browse-mcp has an arbitrary file write via unconfined download and state paths
CVE-2026-55557
### Impact `browser_download` wrote a fetched file to `join(save_dir, filename)` with no validation of `save_dir`, and `
#cwe-22
共收录 2656 条相关情报。
← 返回所有主题rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. A...
CVE-2026-79781
rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-l
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disc...
CVE-2026-79773
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows auth
NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowin...
CVE-2026-79676
NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths usin
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
CVE-2026-55677
### Summary Echo's router and static file handler disagree on URL path decoding. The router matches routes using the ra
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. ...
CVE-2026-55540
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() ra
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or pat...
CVE-2026-55527
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized u
A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpo...
CVE-2026-79622
A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-
A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the compo...
CVE-2026-78886
A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/s
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intende...
CVE-2026-57863
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated co
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend ...
CVE-2026-77139
The extension fails to validate a client-supplied template element key before using it to build file paths for saving an
SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the ...
CVE-2026-68062
SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an
A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing...
CVE-2026-78638
A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dis
GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. At...
CVE-2026-78677
GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary g
Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to en...
CVE-2026-72697
Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to vali
Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrar...
CVE-2026-72695
Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated u
Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An a...
CVE-2026-34968
Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop actio
A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of...
CVE-2026-78435
A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Contr
Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.
CVE-2026-78284
Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.
A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the compo...
CVE-2026-78435
CVE-2026-78435 是影响 Faveo Helpdesk（至 2.0.3 版本）的一个安全漏洞。该漏洞位于 Logo Handler 组件的 app/Http/Controllers/Admin/helpdesk/Settings