CWE-22: Path Traversal vulnerabilities

CVE-2026-18051 is a critical path traversal vulnerability in the W3 Total Cache WordPress plugin versions before 2.10.5. It allows unauthenticated attackers to write files to arbitrary directories on the server, including overwriting important files such as .htaccess on Apache servers. This can break the site and remove security hardening rules.

The Simple File List WordPress plugin versions up to and including 6.3.11 contains a path traversal vulnerability that allows unauthenticated users to read arbitrary files on the server and move critical files outside the web root. This can lead to sensitive information disclosure and potential site takeover.

The Atarim plugin for WordPress (versions up to and including 5.1.1) contains a path traversal vulnerability that allows authenticated users with author-level access or higher to delete arbitrary files on the server. This is due to insufficient validation of file paths in a specific function, enabling attackers to manipulate attachment metadata and trigger deletion of targeted files. Exploitation can lead to remote code execution if critical files like wp-config.php are deleted.

CVE-2026-50186 is a path traversal vulnerability in 4gaBoards prior to version 3.3.8. An authenticated project manager can exploit this flaw by supplying traversal sequences in the filename parameter of a GET request, allowing access to arbitrary files on the server. Additionally, the vulnerability can cause deletion of arbitrary files due to improper handling of the file path after download. This issue is fixed in version 3.3.8.

CVE-2026-52875 is a path traversal vulnerability in the Streambert Electron desktop app prior to version 2.6.0. The issue arises from the perform-scheduled-backup IPC handler accepting a renderer-supplied path without verifying it is within an authorized backup directory. This allows a compromised renderer process to create or delete files outside the intended backup location. The vulnerability is fixed in version 2.6.0.

CVE-2026-52872 is a path traversal vulnerability in Streambert, a cross-platform Electron desktop app for streaming and downloading video content. Versions prior to 2.5.0 have a flaw in the downloadSubtitleFile utility where a renderer process can supply a file URI and control the destination path, allowing arbitrary file copying. This can lead to exposure of sensitive local files and overwriting of writable files. The vulnerability is fixed in version 2.5.0.

CVE-2026-47699 is a path traversal vulnerability in Confidential Containers Guest Components versions 0.16.0 through 0.19.x. It allows a crafted OCI image layer to create a hardlink outside the intended directory during image unpacking, potentially enabling a workload owner to escape into the pod virtual machine and abuse its capabilities. The issue is fixed in version 0.20.0.

CVE-2026-73974 is a path traversal vulnerability in linuxfabrik monitoring-plugins prior to version 7.0.0 and linuxfabrik-lib prior to 6.1.0. The issue arises because the test helper function lib.lftest.test() improperly handles filesystem paths from a hidden --test argument, allowing unauthorized file reads without path confinement. This vulnerability enables an attacker with sudo-authorized plugin access to read arbitrary root-readable files. The flaw affects multiple plugins that expose file content or existence checks. The vulnerability is fixed by confining fixture reads to a safe directory and routing bypasses through the helper in the fixed versions.

Linuxfabrik monitoring-plugins prior to version 7.0.0 contain a path traversal vulnerability in the logfile check plugin. The plugin accepts a free-form --filename argument and opens the specified file as root without restricting the path to /var/log. This allows an attacker with control over the monitoring account to read arbitrary root-readable files such as /etc/shadow. The issue is fixed in version 7.0.0 by confining paths to documented log roots and resolving symlinks and parent-directory traversal before access.

CVE-2026-53457 is a path traversal vulnerability in ha-china blueprint-studio prior to version 2.5.2. The vulnerability arises from improper validation of a working-directory parameter in the terminal command execution path, allowing an administrator to specify directories outside the intended Home Assistant configuration directory. This could enable commands to access or modify files beyond the expected restricted filesystem area. The issue is fixed in version 2.5.2.

CVE-2026-47627 is a critical path traversal vulnerability in NVIDIA Triton Inference Server for Linux version 0.0-26.05. This flaw allows an attacker to improperly limit pathname access, potentially leading to denial of service. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-68922 is a path traversal vulnerability in MobSF Mobile-Security-Framework-MobSF prior to version 4.5.1. The flaw exists in the find_icon_path_zip function, which uses the Android manifest's android:icon value to build file paths without proper validation. This allows an authenticated user to upload a crafted ZIP or APK file that can read server files with allowed extensions, copy them to a predictable location, and retrieve them via the /download/ endpoint. The vulnerability also enables a file-existence oracle through the icon_path report field. The issue is fixed in version 4.5.1.

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.

CVE-2026-48798 is a path traversal vulnerability in SSH.NET versions prior to 2026.0.0. The ScpClient.Download method improperly trusts file and directory names returned by a remote SCP server, allowing an attacker controlling or intercepting the server to craft paths that can overwrite or create files outside the intended directory. This can lead to arbitrary file write by the client process. The issue is fixed in version 2026.0.0.

Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

CVE-2026-15585 is a path traversal vulnerability in AKINSOFT Wolvox9 ERP's KontrolPanel.exe component. It allows an attacker to improperly access files outside of a restricted directory. The vulnerability affects versions from s26.02.17 up to but not including 26.02.22. The CVSS score is 7.5, indicating high severity. There is no information about available patches or vendor advisories. No known exploits are reported in the wild.

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.

ApostropheCMS versions prior to 3.6.2 contain a path traversal vulnerability in the import-export module. This flaw allows an authenticated contributor to craft an archive that can read arbitrary host files with allowed extensions and publish them via an unauthenticated uploads URL. The issue is resolved in version 3.6.2.