MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided file_path to local file operations without restricting it to the workspace. A remote MCP caller with tool access can cause the server to read sensitive local files and upload them as Atlassian attachments. The advisory traces the vulnerable input and processing flow through streamable-http, upload_attachment, and file_path, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Confluence and Jira upload_attachment implementations accept an unconstrained file_path and open the referenced server-local file. A permitted MCP caller can upload sensitive host files to an Atlassian destination and then retrieve their contents. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_safe_path defaults its base directory to os.getcwd(), and affected Confluence attachment call sites omit base_dir, allowing attacker-selected writes within the working directory. This Python module overwrite can provide code execution when the application later imports the modified module, bypassing the remediation tracked as CVE-2026-27825. This issue is fixed in version 0.22.0.
CVE-2026-77270 is a path traversal vulnerability in sooperset mcp-atlassian prior to version 0.22.0. The vulnerability allows an MCP caller with upload access to disclose any file readable by the server process by exploiting improper validation of file_path inputs in Jira and Confluence attachment upload tools. This issue is fixed in version 0.22.0.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment in src/mcp_atlassian/confluence/attachments.py accepts a caller-controlled file_path and opens the selected server-local file without restricting it to the workspace. A permitted Confluence MCP caller can upload the file as an attachment and disclose data readable by the server process. This issue is fixed in version 0.22.0.
Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confining it to an intended directory. When an untrusted source supplies an event field used by the path template, the value can contain an absolute path or parent-directory traversal, causing Vector to create parent directories and create or overwrite files outside the intended location with the Vector process privileges. The resulting file write can modify sensitive files and can lead to code execution when a scheduled task, authorization file, or subsequently executed script is targeted. This issue is fixed in version 0.57.0.
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files are deleted. Exploitation requires two sequential REST API calls: first to /wp-json/ctxfeed/v1/make_feed/save_feed_config to persist the traversal payload in wp_options, then to /wp-json/ctxfeed/v1/manage_feeds/delete_feed to trigger the unlink(); deletion is further constrained to files whose extensions match the plugin's validated whitelist (csv, xml, tsv, xls, xlsx, json, txt).
The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVE-2026-93712 is a path traversal vulnerability in Dancer2 versions from 2.1.0 before 2.2.0 for Perl. The File route handler improperly serves files outside the configured public_dir by not collapsing relative path segments, allowing requests with path traversal sequences to access arbitrary readable files. This vulnerability is exploitable when the File handler is enabled and static_handler is disabled, potentially exposing sensitive files such as configuration files to unauthenticated users.
A path traversal vulnerability exists in roomi-fields notebooklm-mcp versions 1.6.0 through 2.0.2 in the POST /batch-to-vault endpoint and the batch_to_vault MCP tool starting from version 1.7.0. This flaw allows attacker-controlled inputs to cause files to be written outside the intended vault directory. Version 2.0.3 introduces sanitization and containment features to mitigate this issue. Users unable to upgrade should restrict server permissions and limit endpoint exposure.
Joplin Server versions prior to 3.7.7 with transcription enabled are vulnerable to a path traversal issue. Authenticated users can manipulate the transcription job ID to escape the intended directory path, causing the server to proxy requests to unintended backend endpoints. This may expose internal administrative, health, or configuration data. The vulnerability is fixed in version 3.7.7.
Joplin before versions 3.6.15 and 3.7.2 contains an improper input validation vulnerability where synchronized resource metadata fields can include directory traversal characters. This allows an attacker with write access to a sync target or shared notebook to write files outside the intended resource directory without user interaction. The issue is fixed in versions 3.6.15 and 3.7.2.
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can therefore address unintended routes on the internal export server, and the servlet forwards all request headers and the request body to that destination, allowing arbitrary header injection. Depending on the export service configuration, exploitation can expose administration, debugging, health, or configuration endpoints and can permit unintended internal actions. This issue is fixed in version 30.2.7.
CVE-2026-94185 is a path traversal vulnerability in nvm (Node Version Manager) versions up to 0.40.7. It allows an attacker to cause nvm to read arbitrary files outside its alias directory by using specially crafted alias names containing '..' path components. This leads to disclosure of the first non-comment line of arbitrary files readable by the user when running certain nvm commands. There is no impact on integrity, availability, or command execution.
Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_path to validate safe_extractall targets by comparing resolved path strings with startswith instead of comparing path components. A course author or staff user with course import permission can submit a crafted .tar.gz archive through the import_olx flow initiated by cms.djangoapps.contentstore.views.import_export.import_handler. An archive member can therefore escape into a sibling course staging directory whose name shares the attacker's base64 directory prefix, causing limited cross-tenant file corruption. Zip archives are not practically affected because ZipFile.extractall strips parent traversal segments, and the advisory does not establish arbitrary filesystem writes, file reads, or direct code execution. This issue is fixed in Ulmo and Verawood.1.
IBM Guardium Data Protection version 12.2 contains a path traversal vulnerability (CWE-22) that could allow a remote authenticated attacker to execute arbitrary code. The flaw arises from improper limitation of a pathname to a restricted directory, enabling unauthorized file access or manipulation. This vulnerability has a high severity rating with a CVSS score of 7.2.
IBM Guardium Data Protection version 12.2 contains a path traversal vulnerability (CWE-22) that could allow a remote authenticated attacker to traverse directories on the system. This vulnerability has a CVSS 3.1 score of 7.6, indicating high severity with low attack complexity but requiring authentication. The flaw could lead to limited confidentiality impact, high integrity impact, and low availability impact.
IBM Cloud Pak for Data version 5.1.2 contains a directory traversal vulnerability (CWE-22) that allows a remote attacker to access arbitrary files on the system by sending specially crafted URL requests with "dot dot" sequences (/../). This vulnerability has a high severity rating with a CVSS score of 7.5.