CWE-22: Path Traversal vulnerabilities

CVE-2026-92153 is a path traversal vulnerability in NASA's F Prime (fprime) framework prior to version 4.3.0. The vulnerability arises from improper handling of file upload destination paths in the Svc::FileUplink component, which does not canonicalize or restrict paths. This allows an attacker able to send file-uplink packets to create or overwrite files at arbitrary writable filesystem locations, impacting integrity and potentially availability. The issue is fixed in version 4.3.0.

Dell Unisphere for PowerMax vApp version 9.2.4.x contains a path traversal vulnerability (CWE-22) that allows a low privileged remote attacker to access restricted directories, potentially leading to information disclosure. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity). No patch or remediation information is currently provided by the vendor.

A path traversal vulnerability exists in the Ultimate Multisite WordPress plugin before version 2.17.2. This flaw allows unauthenticated attackers to include and read arbitrary local files on the server, including sensitive files such as the WordPress configuration file. The vulnerability arises from improper validation of user-supplied input used to select files for inclusion.

CVE-2026-110458 is a low severity path traversal vulnerability in Ubiquiti Inc's UniFi Protect AI Key. An attacker with network access could exploit this flaw under certain conditions to create or truncate files on the affected device. No known exploits are reported in the wild. The vulnerability affects versions from 0 up to but not including 2.2.8.

CVE-2026-110457 is a path traversal vulnerability in Ubiquiti Inc's UniFi Protect AI Key. An attacker with network access and under certain conditions could exploit this flaw to read information about files on the device. The vulnerability has a low severity score of 3.7 and does not allow modification or denial of service. Affected versions are those prior to 2.2.8. No known exploits or patches are currently reported.

CVE-2026-103820 is a path traversal vulnerability in Adobe Content Credentials Rust SDK that allows an attacker to write files outside of intended directories. Exploitation requires user interaction, specifically extracting a maliciously crafted file. The vulnerability has a medium severity with a CVSS score of 5.5. No patch or remediation information is currently provided.

Adobe ColdFusion 2025 contains a critical path traversal vulnerability (CVE-2026-90530) in its Remote Development Services (RDS) feature. This flaw allows an attacker to read arbitrary files on the file system outside the intended restricted directories without requiring user interaction. The vulnerability affects ColdFusion versions up to 2025.0.13 and 2023.0.25. RDS is intended only for development and is disabled when ColdFusion is set to Production Secure Profile. Disabling RDS or running ColdFusion in Production Secure Profile mitigates the risk.

CVE-2026-79715 is a path traversal vulnerability in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9. It allows a local attacker to use a specially crafted application archive to write files outside the intended directory. This could lead to unauthorized file modification on the system.

Adobe Experience Manager 6.5 LTS contains a path traversal vulnerability (CWE-22) that allows a low-privileged attacker to write files to unauthorized locations on the file system without user interaction. This vulnerability changes the security scope and can lead to arbitrary file system writes.

CVE-2026-102226 is a path traversal vulnerability in Microsoft Dynamics NAV 2018 that allows an authorized attacker to elevate privileges over a network by improperly limiting pathname access to restricted directories. The vulnerability affects versions from 1.0 up to but not including 11.0.50736.0. A patch is available in version 11.0.50736.0 to address this issue.

CVE-2026-85932 is a path traversal vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to disclose information over a network by improperly limiting pathname access to restricted directories. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20190. A fix is available in version 16.0.20326.20190.

CVE-2026-70084 is a path traversal vulnerability in the Windows Projected File System component of Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to disclose information due to improper access control. The vulnerability has a medium severity with a CVSS score of 5.5. Official patches have been released to address this issue in multiple Windows 10 builds.

CVE-2026-70298 is a path traversal vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to disclose information over a network by improperly limiting pathname access to restricted directories. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20190. A patch is available and has been officially released by Microsoft.

CVE-2026-70161 is a path traversal vulnerability in the Microsoft .NET 10.0 runtime that allows an authorized local attacker to elevate privileges by improperly limiting pathname access to restricted directories. The flaw affects multiple versions of the .NET runtime prior to fixed releases. A high-severity CVSS 3.1 score of 7.3 reflects the potential for complete confidentiality, integrity, and availability impact. Official patches are available from Microsoft to remediate this issue.

CVE-2026-69943 is a path traversal vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to execute code remotely over a network. The flaw exists due to improper limitation of pathname to a restricted directory. A fix is available in version 16.0.20326.20190.

CVE-2026-69973 is a path traversal vulnerability in the Windows Libarchive component of Microsoft Windows 10 Version 1809 and related builds. This flaw allows an unauthorized attacker to perform tampering over a network by improperly limiting pathname access to restricted directories. The vulnerability has a CVSS score of 6.5 (medium severity) and affects multiple Windows 10 builds prior to their respective fixed versions. Microsoft has issued official fixes for all affected versions.

CVE-2026-102238 is a critical path traversal vulnerability in Microsoft Visual Studio Code that allows unauthorized attackers to execute code remotely. The flaw involves improper limitation of pathnames to restricted directories, enabling code execution over a network. This vulnerability affects versions from 1.0.0 up to but not including 1.141.1. An official fix is available in version 1.141.1.

CVE-2026-102229 is a path traversal vulnerability in Microsoft Visual Studio Code that allows an authorized attacker to disclose information over a network by improperly limiting pathname access to restricted directories. The vulnerability affects versions from 1.0.0 up to but not including 1.141.1. A fix is available in version 1.141.1.

CVE-2026-105727 is a path traversal vulnerability in Microsoft Dynamics NAV 2018 that allows an authorized attacker to elevate privileges over a network by improperly limiting pathname access to restricted directories. The vulnerability affects versions from 1.0 up to but not including 11.0.50736.0. An official fix is available in version 11.0.50736.0. No known exploits are reported in the wild.

CVE-2026-106047 is a path traversal vulnerability in Ivanti Xtraction's template export functionality that affects versions before 2026.4. It allows a remote authenticated attacker to read arbitrary files on the system. The vulnerability has a high severity with a CVSS score of 7.7. No specific affected versions are provided beyond being prior to 2026.4. There is no information about available patches or vendor advisories. The vulnerability requires authentication and does not impact integrity or availability.