CVE-2026-78275 is a path traversal vulnerability in WP Manage Ninja Fluent Boards Pro affecting versions up to and including 2.0.11. It allows an editor-level user to arbitrarily delete files due to improper limitation of pathnames to restricted directories. The vulnerability has a CVSS score of 6.8, indicating medium severity, with a significant impact on availability but no direct confidentiality or integrity impact reported. No official patch or remediation guidance is currently available.
CVE-2026-47884 is a critical path traversal vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It arises from improper limitation of pathnames in the XsltView component of Spring MVC. Applications with a /** mapping that triggers view rendering without an explicitly specified view name are vulnerable. This flaw can lead to server-side request forgery (SSRF) and remote code execution (RCE). The vulnerability has a CVSS score of 9.8, indicating critical severity. No official patch or remediation guidance is currently available.
CVE-2026-47894 is a path traversal vulnerability in Spring Cloud Config Server's native environment repository that allows exposure of configuration files outside the intended repository path. It affects multiple versions of Spring Cloud Config, including 3.1.14 and earlier, 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.4. The vulnerability has a medium severity with a CVSS score of 4.9 and does not have an official patch or remediation guidance published yet.
CVE-2026-47862 is a path traversal vulnerability in Spring Integration affecting certain versions. An attacker who can control the file_name header on a message processed by the ZipTransformer component with the default ZipResultType.FILE can cause a .zip archive to be written outside the intended working directory. This could lead to unauthorized file writes on the filesystem. The vulnerability affects specific versions of Spring Integration including 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and exactly version 7.1.0. The CVSS score is 5.4, indicating a medium severity impact. No official patch or remediation information is currently available.
CVE-2026-61792 is a path traversal vulnerability in Weblate prior to version 2026.7. It allows a project administrator to read files outside their repository via the App store metadata download feature due to insufficient path restriction. This vulnerability is an incomplete fix of a previous issue (CVE-2026-34242) and permits disclosure of arbitrary files on the Weblate host. The issue is resolved in version 2026.7.
Winter CMS versions up to and including 1.2.12 contain a path traversal vulnerability in the LESS compilation process. Authenticated backend users with certain permissions can inject @import directives into LESS source, allowing them to read arbitrary files accessible to the PHP process, including sensitive configuration files. The issue arises because the LESS parser does not enforce safe import path restrictions. This vulnerability is fixed in version 1.2.13.
Formidable Charts plugin for WordPress up to version 2.0.1 is vulnerable to a directory traversal flaw via the 'frm_graph' parameter. This vulnerability allows unauthenticated attackers to read arbitrary files on the server if certain conditions are met, including having Formidable Forms Lite, Pro, and Charts active and the existence of the wp-content/uploads/frm-charts/ directory. The vulnerability has a high severity rating with a CVSS score of 7.5.
A path traversal vulnerability exists in the Directorist WordPress plugin before version 8.9.3. It allows subscriber-level users to move arbitrary server-readable image files into a publicly accessible directory and delete them from their original location due to improper sanitization of user-supplied image references.
CVE-2026-75797 is a path traversal vulnerability in the AI Engine WordPress plugin before version 3.7.2. It allows users with subscriber-level accounts to read arbitrary files on the server if a non-default public API feature is enabled. Without this feature, administrators (including non-super administrators on multisite setups) can exploit the issue to access network-shared configuration files and secrets.
Compliance-trestle versions before 3.12.4 and from 4.0.0 through 4.0.3 contain a path traversal vulnerability in certain author commands that write generated Markdown files. This flaw allows an attacker to write files outside the intended workspace by supplying a crafted output path. Using the --force-overwrite option can lead to recursive deletion of attacker-chosen directories, potentially enabling indirect code execution. The issue is fixed in versions 3.12.4 and 4.1.0.
Velero versions prior to 1.18.1 contain a path traversal vulnerability (CWE-22) that allows an attacker who controls the backup object-storage backend to upload a malicious backup tarball. This tarball can include parent-directory paths that escape the intended extraction directory during restore, potentially overwriting sensitive files in the Velero pod filesystem. The issue is fixed in Velero version 1.18.1.
CVE-2026-65092 is a path traversal vulnerability in NVIDIA OpenShell Sandbox for Linux. It allows an attacker with limited privileges to bypass L7 REST network policy restrictions by manipulating pathnames. Successful exploitation can lead to information disclosure and data tampering. The vulnerability has a high severity score of 8.5 and does not currently have an official patch or remediation guidance from the vendor.
CVE-2026-55557 is a path traversal vulnerability in That1Drifter's browse-mcp server prior to version 0.8.2. The flaw allows an attacker to write arbitrary files to the host filesystem by controlling the save directory and file contents. This can lead to overwriting critical files such as ~/.bashrc, autostart entries, or cron files, potentially enabling code execution on the host. The vulnerability arises from insufficient validation of caller-controlled paths and a fetch fallback that bypasses origin restrictions. The issue is fixed in version 0.8.2.
The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker‑supplied uiconf_id without proper path validation. An attacker can write arbitrary files into web‑accessible locations and achieve code execution as the webserver user. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.
CVE-2026-55527 is a path traversal vulnerability in MervinPraison PraisonAI affecting versions prior to 1.6.58. The issue arises because the FileMemory constructor joins an unsanitized user_id into a file path, allowing an attacker to escape the intended directory and write JSON data to arbitrary writable locations. This vulnerability is fixed in version 1.6.58.
CVE-2026-55540 is a path traversal vulnerability in MervinPraison PraisonAI prior to version 4.6.58. The issue arises because the function is_path_within_directory() uses os.path.abspath() instead of os.path.realpath() to enforce workspace boundaries. This allows a symbolic link inside the workspace to point outside the workspace and bypass the directory restriction, enabling unauthorized access to files outside the intended directory. The vulnerability is fixed in version 4.6.58.
CVE-2026-77139 is a path traversal vulnerability in the TYPO3 extension "Mask" that allows an authenticated backend user with access to the Mask module to create or delete .html files outside the intended template directory by supplying crafted template element keys. This occurs because the extension does not properly validate client-supplied keys before using them to build file paths. The vulnerability affects certain versions of the Mask extension prior to 9.0.11 and 8.3.12. The CVSS 4.0 score is 6.0, indicating a medium severity.
CVE-2026-78284 is a high-severity vulnerability in Stylemix MasterStudy LMS versions up to and including 3.7.42. It involves an unauthenticated arbitrary file deletion due to improper limitation of a pathname to a restricted directory (path traversal). This flaw allows attackers without any privileges to delete files on the affected system, potentially causing denial of service or disruption of LMS functionality.
CVE-2026-32477 is a high-severity vulnerability in ShopBuilder Pro – Elementor WooCommerce Builder Addons versions up to 2.2.0. It allows unauthenticated attackers to perform arbitrary file deletion via a path traversal flaw (CWE-22). This vulnerability can cause denial of service or data loss by deleting critical files. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-28171 is a high-severity vulnerability in the vanquish WooCommerce File Approval plugin versions up to and including 10.7. It allows unauthenticated attackers to delete arbitrary files due to improper limitation of pathname to a restricted directory (path traversal). This vulnerability does not impact confidentiality or integrity but results in a high impact on availability. No official patch or remediation guidance is currently provided by the vendor.