CVE-2026-96612 is a path traversal vulnerability in hexpm hex affecting versions from 0.6.0 up to but not including 2.5.2. It allows a malicious package publisher to specify a crafted application label that causes the dependency management process to delete and overwrite directories outside the intended deps directory. This occurs because hex does not validate the app label properly and uses it directly to determine the directory path for unpacking packages. The vulnerability can lead to arbitrary directory deletion and file overwriting during dependency fetching or updating.
CVE-2026-93695 is a vulnerability in Progress ShareFile Storage Zones Controller version 5.12.6 and earlier. The FileCopyService component improperly constructs local temporary file paths using remote file identifiers without proper containment enforcement. This flaw allows an attacker to write arbitrary content to filesystem locations writable by the service account, potentially leading to remote code execution if the writable location is served by IIS and executable.
CVE-2026-78355 is a path traversal vulnerability in the OTRS SendSupportBundle functionality that allows an authenticated administrator to reference file paths outside the intended directory. This can lead to deletion of files accessible to the OTRS application process within the permissions of the web server or OTRS user. The vulnerability affects multiple OTRS versions prior to 2026.7.X. Exploitation requires valid administrative access, and direct arbitrary file disclosure to attackers has not been demonstrated.
CVE-2026-21133 is a medium severity vulnerability in Samsung Flow prior to version 4.9.22.1. It is a path traversal flaw (CWE-22) that allows local attackers to access clipboard data by improperly limiting pathname access to restricted directories.
CVE-2026-87690 is a path traversal vulnerability in the Metasploit Framework's post module post/apple_ios/gather/ios_image_gather. It allows an attacker controlling a hostile iOS device to write arbitrary files on the pentester's workstation by manipulating file names in a directory listing. This can lead to persistent code execution as the operator, potentially with root privileges, when msfconsole is next launched. The issue arises from lack of sanitization of file names before writing to the local filesystem. A fix involves sanitizing file names to prevent directory traversal.
CVE-2026-78530 is a path traversal vulnerability in Chimpstudio FoodBakery versions up to 4.6 that allows subscribers to delete arbitrary files. This vulnerability can lead to denial of service by impacting availability. It requires network access with low complexity and privileges of a subscriber-level user. No patch information is currently provided.
CVE-2026-66481 is a path traversal vulnerability in Presto Player Pro versions up to 3.0.1 that allows an authenticated user with high privileges to arbitrarily delete files. This vulnerability does not impact confidentiality or integrity but can cause denial of service by deleting critical files.
The Listdom plugin for WordPress, versions up to and including 6.1.2, contains a path traversal vulnerability in the LSD_Menus_IX_CSV::import function. This flaw allows authenticated users with administrator-level privileges to delete arbitrary files on the server by exploiting insufficient file path validation. Deleting critical files such as wp-config.php could lead to remote code execution. The vulnerability has a medium severity rating with a CVSS score of 4.9.
The Divi Plus WordPress plugin versions up to and including 2.4.0 contain a path traversal vulnerability in the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This flaw allows unauthenticated attackers to read arbitrary files on the server by exploiting insufficient validation of the 'svg_image' parameter. The endpoint's permission callback returns true unconditionally, and sanitization functions used do not prevent access to filesystem paths or URLs. This vulnerability has a high severity rating with a CVSS score of 7.5.
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress contains a critical path traversal vulnerability in the rename_files function affecting all versions up to and including 34.0.10. This flaw allows unauthenticated attackers to delete arbitrary files on the server. The attack can lead to remote code execution by deleting sensitive files such as wp-config.php. Additionally, the vulnerability enables arbitrary file reads by relocating files into a publicly accessible directory.
The SiteOrigin Widgets Bundle WordPress plugin up to version 1.74.3 contains a directory traversal vulnerability in the get_instance_css function. Authenticated users with contributor-level access or higher can exploit this flaw to read arbitrary files on the server. This occurs because the normal input sanitization pipeline is bypassed when the shortcode handler calls the widget function directly on attacker-supplied JSON data.
The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.
The Post Export Import with Media plugin for WordPress contains a directory traversal vulnerability in all versions up to and including 1.17.1. Authenticated users with administrator-level privileges can exploit this flaw by uploading a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the 'file_path' parameter. This allows reading arbitrary files on the server, potentially exposing sensitive information. The vulnerability bypasses extension checks introduced in version 1.13.2. The CVSS score is 4.9, indicating medium severity.
CVE-2026-108258 is a path traversal vulnerability in py-shiny, a Python framework for interactive web applications. Versions from 1.4.0 up to but not including 1.6.4 allow an unauthenticated attacker to manipulate the bookmark restore feature by supplying a crafted state_id. This can lead to unauthorized reading of files outside the intended bookmark directory, including sensitive files like input.json and values.json. Additionally, in configurations using server-side bookmark storage and ui.input_file(), attackers can copy and expose arbitrary files from the server. The issue is fixed in version 1.6.4.
CVE-2026-103412 is a path traversal vulnerability in Apache Camel Karavan versions from 3.18.0 up to but not including 4.22.1. An authenticated user can supply a project file name containing '../' sequences, causing files to be written outside the intended project directory. This allows overwriting of application configuration or classpath files, potentially enabling code execution within the Karavan container. The issue is fixed in version 4.22.1.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a path traversal vulnerability (CWE-22). This flaw allows a high privileged local attacker to potentially execute code and access the filesystem by improperly limiting pathname access to restricted directories. The vulnerability has a CVSS 3.1 base score of 6.3, indicating medium severity. No official patch or remediation details are provided in the input data.
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.
CVE-2026-75875 is a critical path traversal vulnerability in IBM Guardium Data Protection versions 12.0, 12.1, and 12.2. This flaw allows a remote attacker to execute arbitrary code by improperly limiting pathname access to restricted directories.
IBM Guardium Data Protection versions 12.1 and 12.2.2 contain a path traversal vulnerability (CWE-22) that could allow a remote attacker to delete arbitrary files. This vulnerability arises from improper limitation of pathnames to restricted directories, potentially enabling unauthorized file deletion. The vulnerability has a high severity with a CVSS score of 8.1.