Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 (appliance) and 5.36.00.00 (application) contain a Relative Path Traversal vulnerability (CWE-23). This flaw allows a low privileged attacker with remote access to potentially execute remote code. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity.
Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 for the appliance and prior to 5.36.00.00 for the application contain a relative path traversal vulnerability. This flaw allows an unauthenticated remote attacker to potentially execute code remotely by exploiting the path traversal issue. The vulnerability is rated high severity with a CVSS score of 7.4.
CVE-2026-78254 is a high-severity vulnerability in Apache Ant's ftp and scp tasks that allows a malicious server to perform relative path traversal. This enables writing files outside the intended download directory, potentially overwriting arbitrary files with the permissions of the user running Ant. The vulnerability affects Apache Ant versions from 1.2 up to but not including 1.10.18. Exploitation requires either a malicious server or a man-in-the-middle attack, with additional server identity checks required for scp and ftps. Apache Ant 1.10.18 includes a fix that prevents writing outside the destination directory by default. Users are advised to upgrade to this version and follow recommended mitigations regarding server identity checks and use of ftps.
Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An unauthenticated remote attacker able to access the Self-orchestrator API could therefore supply specially crafted identifiers containing path traversal sequences to write or delete JSON files outside the intended application directories, subject to the filesystem permissions of the Self-orchestrator process.
The impact is increased by the absence of authentication on the affected API and by the container running with elevated privileges in the affected deployment configuration.
The issue has been addressed in version 1.2.1 by introducing validation and sanitization of user-controlled identifiers before they are used to construct filesystem paths, preventing path separator characters from being used to escape the intended directories.
A relative path traversal vulnerability exists in amazon-ssm-agent versions before 3.3.4515.0 in the aws:downloadContent plugin. An authenticated remote user with restricted ssm:SendCommand permission to the AWS-DownloadContent document can write arbitrary files outside the intended directory with root privileges by using crafted S3 object keys. This can lead to arbitrary code execution as root if sensitive files are overwritten. The issue is fixed in version 3.3.4515.0.
CVE-2026-81838 is a relative path traversal vulnerability in the zip extraction functionality of AWS diagram-as-code (awsdac) versions 0.10 through 0.23. This flaw allows an attacker to write arbitrary files to the local filesystem by crafting zip entries with path traversal sequences. The issue can lead to unauthorized file writes within the diagram bundle context. AWS has released version 0.24 and later to remediate this vulnerability.
CVE-2026-66907 is a relative path traversal vulnerability in the Apache Camel Google Storage component. It affects versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The vulnerability arises because the component downloads Google Cloud Storage objects to the local filesystem without properly normalizing or restricting the destination path, allowing crafted object names containing parent-directory segments to escape the intended download directory. This can lead to arbitrary file creation or overwriting with the privileges of the Camel process. A fix is available in Apache Camel versions 4.14.9, 4.18.4, and 4.22.0.
CVE-2026-66906 is a critical relative path traversal vulnerability in the Apache Camel Azure Storage Blob component. It allows an attacker who can influence blob names in an Azure Storage container to cause Camel to write files outside the intended directory on the local filesystem. This occurs because the component does not normalize or restrict blob names containing parent-directory segments when downloading blobs to files. The vulnerability affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Fixed versions are available, and users are advised to upgrade to these fixed releases. Alternative mitigations include filtering blob names with regex or avoiding the vulnerable operation on untrusted containers.
A relative path traversal vulnerability exists in the Apache Camel Azure-Storage Datalake component's downloadToFile operation. This flaw allows an attacker who can influence file names in the consumed Azure Data Lake filesystem to cause Camel to write files outside the intended directory, potentially overwriting arbitrary files with the privileges of the Camel process. The issue affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Upgrading to Apache Camel 4.22.0 or the respective patch releases 4.14.9 or 4.18.4 mitigates this vulnerability.
CVE-2026-66897 is a critical path traversal vulnerability in Canonical's LXD container management software. It allows an attacker with container edit permissions or a user launching a crafted image to overwrite arbitrary files on the host system as root. The flaw arises from a mismatch between path validation and file creation during instance template processing, enabling escape from directory confinement and host root code execution.
CVE-2026-78212 is a high-severity vulnerability in 4MOSAn Management Center by 4MOSAn Security Technology. It allows unauthenticated remote attackers to exploit a relative path traversal flaw to read arbitrary system files. This vulnerability does not require user interaction or privileges and impacts confidentiality without affecting integrity or availability.
LeafWiki versions 0.3.0 through 0.10.0 contain a relative path traversal vulnerability in the asset rename functionality. An authenticated user with editor permissions can exploit this flaw to move files accessible to the LeafWiki server into a page's asset directory, potentially exposing sensitive local files such as the application database. Version 0.10.1 and later address this issue. Operators should run LeafWiki with least privilege and restrict editor access until patched.
CVE-2026-77113 is a medium severity vulnerability in Canonical Apport affecting versions prior to 2.36.0, 2.34.2, and 2.28.4. It involves a relative path traversal flaw in the apport-unpack component on Linux systems. This flaw allows an attacker to create or overwrite arbitrary files with the privileges of the executing user by manipulating key names in crash report files.
CVE-2026-63509 is a critical vulnerability in Microsoft Fabric involving a relative path traversal flaw. This vulnerability allows an authorized attacker to elevate privileges over a network. The flaw has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. An official fix is available from Microsoft.
CVE-2026-63043 is a Relative Path Traversal vulnerability in Apache InLong that allows arbitrary file read from the Agent host filesystem. It affects versions from 2.0.0 up to but not including 2.4.0. The vulnerability has a high severity with a CVSS score of 7.5. Users are advised to upgrade to version 2.4.0 or apply the relevant patch to remediate the issue.
A path traversal vulnerability exists in handlebars.java versions prior to 4.5.3. The issue arises from improper validation of attacker-controlled Spring MVC view names in the SpringTemplateLoader component, allowing remote unauthenticated attackers to read arbitrary files accessible to the JVM. This vulnerability is fixed in version 4.5.3.
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.
Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.
The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the item_meta[field_id][content] parameter alongside the delete_saved_image flag during the standard entry-creation POST flow on any form that accepts anonymous submissions.