Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation. Relative traversal such as ../victim/foo and an absolute Prompt.name can escape or discard the configured registry root, while overwrite=True permits replacement of existing target files. The poisoned name is persisted in index.json and reconstructed by _load(), allowing the out-of-root path to survive later registry loads. An application that forwards request data into these fields can therefore write Prompt.raw bytes to attacker-chosen paths writable by the application process. This issue is fixed in version 2.4.5.
A path traversal vulnerability exists in handlebars.java versions prior to 4.5.3. The issue arises from improper validation of attacker-controlled Spring MVC view names in the SpringTemplateLoader component, allowing remote unauthenticated attackers to read arbitrary files accessible to the JVM. This vulnerability is fixed in version 4.5.3.
CVE-2026-70383 is a path traversal vulnerability in the Estonian Information System Authority (RIA) DigiDoc4 client. It affects versions from 4.0.0 up to but not including 4.11.0. The flaw allows improper limitation of a pathname to a restricted directory, potentially enabling unauthorized file access. The vulnerability has a high severity score of 8.4 (CVSS 4.0). No official patch or remediation details are provided in the input data.
CVE-2026-64967 is a path traversal vulnerability in ATutor version 2.2.4 that allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory via the error log viewer. The product is no longer actively supported and this vulnerability remains unpatched.
ATutor version 2.2.4 contains a path traversal vulnerability in its ZIP extraction functionality. An attacker with instructor privileges can upload a crafted ZIP archive that writes files outside the intended directory, including placing executable .phtml files in the web root. This can lead to remote code execution with the web server's privileges. The product is no longer actively supported, and no fix is available. Other versions may also be vulnerable but were not tested.
CVE-2026-64963 is a path traversal vulnerability in ATutor version 2.2.4 that allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE configuration option is enabled. This can lead to unauthorized file access and disclosure of filesystem structure information. The product is no longer actively supported, and no fix is available for this vulnerability.
IBM OpenBMC versions FW1060.00 through FW1060.80 contain a path traversal vulnerability in the BMC firmware update process. This flaw allows an attacker with authenticated administrator-level access to execute arbitrary code, potentially impacting confidentiality, integrity, and availability of the system. The vulnerability is identified as CWE-22 and has a CVSS 3.1 base score of 6.8, indicating a medium severity level.
CVE-2026-75593 is a path traversal vulnerability in moby buildkit prior to version 0.31.2. It allows a custom client with valid BuildKit control API permissions to craft an upload request that escapes the BuildKit-controlled state directory. This issue is fixed in version 0.31.2.
CVE-2026-16888 is a path traversal vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to access sensitive information by improperly limiting pathname access to restricted directories. The vulnerability has a low severity rating with a CVSS score of 3.7.
CVE-2026-63188 is a path traversal vulnerability in the logto-io logto Tunnel npm package prior to version 0.3.9. It allows unauthenticated attackers to read arbitrary files outside the intended static directory by sending crafted requests with path traversal sequences. This occurs because the package improperly joins paths without normalization or containment checks. The vulnerability is fixed in version 0.3.9.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
CVE-2026-48024 is a critical path traversal vulnerability in Wazuh versions from 4.0.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta3. It allows a cluster peer with the shared Fernet key to write arbitrary files outside the intended directory, including sensitive configuration files like ossec.conf. This can lead to remote code execution when Wazuh services reload. The issue is fixed in versions 4.14.6 and 5.0.0-beta3.
CVE-2026-46343 is a path traversal vulnerability in Wazuh versions from 4.0.0 up to but not including 4.14.6 and from 5.0.0-beta1 up to but not including 5.0.0-beta2. It allows a cluster-authenticated node to delete arbitrary files outside the intended directory by exploiting improper handling of file paths in the end_receiving_file() function. This can lead to deletion of critical configuration and secret files, potentially disabling the manager and disrupting cluster and API operations. The issue is fixed in versions 4.14.6 and 5.0.0-beta2.
OpenEMR versions before 8.3.0 have a path traversal vulnerability in the EDI archive restore function. An authenticated user with EOB Data Entry permissions can manipulate the archrestore_sel POST parameter to probe arbitrary filesystem paths. The vulnerability arises because the parameter is not sanitized for path traversal sequences, and differing response messages reveal whether a target path exists on the server.
CVE-2026-53451 is a critical path traversal vulnerability in sgoudelis ground-station prior to version 0.4.13. It allows unauthenticated attackers to write arbitrary files outside the intended directory by exploiting improper pathname limitation in a Socket.IO command. This can lead to remote code execution with service privileges via crafted logging configuration files, and may cause persistent service crashes. The issue is fixed in version 0.4.13.
CVE-2026-53452 is a path traversal vulnerability in sgoudelis ground-station prior to version 0.4.13. It allows unauthenticated attackers to read arbitrary files outside the intended directory by exploiting improper validation of a pathname used in SDR configuration commands. The vulnerability requires the presence of readable JSON metadata files and associated data files to disclose contents. This issue is fixed in version 0.4.13.
CVE-2026-44829 is a path traversal vulnerability in Gotenberg versions 8.32.0 and earlier. The issue arises because filename sanitization using filepath.Base on Linux does not handle Windows-style backslash separators, allowing crafted filenames with Windows-style parent directory components to bypass sanitization. This can lead to malicious archive entries that, when extracted on a Windows system, write files outside the intended directory. The vulnerability affects multiple PDF and document conversion routes. It is fixed in version 8.33.0.
CVE-2026-15061 is a path traversal vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 affecting the nimesis registration service. This flaw could allow a remote attacker to overwrite files on the affected system. The vulnerability has a high severity rating with a CVSS score of 8.2. No specific patch or remediation details are provided in the available data.
A path traversal vulnerability exists in electerm versions prior to 3.11.11. The application improperly handles remote-supplied filenames during Zmodem and Trzsz file transfers, allowing a malicious SSH server or remote shell to craft filenames with traversal sequences. This can cause electerm to write files outside the intended download directory, potentially overwriting sensitive files accessible to the desktop user. The issue is fixed in version 3.11.11.
Dell OpenManage Enterprise versions prior to 4.7.0 contain a path traversal vulnerability (CWE-22) that allows a low privileged remote attacker to potentially expose sensitive information. The vulnerability does not impact integrity or availability but can lead to information disclosure. The CVSS 3.1 base score is 6.5, indicating a medium severity risk.