CVE-2026-59976 is a path traversal vulnerability in C4illin ConvertX, a self-hosted file conversion service. Versions prior to 0.18.0 use an unsanitized convert_to parameter in the ImageMagick converter, allowing directory traversal sequences to escape the intended output directory. This can enable authenticated users, or unauthenticated users if access is allowed, to write converted files to arbitrary paths, potentially overwriting files or causing denial of service. The issue is fixed in version 0.18.0.
CVE-2026-93695 is a vulnerability in Progress ShareFile Storage Zones Controller version 5.12.6 and earlier. The FileCopyService component improperly constructs local temporary file paths using remote file identifiers without proper containment enforcement. This flaw allows an attacker to write arbitrary content to filesystem locations writable by the service account, potentially leading to remote code execution if the writable location is served by IIS and executable.
CVE-2026-87685 is an arbitrary file manipulation vulnerability in the WebTools management interface of Brocade Fabric OS. It affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. An authenticated administrative user can exploit this by submitting a crafted status file path parameter, causing arbitrary system files to be moved to a world-readable temporary directory. This can result in persistent denial of service, critical system file destruction, host compromise, or sensitive data leakage.
CVE-2026-106109 is a path traversal vulnerability in the Quasar Framework's @quasar/app-vite build tool. Versions from 1.0.0 up to but not including 3.3.0 recursively remove the resolved build.distDir directory before building without properly restricting critical directories such as the project root, user home, filesystem roots, or symlink-resolved external directories. This can lead to unintended deletion of data writable by the build user if an unsafe trusted configuration is used. Exploitation requires either compromised or less-trusted automation influencing the build configuration or a developer running a mistaken configuration. The vulnerability is fixed in version 3.3.0.
CVE-2026-106103 is a path traversal vulnerability in the Quasar Framework's icongenie tool prior to version 6.1.1. The vulnerability allows a developer running a crafted profile to write or overwrite files outside the intended project directory, potentially modifying critical executable configuration files. This issue is fixed in version 6.1.1.
## Impact
Under certain conditions, an authenticated user with permission to modify uploads could cause unintended files to be removed during file cleanup. This may result in data loss or service disruption.
You are affected if:
- You use Payload upload collections with local file storage.
- Untrusted authenticated users can update or delete uploads.
Deployments that restrict upload management to trusted users are less exposed.
## Patches
Payload now validates uploaded filenames and ensures file cleanup remains within the configured upload directory.
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
## Workarounds
Restrict upload update and deletion operations to trusted users and validate submitted filenames. These measures are temporary mitigations. Upgrading to a patched version is recommended.
### Summary
docling accepts serialized `DoclingDocument` JSON as an input format (`InputFormat.JSON_DOCLING`, enabled by default). A crafted JSON file can set a picture's image `uri` to a local file path. When the converted document is exported with embedded images (`ImageRefMode.EMBEDDED`, the CLI default for Markdown and HTML), the referenced file is read and embedded as base64 in the output.
### Details
`docling/backend/json/docling_json_backend.py` validates the JSON into a `DoclingDocument` without checking image references. The file is then read by docling-core:
- `DoclingDocument._with_embedded_pictures` opens `file://` and plain-path URIs with PIL.
- `ImageRef.pil_image` checks `allow_image_file_uri` for `file://` URIs but not for plain `Path` values. docling's picture enrichment models load images through this property.
Only files that PIL can decode as an image are disclosed. Other files, such as text files or keys, fail to decode and are not embedded. The different error behaviour does reveal whether a path exists.
### Impact
Disclosure of image files readable by the converting process (for example other users' uploads or page images in a shared service), and disclosure of whether a local path exists.
### Proof of concept
```python
from pathlib import Path
from docling_core.types.doc import DoclingDocument, ImageRef
from docling_core.types.doc.base import Size
doc = DoclingDocument(name="poc")
doc.add_picture(image=ImageRef(mimetype="image/png", dpi=72, size=Size(width=1, height=1),
uri=Path("/srv/uploads/other-user/scan.png")))
doc.save_as_json("poc.json")
```
`docling poc.json --to md` embeds the referenced PNG as base64 in `poc.md`.
### Patches
Fixed in docling 2.131.0 by [#4417](https://github.com/docling-project/docling/pull/4417). The Docling JSON backend now drops image references that point at local files (paths, `file:` URIs and any scheme other than `data:` and `http(s)`) and logs a warning. Callers that need to load local images from JSON they trust can opt in with `DoclingJSONFormatOption(backend_options=DeclarativeBackendOptions(enable_local_fetch=True))`; the CLI has no such option.
Code that loads untrusted JSON directly with docling-core (`DoclingDocument.load_from_json`) and exports it with embedded images is not covered by this fix; that part is tracked in docling-core.
### Workarounds
Upgrade to 2.131.0. For older versions:
- Remove `InputFormat.JSON_DOCLING` from `allowed_formats` when converting untrusted input.
- Export with `ImageRefMode.PLACEHOLDER` or `ImageRefMode.REFERENCED` instead of `EMBEDDED`.
### Summary
When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (`LatexBackendOptions(tikz_engine="tectonic")`), the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted `.tex` file can read files the process can read and write files at paths the process can write. If the caller also sets `tikz_engine_allow_shell_escape=True`, the document can run shell commands through `\write18`.
