CWE-22: Path Traversal vulnerabilities

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

CVE-2026-19493 is a path traversal vulnerability in IBM Security Verify Access and IBM Verify Identity Access versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. This flaw allows a remote attacker to perform arbitrary file write operations on the affected systems. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating significant risk if exploited. No information about available patches or vendor advisories is provided.

IBM Guardium Data Protection version 12.2 contains a path traversal vulnerability in its GIM file-upload functionality. This flaw allows an unauthenticated attacker to write arbitrary files to the Collector system. The vulnerability is identified as CWE-22 and has a CVSS 3.1 base score of 7.5, indicating high severity. No official patch or remediation details are provided in the available data. There are no known exploits in the wild at this time.

CVE-2026-107709 is a path traversal vulnerability in Bower decompress-zip versions up to 0.3.3. It occurs due to improper validation of archive entry paths during ZIP extraction, allowing crafted ZIP files to write files outside the intended directory. This can lead to arbitrary file overwrite, application compromise, or remote code execution depending on the environment and writable sibling directories.

CVE-2026-19585 is a path traversal vulnerability in HashiCorp's go-getter shared library affecting versions before 1.8.10 and go-getter/v2 before 2.2.5. It allows files to be written outside the intended destination directory during S3 and GCS directory downloads. This issue has been fixed in go-getter 1.8.10 and go-getter/v2 2.2.5. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A path traversal vulnerability (CWE-22) exists in the balbooa.com Gridbox extension for Joomla versions 1.0.0 through 2.20.3.1. The issue occurs in the image preview functionality where the containment logic only checks for prefix matching, allowing access to files in sibling directories outside the intended images root. The vulnerability is limited to certain image file types and is rated medium severity with a CVSS score of 6.3.

When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory.

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.

CVE-2026-105820 is a path traversal vulnerability in HashiCorp Vault Enterprise's ACL policy cache. It allows tokens with specially crafted policy names containing path traversal constructs to access capabilities of policies in other namespaces, including the root namespace. This issue affects Vault Enterprise versions prior to 1.21.12 and has been fixed in versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition is not affected as it does not support namespaces.

CVE-2026-105816 is a path traversal vulnerability in HashiCorp Vault and Vault Enterprise that allows a privileged operator to execute arbitrary code on the Vault host when restoring an Integrated Storage (Raft) snapshot with an external plugin directory configured. The issue arises because Vault did not consistently verify that plugin catalog entries reference binaries only within the configured plugin directory. This vulnerability has a high severity score of 8.0 and is fixed in Vault Community Edition 2.1.2 and Vault Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

CVE-2026-102257 is a high-severity Zip Slip vulnerability in the SonicWall SMA1000 Appliance Management Console (AMC) interface. It allows an attacker with high privileges to extract files outside the intended directory by using a specially crafted archive, potentially leading to remote code execution.

Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lower-privileged attacker to redirect benign edits to sensitive files (e.g., shell configuration) in a higher-privileged session. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version. Thank you to hackerone.com/c_h4ck_0 for reporting this issue.

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to access sensitive information by improperly limiting pathnames to restricted directories. This vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity. The flaw does not impact integrity or availability but allows unauthorized disclosure of information. No official patch or remediation details are provided in the available data.

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.