Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user's vault and into other users' vaults, including overwriting existing files. Disguised SVG content can be placed in another user's vault and execute stored cross-site scripting when the victim opens that vault. This issue is fixed in version 0.16.0.
mport is the MidnightBSD Package Manager. Prior to 2.7.8, create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport->root. A malicious or malformed package manifest could therefore direct privileged sample-file handling to copy or write outside the configured installation root, compromising local filesystem integrity. This issue is fixed in version 2.7.8.
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry->bundlefile, and the missing is_valid_bundle_filename() checks allowed downloaded package data to be written outside the intended cache location or to an unsafe destination name. This issue is fixed in version 2.7.8.
pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_long, which permutes arguments, a value beginning with a dash was interpreted as an option rather than as a database name. A value such as --file=/absolute/path therefore overrode the storage-confined --file that pgAdmin had constructed earlier, causing pg_dump to write its output anywhere the pgAdmin process could write, outside the user's File Manager storage directory. This yields arbitrary file creation and overwrite as the operating-system account running pgAdmin, which can destroy pgAdmin's own configuration database and, depending on the target chosen, be escalated further.
The same field additionally permitted connection-string injection. libpq expands a database name containing an equals sign into a full connection string, and keywords embedded there override the --host and --port that pgAdmin passes, so a value such as 'host=attacker.example port=5432 dbname=x' redirected pg_dump to a server of the attacker's choosing. Because pgAdmin exports the decrypted stored database password in the PGPASSWORD environment variable before executing the utility, the redirected connection carries that credential to the attacker-nominated endpoint. Both behaviours are reachable by any authenticated user holding the tools_backup permission, which is granted to the default User role.
The fix stops passing the database name through the argument vector altogether and supplies it in the PGDATABASE environment variable, which libpq treats as a literal database name and never expands as a connection string. This matches the approach already used by the Import/Export tool. Regression tests assert that the database name is absent from the constructed argument vector and that PGDATABASE carries the exact requested value.
This issue affects pgAdmin 4: from the introduction of the trailing positional database argument in the Backup tool before 9.18.
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
CVE-2026-89084 is a high-severity vulnerability in HP Inc's HP AC Print & Scan software, specifically in the HP Advance software component. It involves a CWE-22 (Path Traversal) flaw that could allow an attacker to elevate privileges, execute remote code, or write arbitrary files on the HP Advance server under certain conditions. The vulnerability has a CVSS 4.0 base score of 8.8, indicating a significant risk if exploited. No affected versions or patch information are provided, and there are no known exploits in the wild at this time.
Apache NiFi Registry versions 0.4.0 through 2.11.0 have a path traversal vulnerability (CWE-22) in the handling of extension bundle content. Authenticated users authorized to write and delete bundles can upload crafted manifests that cause file operations outside the intended storage directory. This is due to insufficient validation of path components derived from group, artifact, and version coordinates. The vulnerability is fixed in version 2.12.0 by rejecting parent-directory coordinates and enforcing normalized paths within the storage root.
### Impact
An OpenAPI or AsyncAPI description could make the `split` command write
files outside the chosen output directory, on the machine of anyone who runs
`split` against it. The write is constrained rather than a free file-write
primitive: component data is emitted only as YAML/JSON, and code-sample files are
named after the HTTP method, so an attacker can place or overwrite files at an
unintended path but has limited control over their name and contents.
### Patches
Fixed in `@redocly/cli` v2.33.2.
### Workarounds
Do not run the `split` command on API descriptions from untrusted or unreviewed sources.
To detect an exploit attempt, inspect the description's component names and
`x-codeSamples` `lang` values for a literal `../` — neither legitimately contains
path segments.
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating member paths, and the vulnerable extraction path is reachable through stanza.download and stanza.install_corenlp. A malicious archive containing parent-directory traversal entries can write outside the intended model directory, allowing files writable by the Stanza process to be overwritten and potentially enabling code execution through modified shell configuration, SSH authorization data, Python packages, or executable scripts. This issue is fixed in version 1.14.0.
Red Hat issued a security advisory for Red Hat Edge Manager version 1.2.1 addressing multiple high severity vulnerabilities including CVE-2026-6377. Red Hat Edge Manager is a solution for managing edge devices and container workloads with a focus on scalable and secure lifecycle management. The advisory does not provide specific details on the fixes or patches. No known exploits in the wild have been reported. The product supports large-scale edge deployments and integrates with other Red Hat platforms for enhanced management capabilities.
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution.
CVE-2026-76555 is a path traversal vulnerability in the WP Import Export Lite WordPress plugin versions before 3.9.33. It allows users with import permissions granted by an administrator to read and disclose sensitive files from the server, including those outside the web root. Additionally, the vulnerability causes the plugin to relax file-system permissions on any given path, regardless of whether the file copy operation succeeds.
`@zereight/mcp-gitlab` versions prior to 2.1.27 have a critical path traversal vulnerability in the SSE transport mode that allows unauthenticated attackers to read arbitrary files on the server. This can lead to theft of sensitive tokens and full GitLab account takeover. Version 2.1.27 includes a patch for this issue.
Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root.
Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - `J2StoreModelOrderdownloads::getFilePath()` built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's stored `product_file_save_name`, using only `JPath::clean()` (which normalises separators but does not resolve or reject `..` segments) and a plain `JFile::exists()` check — never confirming the resolved path stayed inside the configured attachment folder. If a product file's `product_file_save_name` ever contained a `../` traversal segment — most plausibly via the CSRF-forgeable admin product-file save actions described in Issue 1, but equally by any future integration or bug that writes that field — any customer holding a valid download `token`/`pid` pair for that product file could have the traversal resolve to a path outside the attachment folder and download any file readable by the web server (e.g. `configuration.php`).
CVE-2026-57442 is a path traversal vulnerability in bitbonsai mcpvault versions prior to 0.11.5. The issue arises because the PathFilter component uses root-anchored deny-list patterns that fail to restrict nested .git, .obsidian, and node_modules directories properly. This allows an attacker influencing AI-selected paths to access restricted metadata and files. The vulnerability is fixed in version 0.11.5.
MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller-controlled filePath directly to fs.readFileSync without restricting the path to an export directory. An MCP client, including an LLM agent induced to call the tool, can use ../ traversal or an absolute path to target any file readable by the server process. A valid JSON file is parsed and imported into the caller's session, allowing its full contents to be retrieved through context_get or context_export, while JSON.parse errors for non-JSON files can return leading file bytes in a SyntaxError message. The two disclosure modes can expose other exported sessions, JSON credentials or service-account files, environment files, and portions of SSH keys or other local files. This issue is fixed in version 0.13.0.
CVE-2026-47215 is a path traversal vulnerability in Sylabs Singularity container platforms. It affects SingularityCE versions prior to 4.4.2 and SingularityPRO versions prior to 4.3.9 and 4.1.14. The flaw arises from incorrect path-string matching in the limit container paths directive of singularity.conf, allowing containers located in sibling directories outside the configured allowlist to be run under setuid mode. Installations not using the limit container paths feature are not affected. This issue has been fixed in the specified versions.