LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs. RenameFile constructed newFilePath with string replacement and moved the uploaded file without verifying the resolved absolute path remained under the web root or data directory. A crafted upload name could therefore move an uploaded file outside the intended storage directory, enabling unauthorized file placement or overwrite with the privileges of the application process. This issue is fixed in version 1.6.8.
CVE-2025-14753 is a path traversal vulnerability in IBM Cloud Pak for Data version 5.1.2. It allows a remote attacker to craft URL requests with directory traversal sequences (/../) to access arbitrary files on the system without authorization. This vulnerability has a high severity rating with a CVSS score of 7.5.
HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized file modification within the application's directory scope.
The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. A valid nonce is obtainable by unauthenticated users via the companion nbd_check_use_logged_in nopriv AJAX endpoint, which freely mints and returns a nbdesigner-get-data nonce to any visitor; additionally, if the NBDESIGNER_ENABLE_NONCE constant is disabled, even this nonce gate is bypassed entirely.
CVE-2026-70200 is a critical path traversal vulnerability in Microsoft Azure Logic Apps that allows unauthorized attackers to elevate privileges over a network. The flaw involves improper limitation of a pathname to a restricted directory, enabling attackers to access unauthorized resources. This vulnerability has a CVSS score of 10.0, indicating its critical severity. Microsoft has issued an official fix for this vulnerability. As Azure Logic Apps is a cloud service, Microsoft manages the remediation on their side.
CVE-2026-70009 is a critical path traversal vulnerability in Microsoft Azure ARC that allows unauthorized attackers to elevate privileges over a network by improperly limiting pathname access to restricted directories. The vulnerability has a high CVSS score of 9.3 and has been officially fixed by Microsoft. Azure ARC is a cloud service, and Microsoft manages remediation for this vulnerability server-side.
CVE-2026-54520 is a path traversal vulnerability in vmDeshpande ai-agent-automation prior to version 0.9.1. The vulnerability arises because the executeStep file-step implementation uses a user-controlled path value without properly restricting it to an approved directory. This allows an authenticated user with permission to create or modify workflow file steps to escape the intended workspace and read or overwrite files accessible to the backend process. The issue is fixed in version 0.9.1.
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical directory containment. An unauthenticated remote attacker can invoke getContribuicoesLogJSON, sincronizarStatus, registrarFaturas, and other sensitive methods to disclose contribution and donation records or trigger financial workflow operations. A traversal-shaped nomeClasse value can also cause require_once to include an accessible PHP or configuration file outside the intended controller directory, exposing source code, credentials, or other sensitive local data. This issue is fixed in version 3.8.5.
CVE-2026-54612 is a path traversal vulnerability in givanz Vvveb CMS versions from 1.0.0 up to but not including 1.0.8.5. An authenticated user with Editor role permissions can exploit this flaw to write arbitrary PHP files outside the intended theme directory. This can lead to persistent webshell placement and full compromise of the application’s confidentiality, integrity, and availability. The vulnerability is fixed in version 1.0.8.5.
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root. A valid admin session and CSRF token are required, the read is limited to .html files in backup directories, and deletion additionally requires filesystem write permission. This can disclose sensitive exported site content or remove backup data. This issue is fixed in version 1.0.8.5.
CVE-2026-53554 is a path traversal vulnerability in dataease SQLBot versions prior to 1.9.0. The issue occurs in the POST /api/v1/datasource/parseExcel endpoint, which improperly uses attacker-controlled multipart filename data to determine where uploaded files are stored. This allows an attacker to place malicious files in the Alembic migration directory, which are then executed during SQLBot startup or migration processing. The vulnerability is fixed in version 1.9.0.
CVE-2026-54343 is a path traversal vulnerability in Frappe Learning Management System (LMS) versions prior to 2.52.1. The vulnerability exists in the SCORMRenderer.render function, which constructs and opens server-side file paths without verifying that the resolved path is confined within the intended public/scorm directory. This flaw allows a remote attacker to read arbitrary files accessible to the server process outside the SCORM directory. The issue is fixed in version 2.52.1.
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
extracting plugin archives. A crafted plugin archive can chain relative symbolic link
entries to escape the plugin installation directory, writing arbitrary files and an
executable backend binary outside that directory. The dropped executable runs with the
privileges of the Grafana server process, resulting in remote code execution.
Plugin archives are extracted before their signature is verified, so a valid plugin
signature does not prevent the write. An operator can therefore be affected by
installing a plugin that appears legitimate, as well as by installing a plugin from an
arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or
preinstall configuration.
Grafana Enterprise is affected because it includes the same plugin extraction code as
Grafana OSS.
Chamilo LMS versions prior to 2.0.1 contain a critical path traversal vulnerability (CWE-22) that allows unauthenticated remote attackers to execute arbitrary code on the server. The vulnerability is fixed in version 2.0.1. The advisory does not specify the affected endpoint or exploitation details. The CVSS score is 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability.
CVE-2026-45723 is an improper input validation vulnerability in siderolabs omni prior to versions 1.6.6 and 1.7.3. An authenticated Operator can manipulate the TalosVersion field to cause the application to issue HTTP GET requests to unintended paths on the configured image-factory host. This can lead to same-host endpoint probing and possible disclosure of internal diagnostic information. The vulnerability does not allow redirection to other hosts or write operations. The issue is fixed in versions 1.6.6 and 1.7.3.
CVE-2026-54617 is a critical path traversal vulnerability in GravitLauncher, an open-source Minecraft launcher. Versions prior to 5.7.12 allow unauthenticated remote attackers to send specially crafted HTTP requests without a leading slash to the LaunchServer file server on port 9274. This flaw enables reading arbitrary files accessible to the LaunchServer process, including sensitive signing keys and credentials. Exploitation can lead to forged administrative tokens and full authentication bypass. The issue is fixed in version 5.7.12.
CVE-2026-55062 is a path traversal vulnerability in the uniget-org CLI tool prior to version 0.27.6. The vulnerability arises from the hooks edit command concatenating an unvalidated hook filename with the hooks directory path, allowing directory traversal outside the intended directory. This can lead to unauthorized file access or modification with the privileges of the uniget process. The issue is fixed in version 0.27.6.
Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user's vault and into other users' vaults, including overwriting existing files. Disguised SVG content can be placed in another user's vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.
mport is the MidnightBSD Package Manager. Prior to 2.7.8, create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport->root. A malicious or malformed package manifest could therefore direct privileged sample-file handling to copy or write outside the configured installation root, compromising local filesystem integrity. This issue is fixed in version 2.7.8.