CWE-22: Path Traversal vulnerabilities

CVE-2026-102119 is a path traversal vulnerability in the Kiteworks Email Protection Gateway affecting versions prior to 9.5.0. It exists in an optional, non-default administrative feature and allows an authenticated administrator to move files outside the intended directory. This could enable arbitrary code execution on the underlying system.

CVE-2026-102991 is a path traversal vulnerability in the Mako template library for Python, affecting versions prior to 1.4.2 on Windows. The issue arises because TemplateLookup.get_template() uses posixpath to resolve template URIs, while Template.__init__() validates them with os.path (ntpath on Windows). This mismatch allows crafted template URIs with drive designators to bypass directory restrictions, potentially exposing readable files and enabling execution of attacker-controlled templates. The vulnerability is fixed in version 1.4.2.

CVE-2026-102123 is a path traversal vulnerability in the Kiteworks Core appliance setup interface. It allows an unauthenticated attacker to write files outside the intended directory, potentially compromising the appliance's integrity or causing denial of service. Exploitation requires network access to the setup interface, which is not accessible in the default fully configured appliance but may be reachable during initial provisioning or non-default configurations. The vulnerability affects Kiteworks Core versions prior to 9.5.0.

Kiteworks Email Protection Gateway versions before 9.5.0 contain a vulnerability that allows an authenticated administrator to import configuration files without sufficient validation. This flaw can lead to remote code execution on the affected gateway by processing crafted submissions. The vulnerability is identified as CWE-22 (Path Traversal) and CWE-94 (Improper Control of Generation of Code).

Kiteworks Core versions prior to 9.5.0 contain a path traversal vulnerability (CWE-22) in an administrative export feature. This flaw allows an authenticated administrator to write files to arbitrary locations on the host system, which could lead to command execution on the appliance. Exploitation requires valid administrative credentials and access to the vulnerable export function.

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.

Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.

Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.

Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.

CVE-2026-13224 is a path traversal vulnerability in the WatchGuard Fireware OS WebUI management agent. It allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request. This vulnerability affects multiple versions of Fireware OS prior to their respective fixed releases. The issue has a high severity with a CVSS score of 8.2. Fixed versions are available, and users should upgrade to these versions to remediate the vulnerability.

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access.

CVE-2026-86136 is a high-severity vulnerability in WatchGuard Fireware OS affecting multiple versions prior to fixed releases. It involves a missing authorization check in the wgagent management daemon's session initialization, allowing an authenticated low-privileged user, including read-only or guest administrators, to crash the wgagent process and read arbitrary files accessible to the daemon via specially crafted management API requests.

CVE-2026-102252 is a path traversal vulnerability in Google OSV-SCALIBR's embedded VMDK filesystem extractor versions 0.3.6 through 0.5.0. This flaw allows an attacker controlling the scan target to write arbitrary files outside the intended extraction directory on the host system by exploiting insufficient validation of archive path entries in crafted VMDK images.

CVE-2026-90915 is a path traversal vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. It allows improper validation of cache group names during cache purge actions, enabling arbitrary directory deletions. The vulnerability has a high severity rating with a CVSS 4.0 score of 7. No known exploits are reported in the wild. Joomla! CMS is not a cloud service, and no patch information is provided in the source data.

CVE-2026-84421 is a high-severity vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. It involves improper validation of file paths during archive extraction, allowing a remote authenticated attacker to perform path traversal and execute arbitrary code.

IBM Guardium Data Protection version 12.2 contains a path traversal vulnerability in its Datasource REST component. This flaw allows an authenticated remote attacker to delete arbitrary files, potentially causing denial of service or affecting system integrity. The vulnerability is identified as CWE-22 and has a high severity rating with a CVSS score of 8.1.

Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path validation checks directories lexically without resolving symbolic links first, an attacker can access or overwrite arbitrary local files located outside the permitted root directories.