Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE
### Summary When the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input
#cwe-22
共收录 2819 条相关情报。
← 返回所有主题netlicensing-mcp: REST Path Traversal Bypasses Token Redaction
## REST Path Traversal Bypasses Token Redaction in netlicensing-mcp ### Summary The `netlicensing_get_product` MCP too
Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape
CVE-2026-54319
## Summary A sandbox volume reference (`volumeId`, which may also be a volume name) was forwarded to the runner and used
UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any file on the application’s server that application has priv...
CVE-2026-54223
UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any f
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the int...
CVE-2026-8811
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An atta
TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to c...
CVE-2026-48768
TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is
The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name co...
CVE-2026-12568
The postman_download module uses the workspace name field from the Postman API to construct the local directory path wit
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GN...
CVE-2026-12565
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, re
CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::...
CVE-2026-48820
CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1
Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated...
CVE-2026-49133
Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level pri
Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the...
CVE-2026-55201
Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function
Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content direc...
CVE-2026-49133
Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level pri
Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function that allows a rogue or compromised remote Windows server ...
CVE-2026-55201
Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function
handlebars.java FileTemplateLoader Path Traversal
CVE-2026-55760
### Impact Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or Clas
picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing...
CVE-2026-53872
picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to r
A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute...
CVE-2026-20181
A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on
Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.
CVE-2026-54193
Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.
Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.
CVE-2026-52716
Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
CVE-2026-54017
### Summary The terminal-server reverse proxy in `backend/open_webui/routers/terminals.py` does not fully confine the u
Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}
CVE-2026-54014
## Summary A path traversal vulnerability exists in open-webui's cache file serving endpoint that allows any authentica