Engine Elevation of Privilege Vulnerability

Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

CVE-2026-108463 High · 8.8 CWE-41 Oct 13, 2026

Windows SmartScreen Security Feature Bypass Vulnerability

Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-102231 High · 7.7 CWE-41 Oct 13, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-102217 High · 8.8 CWE-41 Oct 13, 2026

WebDAV Elevation of Privilege Vulnerability

Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.

CVE-2026-93709 Medium · 5.3 CWE-41 Sep 21, 2026

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts.

CVE-2026-57441 High · 8.4 CWE-41 Sep 15, 2026

MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On case-insensitive macOS and Windows filesystems, case variants of .git, .obsidian, or node_modules pass both isAllowed() and isAllowedForListing() even though the operating system opens the restricted directory, and Windows trailing dots or spaces provide the same bypass. An attacker who influences a path selected by an AI agent can use the bypass in read, write, move, search, or listing operations to expose or modify sensitive repository and Obsidian metadata. Vault-root .. containment is not affected. This issue is fixed in version 0.11.4.

CVE-2026-85978 Critical · 9.8 CWE-41 Sep 9, 2026

Unauthenticated Remote Code Execution in Akana API Platform

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.

CVE-2026-73019 Medium · 4.3 CWE-41 Sep 8, 2026

Windows URL Moniker Security Feature Bypass Vulnerability

Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-72835 Medium · 6.8 CWE-41 Aug 14, 2026

filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.

CVE-2026-66064 Medium · 5.3 CWE-41 Jul 28, 2026

goshs has ACL Bypass & Path Traversal

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.

CVE-2026-49401 High · 8.4 CWE-41 Jun 23, 2026

Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.

CVE-2026-50568 Low · 3.6 CWE-41 Jun 10, 2026

Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefix(path, safedir). This is a lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed. The function did not enforce a path-separator boundary, so any sibling directory whose name began with the safe-directory string was accepted. Callers included the builder's Clean handler (pkg/builder/builder.go:208) and the fetcher's Fetch / Upload handlers (pkg/fetcher/fetcher.go). A tenant who could pre-create or control a sibling directory under the fetcher / builder's shared volume could induce a write or read outside the intended safe directory. This issue has been patched in version 1.25.0.

CVE-2026-5816 High · 8.1 CWE-41 Apr 22, 2026

Improper Resolution of Path Equivalence in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.

CVE-2026-34510 Medium · 5.3 CWE-41 Apr 1, 2026

OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders

OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file targets that are treated as local content, bypassing intended access restrictions.

CVE-2026-23674 High · 7.5 CWE-41 Mar 10, 2026

MapUrlToZone Security Feature Bypass Vulnerability

Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.

CVE-2025-58290 Medium · 5.5 CWE-41 Oct 11, 2025

Denial of service (DoS) vulnerability in the office service. Successful exploitation of…

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.