#cwe-23

共收录 169 条相关情报。

漏洞预警2026-07-27 发布INFO

Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 ...

CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extrac

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-07-22 发布INFO

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function ...

CVE-2026-15802

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

安全公告2026-07-20 发布INFO

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

CVE-2026-62843

## Summary The fix for `GHSA-gxjx-7m74-hcq8` / `CVE-2026-54093` (shipped in v2.63.6) added a `strings.ReplaceAll(nameIn

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-22 #cwe-23 #severity:medium

漏洞预警2026-07-20 发布INFO

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its p...

CVE-2026-58481

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped fil

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23

漏洞预警2026-07-20 发布INFO

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.b...

CVE-2026-58413

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, b

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23

安全公告2026-07-20 发布INFO

Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

CVE-2026-58481

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped fil

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-23

安全公告2026-07-20 发布INFO

EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data

CVE-2026-58413

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, b

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-23

漏洞预警2026-07-20 发布INFO

Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request.

CVE-2026-51026

Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-07-20 发布INFO

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-co...

CVE-2026-54910

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler`

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23

安全公告2026-07-20 发布INFO

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

CVE-2026-54910

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler`

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-23

漏洞预警2026-07-17 发布INFO

AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure required to run bioinformatics analyses at scale for clin...

CVE-2026-15415

AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-07-15 发布INFO

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's a...

CVE-2026-62843

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23

安全公告2026-07-15 发布INFO

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

CVE-2026-62843

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-23

漏洞预警2026-07-14 发布INFO

Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a network.

CVE-2026-56196

Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a network.

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-07-14 发布INFO

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network.

CVE-2026-50663

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code ov

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-07-14 发布INFO

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

CVE-2026-40400

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

安全公告2026-07-10 发布INFO

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

CVE-2026-54066

## Summary The patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the `/export/` route but

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-22 #cwe-23 #cwe-1188 #severity:high

漏洞预警2026-07-10 发布INFO

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path...

CVE-2026-55474

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the rout

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-07-10 发布INFO

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

CVE-2026-59792

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling w

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-07-10 发布INFO

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `WriteFileTool` appear to treat `curr_dir`...

CVE-2026-50181

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `Rea

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23