Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite's server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This issue is fixed in version 4.6.3.
A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device.
Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.
CVE-2026-93864 is a path traversal vulnerability in WatchGuard Fireware OS's firewall daemon. It allows a local attacker with low-privileged code execution to overwrite arbitrary files with root privileges by planting a crafted file system object and triggering a list update. This can also lead to tampering with firewall IP set data. The vulnerability affects multiple versions of Fireware OS and has been assigned a high severity rating.
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.
One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
A critical path traversal vulnerability (CWE-22) exists in intranda goobi-viewer-core versions 24.03 up to but not including 26.05. The flaw allows an attacker to manipulate filenames extracted from a Content-Disposition header to perform directory traversal or use absolute paths. This can lead to arbitrary file writes by the Tomcat process user, potentially enabling remote code execution. The issue is fixed in version 26.05.
A path traversal vulnerability (CWE-22) exists in the Entire CLI prior to version 0.7.7. This flaw allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata containing specially crafted SessionID values. These values can cause the CLI to write attacker-controlled data outside the intended session directory during session resume or checkpoint rewind operations. The vulnerability arises because the SessionID field is used without validation to construct filesystem paths. The issue has been fixed in version 0.7.7.
PraisonAI versions from 2.6.0 up to but not including 4.6.59 contain a path traversal vulnerability in the template loader. The vulnerability allows an attacker to supply crafted GitHub template URIs with malicious refs that escape the intended cache directory. This can lead to deletion of arbitrary directories outside the cache via shutil.rmtree, causing denial of service or data loss. The issue is fixed in version 4.6.59.
CVE-2026-92709 is a path traversal vulnerability in rsyslog's omfile dynaFile facility affecting versions from 1.15.0 up to 8.2610.0. The vulnerability arises when untrusted input influences the dynamic file path used for log output without proper secure-path handling, allowing the path to escape the intended log directory. This can lead to unauthorized file access or modification. No patches are publicly available at the time of disclosure.
Apache bRPC versions prior to 1.18.0 contain vulnerabilities allowing remote attackers to control file paths and cause resource exhaustion via builtin services. Attackers can create directories and overwrite files with server process privileges by manipulating the /flags service parameters. Additionally, the /pprof service allows unbounded profiling durations, causing denial of service by holding profiling resources indefinitely. These issues affect any bRPC server exposing builtin services to untrusted networks.
CVE-2026-92390 is a vulnerability in curl where the anti-clobbering protection for the --remote-header-name (-J) option can be bypassed. This occurs if a 103 Early Hints HTTP response precedes the final response or if an ETag header is processed before Content-Disposition under --etag-save. As a result, an attacker controlling an HTTP(S) server can cause curl to overwrite an existing local file despite the intended non-overwrite constraint.
CVE-2026-105037 is a critical vulnerability in EnergizeLab station-middleware (NestJS) Docker images versions 1.6.5 through 1.8.2. It allows any registered user with low privileges to read arbitrary files on the server by supplying a malicious file path. This flaw exposes sensitive middleware files and server secrets, potentially leading to full compromise of confidentiality, integrity, and availability.
CVE-2026-57155 is a critical path traversal vulnerability in the OPNsense core firewall and routing platform prior to version 26.1.11. It arises from improper validation of a CSV country_code value used in constructing output filenames during GeoIP alias imports. An attacker with Firewall Alias Edit privileges can exploit this to write arbitrary files as root, potentially leading to full firewall compromise via cron job execution. The issue is fixed in version 26.1.11.
Markdown Preview Enhanced for Visual Studio Code prior to version 0.8.30 contains a vulnerability where the _crossnote.updateMarkdown command accepts arbitrary URIs and attacker-controlled content, allowing file writes without proper validation. This can be exploited by JavaScript executing in the preview webview to write files accessible by the user's OS privileges. The vulnerability is fixed in version 0.8.30.
CVE-2026-92153 is a path traversal vulnerability in NASA's F Prime (fprime) framework prior to version 4.3.0. The vulnerability arises from improper handling of file upload destination paths in the Svc::FileUplink component, which does not canonicalize or restrict paths. This allows an attacker able to send file-uplink packets to create or overwrite files at arbitrary writable filesystem locations, impacting integrity and potentially availability. The issue is fixed in version 4.3.0.
CVE-2026-107594 is a critical vulnerability in the File Upload to Order WordPress plugin versions before 1.1.4. It allows unauthenticated attackers to delete arbitrary files on the server by exploiting improper validation of file paths derived from attacker-controlled session data. This flaw can lead to full site compromise due to the potential removal of critical files.
CVE-2026-110385 is a high-severity remote code execution vulnerability in ONLYOFFICE Document Server versions before 10.0.0. It allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary OS commands as the ds service account. The vulnerability arises from improper processing of user-controlled converter XML in the Document Builder API, enabling path override and arbitrary file write outside the job directory. This can lead to overwriting the runtime.json configuration file and modifying executable paths and arguments, resulting in command execution during subsequent Document Builder jobs.
CVE-2026-69783 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving external control of file name or path in Windows Update. This flaw allows an authorized local attacker to elevate privileges by manipulating file paths. The vulnerability affects multiple builds of Windows 11 23H2 prior to specific fixed versions. Microsoft has released official patches to address this issue.
CVE-2026-106042 is a critical vulnerability in Ivanti Xtraction before version 2026.4 involving external control of file name or path. It allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and capture EPMM connector credentials transmitted by the application.