Cloudreve's remote download file paths can escape the selected destination directory
### Summary Cloudreve trusts file paths returned by the configured remote downloader. A downloader-reported path such a
#cwe-22
共收录 2700 条相关情报。
← 返回所有主题Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the...
CVE-2026-71932
Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulne
Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the opti...
CVE-2026-71932
Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulne
rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing direct...
CVE-2026-77914
rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitra
A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project direc...
CVE-2026-71364
A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts
RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-contr...
CVE-2026-78381
RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed characte...
CVE-2026-76844
webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against
The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive in...
CVE-2026-76842
The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding th
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
CVE-2026-32477
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
CVE-2026-28171
Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions.
CVE-2026-28167
Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions.
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbi...
CVE-2026-66897
A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions,
A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Andr...
CVE-2026-78196
A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn o
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19...
CVE-2026-10053
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 1
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could hav...
CVE-2026-10053
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 1
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin...
CVE-2026-18027
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerab
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and incl...
CVE-2026-18027
WordPress 插件 WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels（版本直至并包括 4.9.8）存在目录遍历漏洞，
Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
CVE-2026-76606
Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows...
CVE-2026-76598
Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 -
NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pat...
CVE-2026-63312
NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.E