Typebot.io versions prior to 3.18.0 contain a vulnerability in the server-side Send Email integration block that allows arbitrary reading of local files on the server. This occurs because the parseAttachments helper accepts local filesystem paths without proper validation, enabling any registered user to send email attachments containing sensitive server files. The vulnerability does not require administrative privileges or victim interaction and can expose secrets such as credential encryption keys and database connection strings. The issue is fixed in version 3.18.0.
CVE-2026-55609 is a vulnerability in the ruvnet sublinear-time-solver Rust and WebAssembly library. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, certain tools improperly handle attacker-controlled file path parameters, allowing external control of file names or paths. This flaw enables an attacker with access to the MCP tools to read, write, or overwrite any file accessible to the server process, impacting confidentiality, integrity, and potentially causing service disruption. The issue is fixed in consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0.
CVE-2026-19913 is a local file disclosure vulnerability in the Kaltura HTML5 Video Player's html5lib library. It arises from improper validation of the ServiceUrl parameter in mwEmbedLoader.php, which accepts non-HTTP schemes like file://. This flaw allows an unauthenticated remote attacker to read arbitrary internal files on the server by triggering an error that reflects file contents in the response. The vulnerability affects html5lib versions 2.45, 2.103, and earlier 2.x releases exposing the vulnerable endpoint.
CVE-2026-55527 is a path traversal vulnerability in MervinPraison PraisonAI affecting versions prior to 1.6.58. The issue arises because the FileMemory constructor joins an unsanitized user_id into a file path, allowing an attacker to escape the intended directory and write JSON data to arbitrary writable locations. This vulnerability is fixed in version 1.6.58.
CVE-2026-77139 is a path traversal vulnerability in the TYPO3 extension "Mask" that allows an authenticated backend user with access to the Mask module to create or delete .html files outside the intended template directory by supplying crafted template element keys. This occurs because the extension does not properly validate client-supplied keys before using them to build file paths. The vulnerability affects certain versions of the Mask extension prior to 9.0.11 and 8.3.12. The CVSS 4.0 score is 6.0, indicating a medium severity.
Recce versions prior to 1.50.0 have a vulnerability allowing unauthenticated attackers on untrusted networks to execute SQL queries via the query run API. When configured with DuckDB, attackers can exploit filesystem primitives to read and write files accessible to the Recce server process, potentially leading to local file disclosure, tampering with artifacts, stored XSS, or modification of application files. If run as root, these actions occur with root privileges. This issue is patched in version 1.50.0.
CVE-2026-64679 is a path traversal vulnerability in the Atlantis application, a self-hosted Go service for Terraform pull request automation. Versions from 0.19.8 up to but not including 0.45.0 improperly validate user-controlled workspace names, allowing directory traversal outside intended workspace directories. This can lead to unauthorized filesystem operations such as creating or deleting directories with the privileges of the Atlantis process, potentially causing integrity loss or denial of service. The issue is fixed in version 0.45.0.
Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot` confinement; `metadata.yaml` was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.
Incus, a system container and virtual machine manager, has a critical vulnerability (CVE-2026-48753) in its S3 protocol upload endpoint prior to version 7.1.0. This flaw allows path traversal, enabling attackers to create arbitrary files on the host system, potentially leading to arbitrary command execution. The issue is resolved in version 7.1.0.
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue.
Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue.
CVE-2026-76158 is a critical vulnerability in Datiphy Inc.'s Data Management Center affecting versions 8.3.0 through 8.5.1. It allows remote attackers to write files to arbitrary locations outside the intended upload directory via the upload API endpoint by exploiting external control of file name or path. This can lead to unauthorized file writes on the affected system.
CVE-2026-16926 is a critical vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves improper neutralization of special elements in input, which could allow a remote attacker to overwrite arbitrary files. This vulnerability has a high CVSS score of 9.1, indicating a severe impact on integrity and availability without requiring privileges or user interaction.
CVE-2025-36398 is a medium severity vulnerability in IBM System Storage DS8A00 and DS8900F products. It allows an authenticated user to read or modify another user's command history due to an externally controlled filename. The affected versions include DS8A00 from 10.1.3.0 through 10.11.35.0 and DS8900F from 89.40.83.0 through 89.44.25.0. The vulnerability is related to CWE-73 (External Control of File Name or Path). No patch or remediation information is provided in the available data.
CVE-2026-49441 is a critical vulnerability in Wazuh versions from 4.3.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta3. It involves improper validation of a peer-controlled file path in the cluster master component, allowing a cluster peer with the shared Fernet key to upload crafted archives that overwrite sensitive files such as ossec.conf. This can lead to arbitrary code execution after a service reload. The issue is fixed in versions 4.14.6 and 5.0.0-beta3.
CVE-2026-48162 is a critical vulnerability in Wazuh versions from 4.0.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta3. The flaw exists in the DistributedAPI.send_tmp_file() function, which improperly handles an attacker-controlled file path without canonicalization or confinement. This allows a cluster peer with the shared Fernet key to perform path traversal or use absolute paths to read arbitrary files on the master node. Exploiting this, an attacker can read the private_key.pem file, enabling offline forging of administrator REST API tokens and gaining administrative privileges without an account. The issue is fixed in versions 4.14.6 and 5.0.0-beta3.
CVE-2026-53451 is a critical path traversal vulnerability in sgoudelis ground-station prior to version 0.4.13. It allows unauthenticated attackers to write arbitrary files outside the intended directory by exploiting improper pathname limitation in a Socket.IO command. This can lead to remote code execution with service privileges via crafted logging configuration files, and may cause persistent service crashes. The issue is fixed in version 0.4.13.
CVE-2026-52875 is a path traversal vulnerability in the Streambert Electron desktop app prior to version 2.6.0. The issue arises from the perform-scheduled-backup IPC handler accepting a renderer-supplied path without verifying it is within an authorized backup directory. This allows a compromised renderer process to create or delete files outside the intended backup location. The vulnerability is fixed in version 2.6.0.