The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form.
A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the application's intended file system scope. Successful exploitation would require knowledge of valid file names and paths.
Depending on the privileges of the affected component, exploitation could result in the disclosure of sensitive information, including configuration files, environment settings, application assets, and log data.
The vulnerability has been remediated through enhanced path validation and secure path resolution controls that prevent access to unauthorised locations.
CVE-2026-82393 is a path traversal vulnerability in pnpm package manager versions prior to 10.34.5 and between 11.0.0 and before 11.11.0. It allows an attacker to craft a tarball dependency with a malicious package.json name containing scoped path traversal sequences. This leads to arbitrary file overwrites outside the node_modules directory during package installation, potentially replacing critical files such as shell startup scripts, Git hooks, or package code, which can result in code execution. The vulnerability is fixed in pnpm versions 10.34.5 and 11.11.0.
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Kirby\Filesystem\Dir::realpath() and Kirby\Filesystem\F::realpath(). The checks accepted a sibling directory whose path shared the intended root's string prefix, such as /var/www/site2 next to /var/www/site, because they did not require an exact match or a DIRECTORY_SEPARATOR boundary. A remote attacker could use Kirby\Cms\Media::thumb() to create and access thumbnails from image files in a PHP-readable sibling directory when that directory contained a valid .json thumbnail job file, potentially exposing staging sites, backups, or other internal sites and deleting the job file during processing. This issue is fixed in versions 4.9.5 and 5.5.2.
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filter only applies to post-extraction logo copy step. This issue has been patched in version 4.9.6.
Goploy versions prior to 1.18.0 contain a path traversal vulnerability in the backend API endpoint /deploy/fileDiff. This flaw allows an attacker with limited privileges to manipulate file paths, potentially exposing sensitive files. The vulnerability has been fixed in version 1.18.0.
CVE-2026-79743 is a path traversal vulnerability in samanhappy mcphub prior to version 0.12.13. The MCPB File Upload Handler extracts a ZIP file and reads a manifest.json file, where the name field is concatenated into a file path without sanitization. This allows an attacker to craft a malicious file that can be extracted to arbitrary locations on the file system. Additionally, the unsanitized name is used in a cleanup function that may delete arbitrary directories. The issue has been patched in version 0.12.13.
Eclipse Theia versions 1.73.0 up to but not including 1.75.0 contain a path traversal vulnerability in the AI Agent Mode file-change tools. This flaw allows crafted file paths to write or delete files outside the workspace without proper containment checks. Exploitation can lead to arbitrary file modification with the privileges of the Theia backend OS user, potentially enabling code execution on the host system.
Apache Wicket versions up to 8.18.0, 9.23.0, and 10.10.0 contain a path traversal vulnerability due to improper validation of resource URL attributes. This flaw allows unauthenticated remote attackers to read certain files from the web application, including some under WEB-INF that are normally protected. The vulnerability arises because attacker-controlled path components are appended after initial security checks, enabling crafted requests to escape intended directory restrictions. The default resource guard limits accessible file types, but custom configurations may expose sensitive configuration files. Fixed versions are 8.19.0, 9.24.0, and 10.11.0.
CVE-2026-82673 is a path traversal vulnerability in ash-project's ash_admin component that allows an attacker to write files to arbitrary paths on the server. The vulnerability arises because the filename supplied by the browser is not sanitized before being joined with a temporary directory path, enabling directory traversal. This can lead to arbitrary file writes and potentially remote code execution by overwriting critical application or system files. The issue affects versions from 0.13.7 up to but not including 1.3.1. The vulnerability has a high severity score of 8.3 CVSS 4.0.
Pake versions before 3.13.1 contain a path traversal vulnerability in the download_file Tauri command. The vulnerability allows an attacker to specify filenames with path traversal sequences or absolute paths, causing files to be written outside the intended Downloads directory. This can lead to overwriting user-writable files and installing persistence mechanisms such as macOS LaunchAgents, Linux autostart entries, or Windows Startup entries, resulting in code execution within the user account.
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a path traversal vulnerability that allows remote attackers to read arbitrary files. This vulnerability is identified as CWE-22 and has a high severity with a CVSS score of 7.5. No official patch or remediation has been confirmed at this time.
CVE-2026-55569 is a path traversal vulnerability in the aqua command-line version manager prior to version 2.60.1. The vulnerability arises because the software does not verify that symbolic link targets remain within the intended extraction directory during archive unpacking. This allows a malicious archive to write files outside the extraction directory with the privileges of the user running aqua, potentially overwriting important files such as shell startup scripts or executable paths. The issue is fixed in version 2.60.1.
CVE-2026-59294 is a path traversal vulnerability in Spring AI affecting versions 1.0.9 and earlier, 1.1.0 through 1.1.8, and 2.0.0. The vulnerability arises because ResourceCacheService.getCacheName() constructs file paths by appending URI fragments without sanitizing path separators or '..' sequences, allowing potentially unauthorized file writes. The CVSS 3.1 score is 5.9 (medium severity). No official patch or remediation guidance is currently available.
CVE-2026-54732 is a path traversal vulnerability in the Node.js module libreoffice-convert prior to version 1.8.2. The module improperly handles the caller-controlled fileName parameter by using it directly in path.join without normalizing it to a base name. This allows an attacker to escape the intended temporary directory and write files to arbitrary locations writable by the process, potentially overwriting sensitive files such as SSH authorized_keys, cron configurations, or web root files. The issue is fixed in version 1.8.2.
A path traversal vulnerability (CWE-22) exists in Spring Framework's FreeMarker integration when a controller returns a view name derived from untrusted input and FreeMarker resolves templates via SpringTemplateLoader. This affects multiple Spring Framework versions from 5.2.25.RELEASE and earlier up to 7.0.8. The vulnerability allows an attacker with low privileges to read files outside the intended directory. The CVSS score is 4.3 (medium severity). No known exploits are reported in the wild, and no official patch information is provided in the input data.
CVE-2026-54687 is a path traversal vulnerability in the DangerBlack n8n-node-sqlite3 node prior to version 1.0.0. The vulnerability arises because the db_path parameter, which specifies the SQLite database file path, can be controlled by untrusted workflow input. This allows an attacker to cause the n8n process to open arbitrary files outside the intended database directory, potentially leading to unauthorized reading, creation, or overwriting of files accessible to the process. The issue is fixed in version 1.0.0.
CVE-2026-79653 is a path traversal vulnerability in Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, and 20.1.0 when configured to use file system storage via the enable.attachment.store.to.file.system setting. An attacker can manipulate uploaded filenames to traverse directories arbitrarily. The vulnerability can be mitigated by disabling this configuration or updating to fixed versions.