CWE-22: Path Traversal vulnerabilities

CVE-2026-57496 is a critical path traversal vulnerability in Labs64 NetLicensing-MCP versions prior to 0.1.8. It allows an authenticated MCP client with a non-administrative API key to exploit improper pathname validation and access plaintext token values. This can lead to recovery of an administrative token, granting broad read, write, and delete access to the NetLicensing account. The issue is fixed in version 0.1.8.

CVE-2026-61702 is a directory traversal vulnerability in OpenPrinting CUPS prior to version 2.4.20. It allows an attacker to manipulate the pathname used when processing job-sheet banners, potentially causing the scheduler to read arbitrary files accessible via symlinks and copy their contents into job-sheet spool objects. This could expose file contents to an attacker-observable endpoint. The issue is fixed in version 2.4.20.

CVE-2026-62679 is a path traversal vulnerability in Lychee, a photo-management tool, affecting versions prior to 7.6.4. Under a specific non-default configuration, authenticated users can exploit improper pathname limitation to read files accessible to the web process, including sensitive application configuration and other users' private images. The vulnerability is fixed in version 7.6.4.

A path traversal vulnerability (CWE-22) exists in OPNsense core prior to version 26.1.11. The OpenVPN Client Specific Override common_name field improperly accepts path traversal sequences, allowing an authenticated user with Client Specific Override privileges to cause OpenVPN configuration files to be written outside the intended directory. This occurs because the value is concatenated into a file path without normalization or basename checks. Exploitation requires triggering a matching OpenVPN client-connect or authentication event. The vulnerability is fixed in version 26.1.11.

CVE-2026-57155 is a critical path traversal vulnerability in the OPNsense core firewall and routing platform prior to version 26.1.11. It arises from improper validation of a CSV country_code value used in constructing output filenames during GeoIP alias imports. An attacker with Firewall Alias Edit privileges can exploit this to write arbitrary files as root, potentially leading to full firewall compromise via cron job execution. The issue is fixed in version 26.1.11.

CVE-2026-110746 is a local privilege escalation vulnerability in TotalAV by TotalSecurity. It involves improper limitation of a pathname to a restricted directory (path traversal), allowing an unprivileged local user to forge the gRPC IPC authentication token by loading IPC.dll. This abuse of the SYSTEM service within TotalAV enables execution of arbitrary code with NT AUTHORITY\SYSTEM privileges. The vulnerability affects versions from 0 up to and including 7.1.17. It has a high severity with a CVSS score of 7.8.

CVE-2026-50619 is a critical path traversal vulnerability in QNAP Systems Inc.'s Qsirch product. This flaw allows remote attackers to read arbitrary files or system data outside the intended directories. The vulnerability affects Qsirch versions from 7.0.0 up to but not including 7.0.3.0. It has been fixed in version 7.0.3.0 and later.

CVE-2026-34015 is a path traversal vulnerability in QNAP Systems Inc. Video Station that allows a remote attacker with a user account to read unexpected files or system data. The vulnerability is fixed in Video Station version 5.8.8 and later. Versions from 5.8.x up to but not including 5.8.8 are affected. The CVSS 4.0 score is 8.7, indicating high severity.

CVE-2026-26243 is a path traversal vulnerability in QNAP Systems Inc.'s Qsync Central. A remote attacker with a user account can exploit this flaw to read unauthorized files or system data. The vulnerability has been fixed in versions 5.0.0.6 and later, 5.1.0.2 and later, and 5.2.0.4 and later. The CVSS 4.0 score is 7.2, indicating high severity.

CVE-2026-41544 is a path traversal vulnerability in QNAP Systems Inc.'s QcalAgent. A remote attacker with a user account can exploit this flaw to read files or system data that should be inaccessible. The vulnerability is fixed in QcalAgent version 1.1.10 and later.

CVE-2026-24718 is a path traversal vulnerability in QNAP Systems Inc.'s Qsync Central. A remote attacker with a user account can exploit this flaw to read unexpected files or system data. The vulnerability has been fixed in Qsync Central versions 5.0.0.7 and later, 5.1.0.3 and later, 5.2.0.5 and later, and 5.3.0.2 and later.

CVE-2025-66275 is a path traversal vulnerability in QNAP Systems Inc.'s Video Station. An attacker with a user account can exploit this flaw to read unauthorized files or system data. The vulnerability is fixed in Video Station version 5.8.5 and later.

CVE-2025-66272 is a path traversal vulnerability in QNAP Systems Inc.'s Video Station. A remote attacker with a user account can exploit this flaw to read unauthorized files or system data. The issue is fixed in Video Station version 5.8.5 and later.

FileRise 3.22.0 contains a path traversal vulnerability in the /api/file/saveFile.php endpoint. Authenticated users with inherited edit permissions and a valid CSRF token can exploit this flaw to create files outside authorized directories by using dot and dot-dot path segments. The issue arises because the application evaluates uncanonicalized folder input before access control checks and improperly validates directory containment. This vulnerability is fixed in version 3.23.0.

CVE-2026-0312 is a path traversal vulnerability in Palo Alto Networks Checkov by Prisma Cloud that allows an unauthenticated local user to write files to arbitrary locations on the scanning filesystem. This vulnerability affects versions from 0 up to but not including 3.3.25. The CVSS 4.0 base score is 4.3, indicating a medium severity issue. There is no indication of known exploits in the wild. The vulnerability requires local access and user interaction, with limited impact on confidentiality and availability.

CVE-2026-62664 is a path traversal vulnerability in FileRise, a self-hosted web-based file manager. Versions prior to 3.19.0 do not properly reject dot-dot path segments in folder creation requests, allowing authenticated low-privileged users with appropriate permissions to create directories outside the intended upload directory. This can lead to unauthorized directory creation wherever the web server account has write access. The issue is fixed in FileRise version 3.19.0.

A path traversal vulnerability exists in dbt-labs dbt-core versions from 2.0.0-alpha.0 up to but not including 2.0.0-alpha.5. The dbt docs serve component exposes an unauthenticated POST /api/v1/query endpoint that allows clients to execute SQL queries via DuckDbViewsBackend without authorization or an allowlist. This enables reading of arbitrary files accessible to the dbt process, including files outside the intended docs index directory. The server binds to localhost by default but can be exposed to a network, increasing risk. The issue is fixed in version 2.0.0-alpha.5.

CVE-2026-104103 is a path traversal vulnerability in ludwig-ai's ludwig framework prior to version 0.17.8. The flaw exists in the extract_archive() function, which improperly validates symlink and hard-link members in tar archives, allowing crafted archives to write files outside the intended extraction directory. This can lead to attacker-controlled content being placed at arbitrary filesystem paths with the privileges of the extracting process. The issue affects Python 3.12 and 3.13 runtimes but not Python 3.14, which rejects such escaping links by default. The vulnerability is fixed in version 0.17.8.

CVE-2026-92153 is a path traversal vulnerability in NASA's F Prime (fprime) framework prior to version 4.3.0. The vulnerability arises from improper handling of file upload destination paths in the Svc::FileUplink component, which does not canonicalize or restrict paths. This allows an attacker able to send file-uplink packets to create or overwrite files at arbitrary writable filesystem locations, impacting integrity and potentially availability. The issue is fixed in version 4.3.0.

Dell Unisphere for PowerMax vApp version 9.2.4.x contains a path traversal vulnerability (CWE-22) that allows a low privileged remote attacker to access restricted directories, potentially leading to information disclosure. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity). No patch or remediation information is currently provided by the vendor.