CVE-2026-115194 is a path traversal vulnerability in the Mautic Asset API that allows an authenticated user with asset creation permissions to register and publish arbitrary files readable by the web server. This results in unauthorized disclosure of sensitive files, including configuration files containing database and SMTP credentials, via a public download URL without authentication.
CVE-2026-105947 is a path traversal vulnerability in Innotim Software's Logsign SIEM affecting versions from 6.4.120 up to but not including 6.4.122. This flaw allows an attacker with low privileges to access files outside the intended directory, potentially exposing sensitive information. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 6.4.122.
CVE-2026-95628 is a path traversal vulnerability in the Apache Camel Docling component affecting versions from 4.15.0 before 4.18.5 and from 4.19.0 before 4.22.2. The issue arises because the validation method intended to restrict path arguments to a safe directory only checked for relative traversal sequences and did not block absolute paths. This allows an attacker able to control custom arguments to specify absolute paths, potentially accessing directories outside the intended scope. The vulnerability is fixed in Apache Camel versions 4.18.5 and 4.22.2. Users on unsupported versions must upgrade or apply mitigations to prevent exploitation.
CVE-2026-95629 is a path traversal vulnerability in the Apache Camel Docling component affecting versions from 4.15.0 before 4.18.5 and from 4.19.0 before 4.22.2. The issue arises because the CamelDoclingOutputFilePath header value is passed verbatim to the external docling tool's --output flag without proper normalization or directory confinement, allowing an attacker able to set this header to write conversion output files to arbitrary directories writable by the Camel process. The vulnerability is mitigated by upgrading to Apache Camel versions 4.18.5, 4.22.2, or later, which introduce an outputBaseDirectory option to restrict output paths. For versions that cannot be upgraded immediately, users should ensure the header is not influenced by external inputs and is filtered appropriately.
A path traversal vulnerability exists in the GiveWP WordPress plugin versions before 4.19.0.1. This flaw allows users with a high-privilege custom role to read arbitrary JSON-parseable files from the server and overwrite the plugin's stored configuration by supplying crafted filenames. The issue is fixed in version 4.19.0.1.
CVE-2026-115932 is a critical path traversal vulnerability in GitroomHQ's postiz-app affecting versions from 2.23.0 up to but not including 2.25.3. It allows a registered user to craft a media path that bypasses normal checks and causes the publishing worker to read arbitrary files on the server. These files can then be sent as attachments to a Discord server controlled by the attacker. Additional routes enable file existence checks and file delivery, potentially exhausting backend memory. Self-registration is enabled by default, so no prior account is needed to exploit this issue.
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
Fallow, a codebase intelligence tool for TypeScript and JavaScript, has a path traversal vulnerability in versions from 2.68.0 up to but not including 3.34.0. The tool follows attacker-controlled Jest and Vitest project paths outside the project root via absolute paths, parent directory segments, wildcard globs, or symlinks. This causes Fallow to parse external files as test-runner configuration, which can alter dependency and file usage analysis results. The vulnerability does not expose file contents externally. The issue is fixed in version 3.34.0.
A critical path traversal vulnerability (CWE-22) exists in intranda goobi-viewer-core versions 24.03 up to but not including 26.05. The flaw allows an attacker to manipulate filenames extracted from a Content-Disposition header to perform directory traversal or use absolute paths. This can lead to arbitrary file writes by the Tomcat process user, potentially enabling remote code execution. The issue is fixed in version 26.05.
baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain a path traversal vulnerability in the optional BcThemeFile plugin. An authenticated user with theme-file view permission can read certain files outside the theme directory by exploiting improper path validation. This can disclose sensitive application source code and configuration files, including database credentials and security salts. The plugin is disabled by default, and unauthenticated access is not sufficient. The issue is fixed in versions 5.3.2 and 5.4.2.
baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because normalizePath() resolves only literal dot segments, percent-encoded traversal can pass the containment checks and become a path outside the theme directory at the write sink. An authenticated administrator can write PHP files into writable locations such as webroot and execute them, exceeding the intended theme-template editing boundary. The source also identifies the same check-before-decode ordering in ThemeFilesService::copy(), although that path was not dynamically verified. Exploitation requires the non-default plugin, an administrator session, and a same-origin Origin header; USE_CORE_ADMIN_API=false does not block session-authenticated requests. The Admin web form is not affected by this encoded-path tampering because FormProtection protects fullpath. This is a third bypass of the protections associated with CVE-2026-30940, using encoded traversal decoded after validation. This issue has been patched in versions 5.3.2 and 5.4.2.
A path traversal vulnerability (CWE-22) exists in the Entire CLI prior to version 0.7.7. This flaw allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata containing specially crafted SessionID values. These values can cause the CLI to write attacker-controlled data outside the intended session directory during session resume or checkpoint rewind operations. The vulnerability arises because the SessionID field is used without validation to construct filesystem paths. The issue has been fixed in version 0.7.7.
CVE-2026-55888 is a path traversal vulnerability in flatpak's xdg-desktop-portal prior to version 1.22.1. It allows malicious sandboxed applications to exploit the FileChooser.SaveFiles method to gain arbitrary file access on the host system, limited to files accessible by the user. The flaw exists because filenames are not properly validated, enabling path traversal attacks. The issue has been fixed in version 1.22.1.
CVE-2026-63120 is a path traversal vulnerability in pghoard, a PostgreSQL backup and restore tool. Versions prior to 2.7.2 contain an incomplete fix that allows attackers with write access to backup object storage to write arbitrary files outside the intended PostgreSQL data directory during restore operations. This can lead to arbitrary file writes and directory creation on the host system. The vulnerability is patched in version 2.7.2.
PraisonAI versions from 2.6.0 up to but not including 4.6.59 contain a path traversal vulnerability in the template loader. The vulnerability allows an attacker to supply crafted GitHub template URIs with malicious refs that escape the intended cache directory. This can lead to deletion of arbitrary directories outside the cache via shutil.rmtree, causing denial of service or data loss. The issue is fixed in version 4.6.59.
PraisonAI versions from 3.8.1 up to but not including 4.6.59 contain a path traversal vulnerability in the Dynamic Context Discovery feature. This flaw allows unauthorized reading of arbitrary files on the host filesystem by manipulating artifact tool arguments. The vulnerability has been fixed in version 4.6.59.
CVE-2026-56833 is a path traversal vulnerability in MervinPraison's PraisonAI affecting versions from 3.8.1 up to but not including 4.6.59. The Dynamic Context module improperly handles run_id and agent_id inputs, allowing an attacker with lower trust to read .jsonl and .log files outside the intended directory. This issue is fixed in version 4.6.59.
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
CVE-2026-105265 is a path traversal vulnerability in Kiloview E3 Firmware versions prior to 1.30. It involves improper validation of the time zone parameter, allowing an authenticated user to cause /etc/localtime to point to files outside the intended zoneinfo directory. This vulnerability has a medium severity with a CVSS score of 5.3 and was fixed in version 1.30.
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.
Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal.
Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.