The Super Forms – Drag & Drop Form Builder WordPress plugin is vulnerable to arbitrary file and directory deletion in all versions up to and including 6.3.316. This vulnerability allows authenticated users with Subscriber-level access or higher to delete files and directories on the server, including critical WordPress files such as wp-config.php. The flaw arises from insufficient capability checks and improper sanitization of user-controlled input in AJAX handlers, enabling recursive deletion that can lead to full site takedown and potential remote code execution if the site is reinstalled by an attacker.
The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler WordPress plugin before 1.8.17 or passes a request-derived URL to its public cache-clearing hook.
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover.
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.
CVE-2026-102141 is a vulnerability in Kiteworks Core cluster-management operations where file paths supplied were not validated. This allows an attacker with root access on one cluster node to write files as root onto another node, potentially causing execution there. Exploitation requires high privileges (root) on a backend node and the presence of a pending software patch on the target node. The vulnerability affects Kiteworks Core versions prior to 9.5.1.
CVE-2026-102146 is a vulnerability in Kiteworks Email Protection Gateway where an authenticated administrator with limited delegated permissions can write files with attacker-controlled content to arbitrary locations accessible by the service account. This privilege escalation can lead to modification of application files or configurations and potentially disrupt service availability. The vulnerability affects versions prior to 9.5.1. The CVSS score is 6.5, indicating a medium severity impact.
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.
CVE-2026-101126 is a medium severity vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.3. The flaw involves improper limitation of pathname to a restricted directory, allowing potential path traversal and metadata tampering. The vulnerability arises because the extension processes JSON arrays per upload field, trusting client-supplied filenames and display names without sufficient validation. This can lead to cross-session claiming and unauthorized file metadata manipulation.
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE).
This issue was fixed in version 2.3.9.
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution (RCE). Authentication with a known username is required. The vulnerability stems from insufficient path sanitization in the file conversion process, enabling path traversal attacks that place malicious PHP files in the web server's root directory. This issue has been patched in versions 16.0.10 and 17.0.5.
An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to the admin or itadmin account to submit commands written in the Intermec Fingerprint programming language directly to the printer ’s internal command interpreter.
An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
Plex Media Server versions before 1.43.3.10861 contain a vulnerability that allows an admin user to write arbitrary files which may be executed on load. This occurs because the TranscoderH264Options preference is directly appended to x264's option string without validation, and at startup, all .so files are executed without signature, execute bit, or symbol checks. This flaw enables potential arbitrary code execution.
Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.
CVE-2026-77247 is a high-severity vulnerability in the MCP Atlassian server used by Atlassian products like Confluence and Jira. Versions prior to 0.22.0 allow permitted clients to control file path arguments during attachment uploads, enabling disclosure of host files without requiring shell or direct filesystem access. The flaw involves improper handling of caller-controlled paths in the upload process. This issue is fixed in version 0.22.0.
Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confining it to an intended directory. When an untrusted source supplies an event field used by the path template, the value can contain an absolute path or parent-directory traversal, causing Vector to create parent directories and create or overwrite files outside the intended location with the Vector process privileges. The resulting file write can modify sensitive files and can lead to code execution when a scheduled task, authorization file, or subsequently executed script is targeted. This issue is fixed in version 0.57.0.
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.
A path traversal vulnerability exists in roomi-fields notebooklm-mcp versions 1.6.0 through 2.0.2 in the POST /batch-to-vault endpoint and the batch_to_vault MCP tool starting from version 1.7.0. This flaw allows attacker-controlled inputs to cause files to be written outside the intended vault directory. Version 2.0.3 introduces sanitization and containment features to mitigate this issue. Users unable to upgrade should restrict server permissions and limit endpoint exposure.
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.
CVE-2026-90817 is a critical unauthenticated remote code execution vulnerability in Vanderbilt University's REDCap software. It affects version 13.3.0 and higher. The flaw arises from improper control of code generation in the survey passthrough routing and data import processing logic. An attacker with knowledge of a valid public survey hash can manipulate HTTP requests and crafted file-path or stream parameters to execute arbitrary code on the REDCap server without authentication.