CVE-2026-66897 is a critical path traversal vulnerability in Canonical's LXD container management software. It allows an attacker with container edit permissions or a user launching a crafted image to overwrite arbitrary files on the host system as root. The flaw arises from a mismatch between path validation and file creation during instance template processing, enabling escape from directory confinement and host root code execution.
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels WordPress plugin up to version 4.9.8 contains a directory traversal vulnerability. Authenticated users with subscriber-level access or higher can exploit this flaw via the get_image_src_in_base64 function to read arbitrary files on the server. The plugin embeds base64-encoded file contents into cached invoice HTML, which is accessible through Print/Download invoice endpoints requiring only a valid nonce and access key.
CVE-2026-76606 is a critical path traversal vulnerability in the Fabrik extension for Joomla, versions up to 4.7.3. It allows an attacker to manipulate the pathname of an image element to access restricted directories improperly. The vulnerability has a CVSS 4.0 score of 10.0, indicating a severe risk with no required privileges or user interaction. No official patch or remediation guidance is currently available from the vendor.
An improper access control vulnerability exists in the Fabrik extension for Joomla versions up to 4.7.1. The onAjax_getFolders method allows unauthenticated users to perform arbitrary directory listings. This vulnerability is identified as CWE-284 and CWE-22 and has a high severity with a CVSS 4.0 score of 8.7.
CVE-2026-48105 is a path traversal vulnerability in Basekick-Labs' Arc Enterprise time-series database prior to version 26.06.1. The Raft FSM component accepts attacker-controlled file paths without proper validation, allowing potentially unauthorized file access or manipulation. The vulnerability is fixed in version 26.06.1. Mitigations include restricting cluster network access to trusted peers, auditing manifest paths, or disabling cluster mode until patched.
CVE-2026-47735 is a path traversal vulnerability in Basekick-Labs' Arc time-series database prior to version 26.06.1. The vulnerability arises because Arc's user-SQL validator only blocked certain DuckDB I/O functions via regex denylist, leaving many others unblocked. This allowed unauthorized file access through scalar table functions in SQL queries. The issue is fixed in version 26.06.1 by implementing a structural sandbox at the DuckDB layer that restricts file access to an allowlist and disables further extension installs or loads.
CVE-2026-44517 is a path traversal vulnerability in the Buildah tool used for building OCI images. Versions from 1.38.1 up to but not including 1.43.2, and a range starting at 1.44.0 but excluding 1.44.0, are affected. The vulnerability allows a malicious Git repository or tar archive server to cause files outside the intended build context directory to be included or copied into the build process. This issue is fixed in versions 1.43.2 and 1.44.0. The CVSS 3.1 score is 6.3, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.
CVE-2026-64679 is a path traversal vulnerability in the Atlantis application, a self-hosted Go service for Terraform pull request automation. Versions from 0.19.8 up to but not including 0.45.0 improperly validate user-controlled workspace names, allowing directory traversal outside intended workspace directories. This can lead to unauthorized filesystem operations such as creating or deleting directories with the privileges of the Atlantis process, potentially causing integrity loss or denial of service. The issue is fixed in version 0.45.0.
CVE-2026-45099 is a path traversal vulnerability in Terragrunt versions prior to 1.0.4. It arises because Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during a cleanup operation. A malicious or compromised external module can exploit this to delete files outside the module cache accessible to the Terragrunt process, potentially removing local source code or configuration and disrupting CI/CD pipelines. The issue is fixed in version 1.0.4.
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, omnigent/runner/resource_registry.py preserves the attacker-controlled path and omnigent/inner/os_env.py uses the resolved path as the environment root and copytree source. The _assert_within_cwd check then treats that attacker-selected root as trusted, allowing sys_os_read, write, edit, and shell tools to access runner files and environment secrets outside the intended workspace. This issue is fixed in version 0.3.0.
CVE-2026-76611 is a medium severity vulnerability in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.65. It allows unauthenticated attackers to perform arbitrary directory listing via the Gallery element due to improper limitation of a pathname to a restricted directory (CWE-22). This could expose directory contents without requiring authentication.
CVE-2026-75115 is a high severity path traversal vulnerability in the YOOtheme Pro extension for Joomla versions 2.3.0 through 5.0.40. It allows authenticated privileged users to read arbitrary files on the filesystem due to improper limitation of pathname filtering in the Filesystem source component. This vulnerability arises from glob-based pattern filtering that can be bypassed to access restricted files.
CVE-2026-77751 is a path traversal vulnerability in misp-stix affecting the handling of MISP object template names during STIX 2 import and export. The vulnerability allows crafted object names containing path traversal sequences to escape the intended template directory and load arbitrary definition.json files accessible to the process. This can lead to unintended disclosure of local data and modification of object metadata. The issue is mitigated by patches that enforce strict validation of object-template names, restricting them to safe characters and replacing invalid names with a generic placeholder.
CVE-2026-17424 is a medium severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 involving improper limitation of a pathname to a restricted directory, also known as a path traversal issue. This flaw could allow a remote attacker to bypass security restrictions. The vulnerability has a CVSS 3.1 base score of 4.8, indicating limited impact on confidentiality and integrity, with no impact on availability. No known exploits are reported in the wild. No patch or remediation information is currently provided.
CVE-2026-49244 is a path traversal vulnerability in the SFTPGo open source file transfer solution. Versions from 2.2.0 up to but not including 2.7.2 allow unauthenticated users to exploit the public web-client partial ZIP download endpoint for browsable shares. The vulnerability arises because the endpoint validates file entries using a raw byte-prefix comparison instead of a directory-boundary-aware check. This flaw allows attackers to include files outside the intended shared directory in the ZIP download, potentially disclosing sensitive file contents. The issue is fixed in version 2.7.2.
CVE-2026-69400 is a critical path traversal vulnerability in Microsoft Azure Logic Apps that allows unauthorized attackers to elevate privileges over a network. The flaw involves improper limitation of pathnames, enabling attackers to access restricted directories. This vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. Microsoft has issued an official fix for this cloud service vulnerability.
A path traversal vulnerability (CWE-22) exists in libgit2 prior to versions 1.8.6 and 1.9.5. The flaw allows crafted repositories to specify submodule paths with traversal components (e.g., ../escape-target), potentially causing applications to create directories outside the intended repository working tree. This issue affects the submodule handling functions git_submodule_lookup and git_submodule_add_setup. The vulnerability is fixed in libgit2 versions 1.8.6 and 1.9.5.
CVE-2026-73255 is a path traversal vulnerability in the cesanta mongoose embedded web server and network library. Versions prior to 7.22 allow an attacker who can control an SSI-enabled file to include directory traversal sequences in #include directives. This leads to disclosure of files readable by the Mongoose process due to improper sanitization of the file path. The issue is fixed in version 7.22.
VictoriaMetrics before versions 1.122.25, 1.136.12, and 1.146.0 contains a path traversal vulnerability in the vmrestore utility. The vulnerability arises because vmrestore does not validate backup part path components when restoring data from sources like S3, GCS, or Azure Blob Storage. An attacker able to supply or modify backup source object names can use '..' path components to cause vmrestore to write files outside the intended restore directory, potentially overwriting arbitrary files with the permissions of the vmrestore process. This issue is fixed in the specified versions.
CVE-2026-18274 is a path traversal vulnerability in the uploadJar method of Heimdall Data Database Proxy version 25.03.01.21. It allows authenticated remote attackers to execute arbitrary code with root privileges by exploiting improper validation of user-supplied file paths. The vulnerability is classified as high severity with a CVSS score of 7.2.