#cwe-22

共收录 2656 条相关情报。

漏洞预警2026-09-04 发布INFO

Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project directory. Attackers can influence mode...

CVE-2026-85690

Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files ou

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an uncon...

CVE-2026-85685

AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segme...

CVE-2026-85665

Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitr

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply...

CVE-2026-85661

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directiv...

CVE-2026-85618

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users t

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory conta...

CVE-2026-85606

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-09-04 发布INFO

Plandex 2.2.1 Path Traversal via ApplyFiles

CVE-2026-85690

Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files ou

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-09-04 发布INFO

AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skill

CVE-2026-85685

AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-09-04 发布INFO

Bruno 3.4.2 Arbitrary File Read via Unconfined Body File Path

CVE-2026-85665

Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitr

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-09-04 发布INFO

excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode

CVE-2026-85661

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attacker

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-09-04 发布INFO

ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives

CVE-2026-85618

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users t

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

漏洞预警2026-09-04 发布INFO

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function accepts parameters ...

CVE-2026-74236

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf_handle_download() function acc...

CVE-2026-74235

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read...

CVE-2026-85580

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-se

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-09-04 发布INFO

SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch

CVE-2026-85580

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-se

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

漏洞预警2026-09-04 发布INFO

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attac...

CVE-2026-79707

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 throug

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrat...

CVE-2026-82193

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name be

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Serv...

CVE-2026-85409

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireSer

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-09-04 发布INFO

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to...

CVE-2026-67397

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:high

安全公告2026-09-04 发布INFO

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in...

CVE-2026-85456

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowin

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:medium