CVE-2026-62804 is a vulnerability in Microsoft 365 Apps for Enterprise, specifically in Microsoft Office Word, involving external control of file name or path. This flaw allows an unauthorized attacker to execute code locally on the affected system. The vulnerability has a high severity score of 7.8 and has been officially fixed by Microsoft.
CVE-2026-69805 is a high-severity vulnerability in Microsoft Visual Studio 2022 version 17.14 involving external control of file name or path in .NET. This flaw allows an unauthorized attacker to elevate privileges over a network. The vulnerability affects specific versions prior to 17.14.40 and 18.9.3, and has an official fix available.
CVE-2026-69383 is a vulnerability in Microsoft Windows 11 version 23H2 involving external control of file name or path in the Windows Shell. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.0 and affects multiple builds of Windows 11 23H2 prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-69355 is a high-severity vulnerability in Microsoft Exchange Server 2016 Cumulative Update 23 that allows an authorized attacker to execute code remotely by externally controlling file names or paths. The vulnerability affects multiple builds prior to specific fixed versions. An official patch is available from Microsoft to remediate this issue.
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.
OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the user's destination storage. The temporary filename comes from the attacker-controlled Content-Disposition header, is passed from parseFilenameFromContentDisposition in internal/offline_download/http/util.go to filepath.Join(task.TempDir, filename) in SimpleHttp.Run in internal/offline_download/http/client.go, and is opened with os.Create without a containment check. Because filepath.Join cleans .. segments, a non-admin user with PermAddOfflineDownload on any path can traverse out of task.TempDir and create, truncate, or overwrite any file writable by the OpenList process whose parent directory already exists. The server/handles/offline_download.go AddOfflineDownload route uses normal user authentication rather than AuthAdmin, and local-storage destinations fall through tryPutUrl in internal/offline_download/tool/add.go to the vulnerable SimpleHttp.Run path. This issue is fixed in version 4.2.3.
Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export->store(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an existing writable file, Disk::copy() opens it with fopen() in rb+ mode and uses stream_copy_to_stream(), bypassing Flysystem path confinement and allowing an attacker whose application input controls the export path to overwrite arbitrary existing files with export content. The rb+ behavior creates a non-truncating overwrite and trailing bytes when the new export is shorter, and overwriting an executable PHP file can lead to remote code execution. This issue is fixed in version 3.1.70.
CVE-2026-82393 is a path traversal vulnerability in pnpm package manager versions prior to 10.34.5 and between 11.0.0 and before 11.11.0. It allows an attacker to craft a tarball dependency with a malicious package.json name containing scoped path traversal sequences. This leads to arbitrary file overwrites outside the node_modules directory during package installation, potentially replacing critical files such as shell startup scripts, Git hooks, or package code, which can result in code execution. The vulnerability is fixed in pnpm versions 10.34.5 and 11.11.0.
CVE-2026-66324 is a vulnerability in Microsoft Edge (Chromium-based) involving external control of file name or path. This flaw allows an unauthorized attacker to perform spoofing attacks over a network. The issue affects versions prior to 152.0.4191.52 and 152.0.4191.53. A fix has been officially released by Microsoft.
CVE-2026-19084 is a vulnerability in the shared-files-pro WordPress plugin before version 1.7.70. It allows unauthenticated attackers to read arbitrary files on the server by exploiting improper validation of file paths when creating a featured image. This can lead to sensitive information disclosure via publicly accessible URLs.
A vulnerability in the Shared Files WordPress plugin before version 1.7.67 and shared-files-pro before 1.7.68 allows unauthenticated users to bypass a traversal filter and specify file paths outside the intended uploads directory. This can lead to deletion of arbitrary files on the server, such as wp-config.php, when a corresponding file entry is deleted, causing denial of service and potential site takeover.
Trilium versions prior to 0.104.0 have a vulnerability in the automatic image-download feature that allows authenticated users to read arbitrary local files via file:// URLs in note img tags. This occurs because the feature accepts file URLs without path validation, enabling disclosure of files readable by the Trilium process. Additionally, referencing unbounded sources like /dev/zero can cause memory exhaustion and crash the server. The issue affects the web UI, ETAPI, web clipper, and note imports and requires only an authenticated session or ETAPI token. The vulnerability is fixed in version 0.104.0.
CVE-2026-79653 is a path traversal vulnerability in Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, and 20.1.0 when configured to use file system storage via the enable.attachment.store.to.file.system setting. An attacker can manipulate uploaded filenames to traverse directories arbitrarily. The vulnerability can be mitigated by disabling this configuration or updating to fixed versions.
CVE-2026-77016 is a critical vulnerability in the Workeera WordPress plugin before version 1.0.6. It allows users with subscriber-level roles to delete arbitrary files on the server due to improper validation of file paths when deleting files from their candidate profiles.
CVE-2026-59683 is a critical vulnerability in the OpenRGB network protocol by CalcProgrammer1 that allows attacker-controlled strings to be written to arbitrary file system paths. This vulnerability extends a previous issue (CVE-2026-59682) and can result in full system compromise if the OpenRGB daemon runs with root privileges, or full account takeover if running under a user context. The vulnerability affects OpenRGB versions from 0 up to and including 1.0rc3. No patch or official remediation guidance is currently available.
CVE-2026-59682 is a high-severity vulnerability in OpenRGB up to version 1.0rc3 that allows an attacker to overwrite arbitrary files via the SAVE_PROFILE message. This vulnerability involves external control of file name or path (CWE-73). There is no official patch or remediation guidance currently available from the vendor.
CVE-2026-16444 is a high-severity vulnerability in TeamViewer Desktop Clients prior to version 15.81.5. It involves improper neutralization of path traversal sequences, allowing an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. This can lead to arbitrary file write and potentially code execution with the privileges of the affected user.
The Order Tip for WooCommerce WordPress plugin before version 1.6.0 contains a vulnerability that allows users with the Shop Manager role or higher to delete arbitrary files on the server. This occurs because the plugin does not verify user capabilities for file deletion requests and does not restrict the file paths that can be deleted. Exploitation of this vulnerability could lead to site takeover.