Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain a path traversal vulnerability (CWE-22) that allows an unauthenticated remote attacker to access the filesystem. This vulnerability is fixed in versions 8.9.0.0 or later and other specified LTS versions. The CVSS 3.1 score is 5.3 (medium severity).
CVE-2026-105457 is a path traversal vulnerability in HAVELSAN Inc. Liman MYS that allows an attacker with limited privileges to access files outside the intended directory. This affects versions before 2.3.5-1132. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact primarily on confidentiality. A fix is available in version 2.3.5-1132.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including various LTS releases, contain a path traversal vulnerability (CWE-22). This flaw allows a low privileged attacker with remote access to potentially access the filesystem beyond intended restrictions. The vulnerability is rated high severity with a CVSS score of 8.8. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 respectively.
The Tainacan WordPress plugin versions up to and including 1.3.0 contain a directory traversal vulnerability via the 'tmp_file' parameter. Authenticated users with editor-level or higher privileges can exploit this flaw to read arbitrary files on the server. The attack involves injecting a malicious path that is stored in the database and later accessed through a REST endpoint, exposing file contents.
The Product Designer for WooCommerce WordPress | Lumise plugin is affected by a directory traversal vulnerability in all versions up to and including 2.1.2. This flaw allows unauthenticated attackers to read arbitrary files on the server by exploiting the process_checkout function. The required security nonce can be obtained without authentication, enabling exploitation without prior access or credentials.
The AI Engine – MCP Server & AI Chatbot for WordPress plugin is affected by a path traversal vulnerability that allows authenticated users with subscriber-level access or higher to delete arbitrary media files on the server. This vulnerability exists due to insufficient file path validation in the upload_file function in versions up to and including 3.8.4. Exploitation requires the Public API option to be enabled by an administrator and depends on the scheduled hourly cleanup_files task to execute after a malicious upload.
CVE-2026-58257 is a path traversal vulnerability in JeromeDevome GRR prior to version 4.5.0. The flaw exists in the database restoration feature, which does not properly validate file paths. An administrator user can exploit this to read or delete arbitrary files on the server, potentially disclosing sensitive information or causing denial of service. The risk is higher if the server runs with elevated privileges. The issue is fixed in version 4.5.0.
CVE-2026-57200 is a path traversal vulnerability in Asterisk affecting versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 22.8-cert3. An authenticated attacker with read-only Asterisk REST Interface (ARI) credentials can bypass authorization under certain conditions to perform write operations via REST-over-WebSocket, potentially leading to arbitrary module path loading and remote code execution. The vulnerability requires the Asterisk HTTP server to be enabled and reachable, which is disabled by default and bound to localhost. This issue has been fixed in the specified versions.
MLflow versions from 3.10.0 up to but not including 3.17.0 contain a path traversal vulnerability in the _create_model_version() function. This flaw allows remote attackers to read arbitrary files on the MLflow server by storing server-local paths as model version artifact locations and accessing them via the model-versions artifact API. The vulnerability arises because path validation only occurs when a source has a URL scheme, and the is_prompt tag is checked by presence rather than a true value. The issue is fixed in version 3.17.0.
CVE-2026-116682 is a path traversal vulnerability in FileBrowser Quantum before versions 1.5.2-stable and 2.0.1-beta. The backend improperly resolves symbolic links without verifying that the target remains within the authorized scope. This allows authenticated users with download access, and even unauthenticated users with public share links, to read files outside their assigned directories. The issue is fixed in versions 1.5.2-stable and 2.0.1-beta.
A path traversal vulnerability (CWE-22) exists in the systeminformation Node.js library prior to version 5.33.14. The Linux networkStats(iface) function improperly uses a caller-supplied interface name to build filesystem paths without validating that the input is a single segment or that the resolved path remains within the expected directory. This allows a local attacker who can control the iface parameter and set up symlinked directories to read the first line of arbitrary files accessible to the Node.js process. The package does not expose a network endpoint, so exploitation requires local filesystem access and setup. The issue is fixed in version 5.33.14.
CVE-2026-108141 is a path traversal vulnerability in Veeam Backup and Replication that allows an authenticated user with the Restore Operator role, who controls a backed-up NAS share, to write files to arbitrary paths on the backup server. This flaw affects versions 13.0 up to but not including 13.0.3 and 13.1 up to but not including 13.1.2. The vulnerability is rated medium severity with a CVSS score of 5.9. Fixed versions 13.0.3 and 13.1.2 are available.
CVE-2026-108140 is a path traversal vulnerability in Veeam Backup and Replication that allows an authenticated user with the Restore Operator role, who can control a backed-up NAS share, to write files to arbitrary locations on the backup server via relative path traversal. This could lead to unauthorized file writes on the backup server.
CVE-2026-93864 is a path traversal vulnerability in WatchGuard Fireware OS's firewall daemon. It allows a local attacker with low-privileged code execution to overwrite arbitrary files with root privileges by planting a crafted file system object and triggering a list update. This can also lead to tampering with firewall IP set data. The vulnerability affects multiple versions of Fireware OS and has been assigned a high severity rating.
CVE-2026-115924 is a path traversal vulnerability in the rembg tool prior to version 2.0.82. The vulnerability exists in the /api/remove endpoint, where an attacker can manipulate the sam_model parameter to perform path traversal combined with URL fragment syntax. This allows an unauthenticated attacker to download malicious ONNX encoder and decoder files alongside readable target files, enabling disclosure of any file accessible to the rembg process and arbitrary ONNX computation. The issue is fixed in version 2.0.82.
CVE-2026-115923 is a path traversal vulnerability in Backstage's DefaultCatalogRulesEnforcer component of the @backstage/plugin-catalog-backend. It affects versions prior to 3.9.2 and from 4.0.0 up to but not including 4.0.2. The flaw allows an authenticated user with catalog.location.create permission to bypass URL validation by using percent-encoded path segments, causing untrusted URLs to be treated as trusted. This can lead to the ingestion of entity content from untrusted sources. The issue is fixed in versions 3.9.2 and 4.0.2.
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.
This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected to be in some specific formats and the reading stops at the first parsing error, which makes this vulnerability unlikely to leak sensitive information. The impacted formats are:
* Geographic Markup Language (GML) with `xlink:href` attributes for other files in GML format.
* Well Known Text (WKT) with parameter elements for datum shift grids in NADCON, NTv2 or RGF93 formats.
* Landsat scene with paths to files for each band in the GeoTIFF format.
Users are recommended to upgrade to version 1.7, which fixes the issue by restricting the paths to the same directory as the file containing the references to other files, or to a predetermined directory for datum shift grids.
CVE-2026-93328 is a critical vulnerability in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0. It involves path traversal and missing authorization in the cloud-storage source component, allowing unauthenticated remote attackers to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters. The issue is fixed in version 1.5.0.
CVE-2026-115194 is a path traversal vulnerability in the Mautic Asset API that allows an authenticated user with asset creation permissions to register and publish arbitrary files readable by the web server. This results in unauthorized disclosure of sensitive files, including configuration files containing database and SMTP credentials, via a public download URL without authentication.