CWE-22: Path Traversal vulnerabilities

CVE-2026-106034 is a path traversal vulnerability in Ivanti Xtraction before version 2026.4. It allows a remote authenticated attacker to create or modify arbitrary directories on the host file system. The vulnerability requires low attack complexity and no user interaction but does require authentication with privileges. The impact is limited to integrity, with no confidentiality or availability impact reported. The CVSS score is 5.0, indicating a medium severity level.

A path traversal vulnerability exists in Quasar Framework's @quasar/app-vite SSG page definitions from versions 3.1.0 up to but not including 3.3.0. The vulnerability allows directory traversal or symlink exploitation during the build process, potentially creating files or directories outside the intended output directory with the build user's permissions. Exploitation requires the build process to use untrusted or external content for configuration. The issue is fixed in version 3.3.0.

CVE-2026-18228 is a path traversal vulnerability in Commvault Commvault Cloud's HyperScale MediaAgents that could lead to information disclosure. The issue arises from improper limitation of a pathname to a restricted directory. It affects multiple versions of the software prior to specific maintenance releases. The vulnerability has a high severity score of 7.1. Users are advised to upgrade to the resolved maintenance releases to mitigate the risk.

NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service.

NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.

NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, resulting in the arbitrary creation or overwrite of a file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service.

CVE-2026-85114 is a path traversal vulnerability in Siemens .NET Client Library for SIMATIC S7 Webserver API versions prior to 3.3.61. The affected library does not properly validate filenames received from remote servers during ticket downloads, allowing an attacker who can manipulate the ticket response to write arbitrary files outside the intended directory. This can lead to overwriting existing files accessible to the application if overwriting is enabled.

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.

CVE-2026-105052 is a path traversal vulnerability in IBM Maximo Application Suite versions 8.10, 8.11, 9.0, 9.1, and 9.2. It allows a remote attacker to send specially crafted URL requests containing directory traversal sequences (/../) to access arbitrary files on the system. This vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation information is provided in the available data.

CVE-2026-84320 is a path traversal vulnerability in 0xJacky's nginx-ui affecting versions prior to 2.4.3. The issue arises because the auto-backup filename is constructed from a user-controlled name without sanitizing path separators or '..' components, allowing an authenticated user to escape the intended backup storage directory. This bypasses the administrator-defined backup path boundary, potentially enabling backup archives and sensitive encrypted key files to be written outside authorized directories with the privileges of the nginx-ui process.

CVE-2026-59976 is a path traversal vulnerability in C4illin ConvertX, a self-hosted file conversion service. Versions prior to 0.18.0 use an unsanitized convert_to parameter in the ImageMagick converter, allowing directory traversal sequences to escape the intended output directory. This can enable authenticated users, or unauthenticated users if access is allowed, to write converted files to arbitrary paths, potentially overwriting files or causing denial of service. The issue is fixed in version 0.18.0.

CVE-2026-104102 is a path traversal vulnerability in the FTP and FTPS server components of copyparty before version 1.20.19. It allows uploading files to any directory writable by the copyparty process when FTP or FTPS is explicitly enabled. The vulnerability does not allow reading or overwriting existing files, and filenames have randomized suffixes. It cannot be used to execute code directly via copyparty. The main risk is that uploaded files might affect other software on the same system if that software executes files in writable directories.

CVE-2026-85964 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server. It affects 11.x versions before 11.3.7 and 12.x versions before 12.1.0. An authenticated Query Console user can supply unsafe path values to a privileged filesystem helper, potentially leading to disclosure of arbitrary server files. The vulnerability is related to improper limitation of a pathname to a restricted directory (CWE-22).

FreeRDP versions before 3.32.0 have a path traversal vulnerability in the clipboard file handling function. This flaw allows a malicious RDP server to craft clipboard data with '../' sequences, causing the client to read arbitrary local files when pasting from the clipboard. The vulnerability arises because the function does not properly sanitize server-supplied file names before creating local file URIs.

CVE-2026-85953 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0. It involves improper limitation of a pathname to a restricted directory in privileged legacy InfoStudio modules, which insufficiently validate user-controlled file paths and user-context values. This flaw could allow unauthorized access to server files or execution under an unintended identity.

CVE-2026-103060 is a path traversal vulnerability in erlang rebar3 affecting versions from 3.7.0-rc1 up to but not including 3.27.2. It allows a malicious package publisher to delete directories outside the intended _build directory and extract package files there when dependencies are fetched. This occurs because rebar3 uses an unvalidated app field from package dependencies to construct directory paths, which can be manipulated to traverse directories. The vulnerability was publicly disclosed on 2026-10-12.