Path traversal in AshAdmin file uploads via unsanitized client filename
CVE-2026-82673
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allo
#cwe-22
共收录 2656 条相关情报。
← 返回所有主题A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Cache. The manipulat...
CVE-2026-82603
A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?ac
A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Up...
CVE-2026-82599
A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability...
CVE-2026-56718
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web ser
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read...
CVE-2026-56718
AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web ser
Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality,...
CVE-2026-82656
Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated user
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command...
CVE-2026-82635
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads
Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal se...
CVE-2026-82656
Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated user
Admidio before 5.0.12 Path Traversal via Photo ZIP Download
CVE-2026-82656
Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated user
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing pat...
CVE-2026-82635
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads
Pake arbitrary file write via unsanitized download_file filename
CVE-2026-82635
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file...
CVE-2026-82460
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoint
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Att...
CVE-2026-82460
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoint
Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown
CVE-2026-82460
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoint
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due...
CVE-2026-18899
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
CVE-2026-55874
### Summary The SeaweedFS S3 API gateway did not reject `..` path segments in the `X-Amz-Copy-Source` header used by `Co
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.
CVE-2026-18899
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl...
CVE-2026-82286
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthent
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that...
CVE-2026-82275
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file acc
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesyst...
CVE-2026-82286
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthent