CWE-23 vulnerabilities

Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.

CVE-2026-34926 is a directory traversal vulnerability in the on-premise version of Trend Micro's TrendAI Apex One server. It allows a pre-authenticated local attacker with administrative credentials on the server to modify a key table, potentially injecting malicious code that could be deployed to agents. Exploitation requires prior administrative access to the Apex One server and is limited to the on-premise deployment. The vulnerability has a CVSS score of 6.7, indicating medium severity. No official patch or remediation information is currently available, and no known exploits are reported in the wild.

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.

The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin up to version 6.0.6 contains a relative path traversal vulnerability in its 'downloadZIP' function. This flaw allows unauthenticated attackers to read and delete arbitrary files within the WordPress uploads base directory due to insufficient file path validation and missing capability checks. The vulnerability is tracked as CVE-2026-8073 and has a high severity rating with a CVSS score of 7.5. There is no confirmed patch or official remediation available at this time.

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.

Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.

CVE-2026-41551 is a critical relative path traversal vulnerability in Siemens ROS# versions prior to 2.2.2. The issue arises from improper sanitization of user input, allowing remote attackers to access arbitrary files on affected devices. The vulnerability has a high CVSS score of 9.1, indicating significant confidentiality and integrity impact without requiring privileges or user interaction. No official patch or remediation guidance is currently confirmed from the vendor. There are no known exploits in the wild at this time.

Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges. Exploitation could result in loss of availability of the web application.

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

OpenClaw versions before 2026.4.10 have a relative path traversal vulnerability in QQBot media tags. This flaw allows attackers to read arbitrary local files outside the intended media storage area by crafting malicious reply text containing specially designed media tags. The vulnerability can lead to unauthorized disclosure of sensitive local files.

Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by crafting malicious archive entries with relative traversal sequences or absolute paths. Attackers can exploit insufficient path normalization during archive extraction to write files outside the intended extraction directory and achieve persistent code execution by overwriting user startup scripts.

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.

ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.

ThreatSonar Anti-Ransomware developed by TeamT5 has an Arbitrary File Deletion vulnerability. Authenticated remote attackers with web access can exploit Path Traversal to delete arbitrary files on the system.

Anviz CX7 Firmware is vulnerable to an authenticated CSV upload which allows path traversal to overwrite arbitrary files (e.g., /etc/shadow), enabling unauthorized SSH access when combined with debug‑setting changes.

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses ".." path components instead of rejecting them. As a result, an attacker can use parent-directory traversal in the scope claim to broaden the effective authorization beyond the intended directory. This issue has been patched in version 1.4.1.

CVE-2026-4415 is a critical vulnerability in GIGABYTE's Gigabyte Control Center that allows unauthenticated remote attackers to write arbitrary files to any location on the operating system when the pairing feature is enabled. This arbitrary file write can lead to arbitrary code execution or privilege escalation. The vulnerability is classified as a relative path traversal (CWE-23). It has a high CVSS 4.0 score of 9.2, indicating a severe risk. No official patch or remediation information is currently provided. There are no known exploits in the wild at this time.

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a path traversal vulnerability exists in Calibre' handling of images in Markdown and other similar text-based files allowing an attacker to include arbitrary files from the file system into the converted book. Additionally, missing authentication and server-side request forgery in the background-image endpoint in the ebook reader web view allow the files to be exfiltrated without additional interaction. Version 9.6.0 contains a fix.

ORY Oathkeeper versions prior to 26.2.0 are affected by a critical authorization bypass vulnerability due to relative path traversal (CWE-23). The issue arises because the software uses the raw, un-normalized HTTP request path for access rule evaluation, allowing crafted URLs with path traversal sequences to bypass intended access controls. This vulnerability has a CVSS score of 10.0, indicating critical severity. Version 26.2.0 includes a patch that addresses this flaw.