Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD
CVE-2026-85526
Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with in
#cwe-22
共收录 2619 条相关情报。
← 返回所有主题CLI Path Traversal via Content-Disposition in LXD Image Export/Copy
CVE-2026-86334
Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10,
A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/src/controllers/databaseConnections.js of the component Ex...
CVE-2026-101069
A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/s
A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js of the component C...
CVE-2026-101068
A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packag
A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile of the file files.js of the component save-uploaded-file...
CVE-2026-101067
A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile
A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of the component Archiv...
CVE-2026-101066
A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packag
A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the ...
CVE-2026-19444
A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When cop
Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes
CVE-2026-19444
A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When cop
A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The ma...
CVE-2026-101036
A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.joi
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management Sys...
CVE-2026-82915
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders,...
CVE-2026-101051
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated use
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0...
CVE-2026-101044
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination direc...
CVE-2026-101051
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated use
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken fr...
CVE-2026-101044
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.
Cloudreve before 4.16.1 Path Traversal via Remote Download
CVE-2026-101051
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated use
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in...
CVE-2026-97164
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extensio
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using the `images` parameter of the `cache.pr...
CVE-2026-97164
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extensio
The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local ...
CVE-2026-84069
The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5...
CVE-2026-97163
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin...
CVE-2026-97161
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.