#cwe-22

共收录 2700 条相关情报。

漏洞预警2026-08-25 发布INFO

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. A...

CVE-2026-79781

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-l

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disc...

CVE-2026-79773

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowin...

CVE-2026-79676

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths usin

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-08-25 发布INFO

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

CVE-2026-55677

### Summary Echo's router and static file handler disagree on URL path decoding. The router matches routes using the ra

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-22 #severity:high

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. ...

CVE-2026-55540

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() ra

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or pat...

CVE-2026-55527

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized u

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-08-25 发布INFO

A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpo...

CVE-2026-79622

A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the compo...

CVE-2026-78886

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/s

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intende...

CVE-2026-57863

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated co

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend ...

CVE-2026-77139

The extension fails to validate a client-supplied template element key before using it to build file paths for saving an

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-08-25 发布INFO

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the ...

CVE-2026-68062

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing...

CVE-2026-78638

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dis

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. At...

CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary g

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to en...

CVE-2026-72697

Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to vali

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrar...

CVE-2026-72695

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated u

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-25 发布INFO

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An a...

CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop actio

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-08-25 发布INFO

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of...

CVE-2026-78435

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Contr

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:low

安全公告2026-08-25 发布INFO

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

CVE-2026-78284

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:high

漏洞预警2026-08-24 发布LOW

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the compo...

CVE-2026-78435

CVE-2026-78435 是影响 Faveo Helpdesk（至 2.0.3 版本）的一个安全漏洞。该漏洞位于 Logo Handler 组件的 app/Http/Controllers/Admin/helpdesk/Settings

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-08-24 发布INFO

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

CVE-2026-78284

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22