CVE-2026-52872 is a path traversal vulnerability in Streambert, a cross-platform Electron desktop app for streaming and downloading video content. Versions prior to 2.5.0 have a flaw in the downloadSubtitleFile utility where a renderer process can supply a file URI and control the destination path, allowing arbitrary file copying. This can lead to exposure of sensitive local files and overwriting of writable files. The vulnerability is fixed in version 2.5.0.
CVE-2026-48798 is a path traversal vulnerability in SSH.NET versions prior to 2026.0.0. The ScpClient.Download method improperly trusts file and directory names returned by a remote SCP server, allowing an attacker controlling or intercepting the server to craft paths that can overwrite or create files outside the intended directory. This can lead to arbitrary file write by the client process. The issue is fixed in version 2026.0.0.
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.
Progress ShareFile Storage Zones Controller versions 5.12.5 and earlier contain a path traversal vulnerability in the resumable upload initiation endpoint. An authenticated user with valid zone credentials can exploit this flaw to write arbitrary files to locations writable by the application's service account. This can lead to execution of attacker-supplied code, posing a significant security risk.
CVE-2026-16139 is a path traversal vulnerability in Progress ShareFile Storage Zones Controller versions up to 5.12.5 and 6.0.2. An authenticated zone administrator can exploit improper validation in the download preparation process to write files outside the intended directory. This vulnerability can lead to remote code execution in version 5.x, while remote code execution is not confirmed for version 6.x.
CVE-2026-16987 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper validation of the LANG environment variable, which could allow a local attacker to gain elevated privileges. The vulnerability is classified under CWE-73, indicating external control of file name or path. No official patch or remediation information is currently available.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability that allows a local authenticated attacker to change the ownership of arbitrary files. This occurs due to improper validation of an attacker-controlled file path, potentially leading to high impact on confidentiality, integrity, and availability.
compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for.
to_pdf reads the generated PDF back from its path argument, and _style_tag_for reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe ("| cmd", "cmd |") is run as a command rather than opened as a file, and one that begins with a redirect ("> path", ">> path") opens that path for write or append. to_file forwards its path argument to to_pdf and reaches the same read.
Any caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the "cmd |" form the command's output is returned in place of the PDF, and with the "> path" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.