draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions operate on a renderer-chosen filesystem path with no blessed-path (assertWritablePath) authorization. The only gates are validateSender — a URL-prefix origin check — plus, for readFile alone, a content "sniff" and a lexical appBaseDir prefix block. The write-side handlers (saveFile, writeFile, saveDraft, deleteFile) are all protected by assertWritablePath; the read side is not. The result is a read/write authorization asymmetry: any frame executing in the app's file:// origin can read the contents of local files that the same origin is explicitly forbidden to write. This issue is fixed in version 31.4.4.
CVE-2026-92709 is a path traversal vulnerability in rsyslog's omfile dynaFile facility affecting versions from 1.15.0 up to 8.2610.0. The vulnerability arises when untrusted input influences the dynamic file path used for log output without proper secure-path handling, allowing the path to escape the intended log directory. This can lead to unauthorized file access or modification. No patches are publicly available at the time of disclosure.
CVE-2026-81163 is a path traversal vulnerability in the Drupal Media Library Importer module that allows improper limitation of pathnames to restricted directories. This flaw affects versions from 0.0.0 up to but not including 2.1.6. The vulnerability could allow an attacker with limited privileges to read or write files outside the intended directory. The issue has been fixed in version 2.1.6. The CVSS score is 5.4, indicating a medium severity level.
A path traversal vulnerability (CWE-22) exists in jupyter nbconvert versions from 5.4.0 up to but not including 7.17.2. The vulnerability allows an attacker to craft a malicious notebook that, when converted using certain exporters, can write output files to arbitrary locations accessible to the victim. This occurs because the ExtractOutputPreprocessor does not properly restrict the output filename path. The issue is fixed in version 7.17.2.
Apache Pulsar contains a path traversal vulnerability in its Packages Management Service when using the filesystem storage provider. An authenticated user with package permissions on any namespace can exploit this flaw by manipulating the version component of a package name to access, overwrite, or delete packages in other tenants or namespaces. This can impact the integrity and availability of Pulsar Functions, Sources, or Sinks. The vulnerability affects deployments with package management enabled and the filesystem storage provider configured. It impacts Apache Pulsar versions from 2.10.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions are 4.0.14 and 4.2.5.
A path traversal vulnerability (CWE-22) in Storybook development server versions from 8.0.0 up to but not including 8.6.19, 9.0.0 up to 9.1.21, 10.0.0 up to 10.6.2, and 11.0.0-alpha.0 up to 11.0.0-alpha.6 allows an attacker on the local network to obtain the WebSocket authentication token. This token can be used to invoke file-writing or testing functionality, potentially leading to code execution if the Vitest addon is installed with an old Vitest version. The issue is fixed in versions 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6.
CVE-2026-92205 is a path traversal vulnerability in the libarchive component of BusyBox version 1.37.0. It allows remote attackers to create arbitrary files by exploiting improper validation of user-supplied paths. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability impacts the integrity of the affected system but does not affect confidentiality or availability directly.
A path traversal vulnerability (CWE-22) exists in djust versions from 0.9.0 up to but not including 1.0.10, 1.1.0 up to 1.1.7, 1.2.0.dev0 up to 1.2.4, and 1.3.0.dev0 up to 1.3.0rc8. The vulnerability occurs in the find_handlers_for_template MCP tool, which accepts an absolute template path and reads files without restricting access to the project or configured template directories. This allows a local MCP client to use the tool as a file existence and readability oracle and extract certain substrings from readable files. The issue is fixed in versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8.
CVE-2026-9827 is a critical vulnerability in the boa formUploadFile functionality of the TOTOLINK X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). It allows an authenticated attacker to perform a specially crafted HTTP request that leads to arbitrary file write and potentially arbitrary code execution via path traversal.
CVE-2026-113719 is a path traversal vulnerability in pypa virtualenv prior to version 21.14.9. It occurs during environment creation when existing package metadata is reused, allowing deletion of files outside the virtual environment if the invoking user has deletion rights. The issue is fixed in version 21.14.9.
CVE-2026-113672 is a critical path traversal vulnerability in Argo CD's repo-server affecting versions from 0.9.0 up to certain fixed releases. The flaw allows crafted .jsonnet files to import files outside the repository root, exposing sensitive files such as service-account tokens and private keys. Attackers with Application get permission can exploit this without needing update, sync, or repository write access. The issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
CVE-2026-105772 is a critical path traversal vulnerability in Google ADK TypeScript (@google/adk) versions 0.4.0 up to but not including 0.6.0. It affects the FileArtifactService component when enabled, allowing remote unauthenticated attackers to read or write files outside the intended artifact storage root by exploiting crafted path traversal sequences in userId or sessionId parameters. Applications using the default InMemoryArtifactService are not affected. The issue is fixed in version 0.6.0 and later.
