CWE-22: Path Traversal vulnerabilities

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose `id` merely looks numeric, the component trusts the supplied `filename`, concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal “auto reply” and “attach uploaded files” options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as `../../../../configuration.php` and receive any file readable by the Joomla process.

CVE-2026-101126 is a medium severity vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.3. The flaw involves improper limitation of pathname to a restricted directory, allowing potential path traversal and metadata tampering. The vulnerability arises because the extension processes JSON arrays per upload field, trusting client-supplied filenames and display names without sufficient validation. This can lead to cross-session claiming and unauthorized file metadata manipulation.

CVE-2026-19743 is a path traversal vulnerability in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS versions prior to 15.82. It allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM or root) by sending crafted IPC commands. This vulnerability can lead to local privilege escalation.

CVE-2026-96419 is a path traversal vulnerability in Wireshark that affects versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. The flaw occurs during the profile import process and can cause the application to crash, resulting in a denial of service. There is also potential for code execution. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-96440 is a path traversal vulnerability in Flowring Technology Corp's Agentflow 4.0. It affects the /WebAgenda/download/uploadFile.jsp API endpoint, allowing remote authenticated users to write files outside the intended upload directory by manipulating the path parameter. This vulnerability exists in versions before 2023/03/24. The CVSS 4.0 score is 7.1, indicating high severity.

CVE-2026-55156 is a path traversal vulnerability in the token-optimizer-mcp product by ooples. Versions prior to 5.1.0 have an unauthenticated HTTP server exposing endpoints that accept a sessionId parameter concatenated directly into a filesystem path. This allows an attacker to read arbitrary .jsonl files on the server filesystem. The issue is fixed in version 5.1.0.

FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution (RCE). Authentication with a known username is required. The vulnerability stems from insufficient path sanitization in the file conversion process, enabling path traversal attacks that place malicious PHP files in the web server's root directory. This issue has been patched in versions 16.0.10 and 17.0.5.

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink entries so that a later entry resolves outside the output directory. This allows files outside output to be read or written, and overwriting startup scripts or configuration can lead to remote code execution. The maintained @xhmikosr/decompress package is fixed in 10.2.2 and 11.1.4, but the separately affected unmaintained decompress package remains unpatched through 4.2.1. This vulnerability results from a bypass of the incomplete hardening for CVE-2026-53486. @xhmikosr/decompress is fixed in versions 10.2.2 and 11.1.4.

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. Upgrading to version 4.6.0 is able to mitigate this issue. The identifier of the patch is ac0384edc9dbea3b226edefcf50613bd8509134f. You should upgrade the affected component.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.

CVE-2026-85526 is a critical path traversal vulnerability in the Btrfs storage driver of Canonical LXD on Linux. It allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem with root privileges by exploiting a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14.

Dayforce ESS Excelity contains a critical path traversal vulnerability (CWE-22) in its file download functionality. An unauthenticated attacker can exploit this flaw by sending a crafted GET request with a file path parameter that references arbitrary local files. This vulnerability allows unauthorized access to restricted files on the server. The issue has been fixed in version 4 of the product.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Path Traversal. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.

CVE-2026-97164 is a high-severity vulnerability in the Event Gallery extension for Joomla by svenbluege.de. Versions from 1.0.0 through 6.0.0 are affected. The flaw allows an authenticated user to perform arbitrary recursive deletion of directories writable by the web server via the 'images' parameter in the 'cache.process' task. This improper limitation of pathname to restricted directories (CWE-22) can lead to significant data loss or service disruption.

CVE-2026-84069 is a medium severity vulnerability in the WebFacing™ WordPress plugin versions 5.3 up to but not including 5.4. It involves improper limitation of a pathname to a restricted directory (CWE-22), allowing unauthenticated users to perform Local File Inclusion by exploiting a bundled script that does not validate user-supplied paths.

CVE-2026-97163 is a critical vulnerability in the lomart.fr UP plugin for Joomla affecting versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. It involves improper limitation of a pathname to a restricted directory (CWE-22), allowing unauthenticated remote code installation. The vulnerability has a CVSS 4.0 base score of 10.0, indicating it is exploitable over the network without authentication and can lead to severe impact. No patch or remediation information is currently available from the vendor.