### Details
`docling/backend/latex/engines/tectonic.py` writes the picture source into a temporary document and runs the `tectonic` binary on it. `_resolve_local_dependency` only decides which files are staged into the temporary directory. It does not limit what TeX opens at compile time, so:
- `\input{/abs/path}`, `\verbatiminput{...}` and `\openin` read arbitrary files, and their content can be typeset into the rendered picture that ends up in the conversion output. For an in-memory `DocumentStream`, staging is skipped entirely.
- `\immediate\openout` / `\write` create or overwrite files outside the temporary directory. Neither needs shell escape. Tectonic's `--untrusted` flag does not block them either.
Separately, the `TectonicEngine` constructor defaults to `allow_shell_escape=True`. The LaTeX backend always passes `tikz_engine_allow_shell_escape` explicitly (default `False`), so this default only affects code that instantiates `TectonicEngine` directly.
### Affected configurations
- Affected: callers that set `tikz_engine="tectonic"`, have a `tectonic` binary available (on `PATH` or in the docling cache), and convert untrusted LaTeX.
- Not affected: the default configuration (`tikz_engine=None`). docling does not install `tectonic` automatically, and the CLI exposes no option to enable it.
### Impact
Disclosure of local files readable by the process, and creation or overwrite of files writable by the process. Writing to startup or configuration files can lead to code execution. With shell escape enabled, commands run directly.
### Proof of concept
```latex
\documentclass{article}
\usepackage{tikz}
\begin{document}
\begin{tikzpicture}
\immediate\openout15=/tmp/docling-tectonic-poc.txt
\immediate\write15{written by the input document}
\immediate\closeout15
\node {x};
\end{tikzpicture}
\end{document}
```
Converting this file with `LatexBackendOptions(tikz_engine="tectonic")` creates `/tmp/docling-tectonic-poc.txt`.
### Patches
Mitigated in docling 2.132.0 by [#4419](https://github.com/docling-project/docling/pull/4419):
- `TectonicEngine` now defaults to `allow_shell_escape=False`, and without shell escape Tectonic runs with `--untrusted` and `--only-cached`.
- Before compiling, docling checks the generated document and every staged file. It skips rendering, and keeps the diagram as TikZ code, when the source uses the `\openin`, `\openout`, `\XeTeXpicfile` or `\XeTeXpdffile` primitives, or names an absolute, home, drive-letter or parent-directory path in `\input`, `\include`, `\includegraphics`, `\InputIfFileExists` or `\graphicspath`.
This check is best-effort. It reads the source text, and TeX can open files in ways a text check cannot see, for example through package commands or names built by macros. As documented in the [pipeline options reference](https://github.com/docling-project/docling/blob/main/docs/reference/pipeline_options.md), untrusted LaTeX rendered with `tikz_engine="tectonic"` should still be processed in an isolated environment.
### Workarounds
Upgrade to 2.132.0. For older versions:
- Do not enable `tikz_engine="tectonic"` for untrusted input, or run the conversion in an OS-level sandbox (container, no host mounts, read-only filesystem, no network).
- Never set `tikz_engine_allow_shell_escape=True` for untrusted input.
CVE-2026-105676 is a path traversal vulnerability in TryGhost Ghost affecting versions from 1.20.0 up to but not including 6.64.0. It allows an authenticated Administrator to read JSON files outside the active theme's directory, potentially exposing sensitive server configuration secrets. The issue is fixed in version 6.64.0.
Eclipse Che versions 7.29.0 and later contain a vulnerability in the GET /api/scm/resolve and POST /api/factory/resolver endpoints that allows authenticated users to supply attacker-controlled URLs to a fetch function without proper scheme or host validation. This enables reading arbitrary local files, accessing internal HTTP services and cloud metadata endpoints, and forwarding stored SCM personal access tokens to attacker-controlled hosts. The vulnerability also allows exfiltration of SCM personal access tokens via malicious devfiles. No fix is currently available.
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.
Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account.
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration.
The specific flaw exists within the backup restoration mechanism, which fails to properly validate the paths, file types, integrity, and authenticity of files contained within a restored TGZ archive. The application does not perform file-signature verification before extracting the archive, allowing a specially crafted backup to contain attacker-controlled files.
An attacker with access to the backup SFTP or other configured repository can therefore provide a malicious TGZ archive that, when restored by the system, may place arbitrary files on the underlying Linux system. Depending on the location and permissions of the extracted files, this behavior can potentially be leveraged to achieve arbitrary code execution with root privileges and compromise the underlying virtual machine.
The absence of enforced backup passwords further reduces the protection provided by the backup mechanism and may facilitate unauthorized access to the repository.
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package introduced through a trusted package's packageGroup can supply .. segments or an absolute path, causing nx migrate to join an escaping destination onto its temporary directory. The migration archive can then write attacker-controlled bytes outside the temporary directory, while opening the destination stream can truncate an existing writable file even when no archive entry matches. This occurs during migration planning before review of the migration list or use of --run-migrations; the vulnerable installed Nx copy is reached when the normal nx@latest handoff is bypassed with NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or fallback after a temporary-install failure. This issue is fixed in versions 22.7.10 and 23.2.1.
CVE-2026-71453 is a medium severity vulnerability in Johnson Controls EasyIO FS32 prior to version 3.0b63. It involves external control of file name or path, enabling a traversal attack. The vulnerability allows an attacker with high privileges to potentially manipulate file paths externally. A patch is available, and the product is a cloud service, so vendor-managed remediation is expected.
CVE-2026-97662 is an argument injection vulnerability in the diff scan operation of AWS security-agent-mcp-server versions 0.1.1 up to but not including 0.2.0. This flaw allows context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host system outside the intended workspace by supplying a crafted reference value. The issue is fixed in version 0.2.0.