ApostropheCMS versions prior to 3.7.0 of the import-export module contain a path traversal vulnerability (CWE-22) that allows an authenticated importer to submit a tar entry targeting a directory by bypassing parent-path substring checks. This causes an unhandled filesystem error that can terminate the Node.js process. The issue is fixed in version 3.7.0.
ApostropheCMS versions prior to 4.33.0 and uploadfs versions prior to 1.28.0 contain a path traversal vulnerability (CWE-22) in the uploadfs file storage library. This flaw allows attacker-controlled paths with parent-directory segments to escape the configured upload directory, potentially enabling unauthorized file read, write, or deletion operations on the host filesystem. Exploitation requires the application to expose the vulnerable uploadfs operations to untrusted inputs. The issue is fixed in uploadfs 1.28.0 and ApostropheCMS 4.33.0.
A path traversal vulnerability (CWE-22) exists in vitest versions 4.1.11 up to but not including 4.1.12, and 5.0.0-rc.2 up to but not including 5.0.3. On Windows systems, this flaw allows a client who can reach the Vite dev server to craft a redirect mock with backslash traversal sequences that bypass filesystem restrictions, enabling reading of files outside the intended allowed directory. The issue is fixed in versions 4.1.12 and 5.0.3.
CVE-2026-112947 is a path traversal vulnerability in the Vite development server that allows an attacker to retrieve the first 4 bytes of arbitrary files on disk by sending a request with the query parameter '?vite-wasm-instance'. This occurs because the internal Wasm plugin's load hook reads files without applying server.fs access restrictions. The vulnerability affects Vite versions >=0.2.8 <1.1.0, >=8.2.0 <8.2.4, and >=8.3.0 <8.3.3. It only impacts applications that expose the Vite dev server to the network, run on Node.js or Deno, and have sensitive information in the first 4 bytes of a file. The issue is fixed in versions 1.1.0, 8.2.4, and 8.3.3.
### Summary
The content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references `<path-to-project-root>/etc/hosts`, the content of `/etc/hosts` was possible to be returned.
The content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing `<project-root>/etc/hosts` could make Vite return the host's `/etc/hosts` file.
### Impact
Only apps that meet all of the following conditions are affected:
- explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host))
- contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host
- The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)
- the dev server is not running on Windows
### Details
When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesystem path `/etc/hostname`.
For a later request to `/@fs/etc/hostname`, the raw-filesystem middleware interprets `/etc/hostname` as an absolute path. The access check applies `server.fs.deny`, then accepts paths present in `safeModulePaths` before checking `server.fs.allow`. As a result, the request can return the host file instead of the project file that originally populated `safeModulePaths`.
### PoC
The following example requires Linux with a readable `/etc/hostname`:
```bash
$ mkdir vite-safe-module-path-poc
$ cd vite-safe-module-path-poc
$ npm init -y
$ npm install vite@8.3.1
$ mkdir -p etc
$ echo 'PROJECT-DECOY\n' > etc/hostname
$ echo 'import "./etc/hostname"\n' > main.js
$ npx vite --host 127.0.0.1
```
In another terminal:
```bash
$ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js
200
$ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@fs/etc/hostname
200
$ cmp -s response /etc/hostname && echo 'response matches host file'
response matches host file
```
CVE-2026-92162 is a path traversal vulnerability in Flatpak versions prior to 1.18.1. It affects systems with at least one OCI remote configured, allowing a malicious local user to trick the flatpak-system-helper process into creating root-owned directories and files outside the intended root directory. This vulnerability alone does not lead to privilege escalation but can contribute to local root escalation when combined with other vulnerabilities fixed in version 1.18.1. Systems without OCI remotes configured are not believed to be vulnerable. The issue is patched in Flatpak 1.18.1.
CVE-2026-12660 is a path traversal vulnerability in the IBM MQ Operator's Web Console that allows an authenticated administrator to write files outside the intended directory due to improper path validation. This flaw affects multiple versions of IBM MQ Operator prior to version 3.4.0, where it has been fixed. The vulnerability has a low CVSS score of 2.7 and does not impact confidentiality or availability but may allow limited integrity impact. No known exploits are reported in the wild.
CVE-2026-111053 is a path traversal vulnerability in FOSSBilling versions 0.1.0 through 0.8.6. The unauthenticated api/guest/system/template_exists endpoint improperly handles the file parameter, allowing attackers to submit traversal sequences to check for the existence of arbitrary files or directories on the server. This vulnerability does not disclose file contents. It is fixed in version 0.8.7.