CWE-22: Path Traversal vulnerabilities

The Motors – Car Dealership & Classified Listings Plugin for WordPress has a path traversal vulnerability allowing authenticated users with Subscriber-level access or higher to delete image files belonging to other users within the uploads directory. This occurs because the plugin writes an attacker-controlled file path to user meta without proper ownership or capability checks. The vulnerability affects all versions up to and including 1.4.128. The attack surface is limited to image files within the uploads directory, preventing deletion of critical files outside this scope.

CVE-2026-57565 is a path traversal vulnerability in the Readest ebook reader prior to version 0.11.10. The flaw allows an authenticated attacker to craft a file name that includes path traversal sequences, enabling them to overwrite or poison another user's stored book object and corrupt associated metadata. This occurs due to improper validation of file names and URL normalization in the R2 backend. The issue is fixed in version 0.11.10.

CVE-2026-57567 is a path traversal vulnerability in the readest ebook reader affecting desktop Tauri builds prior to version 0.11.10. The flaw allows JavaScript running in the privileged application origin to read or write arbitrary files on the filesystem by exploiting insufficient validation of file paths in the download_file and upload_file commands. This can lead to exposure of sensitive data such as keys and tokens, or overwriting of trusted files. The issue is fixed in readest version 0.11.10.

CVE-2026-16725 is a path traversal vulnerability in IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0. This flaw allows a remote authenticated attacker to read arbitrary files on the local filesystem. The vulnerability does not require user interaction and impacts confidentiality but not integrity or availability.

CVE-2026-76806 is a path traversal vulnerability in the open-source time-tracking app solidtime prior to version 0.16.0. The vulnerability arises from improper validation of project ID values read from uploaded ZIP imports, allowing directory traversal outside the intended temporary sandbox. This can lead to creation of directories at arbitrary writable host paths and disclosure of host filesystem layout information. The flaw affects any registered user able to create an organization and perform a specific import API call. The issue is fixed in version 0.16.0.

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.

A path traversal vulnerability (CWE-22) exists in TÜBİTAK BİLGEM Software Technologies Research Institute's İmzager software versions from 2.10.5 up to but not including 2.10.7. This flaw allows unauthorized path traversal, potentially leading to limited integrity impact. The issue is fixed in version 2.10.7.

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.

CVE-2026-92197 is a high-severity path traversal vulnerability in Quest Foglight for Databases version 8.2.0. It exists in the unzipFile method due to improper validation of user-supplied paths, allowing authenticated remote attackers to execute arbitrary code with SYSTEM privileges.

CVE-2026-92186 is a high-severity path traversal vulnerability in Quest Foglight for Databases version 8.2.0. It exists in the paFnUploadFileAndCreateInfo script due to improper validation of user-supplied file paths. Exploitation requires authentication and can lead to remote code execution with SYSTEM privileges.

CVE-2026-92194 is a high-severity path traversal vulnerability in Quest Foglight for Databases version 8.2.0. It affects the loadManageServerLicense script, which fails to properly validate user-supplied paths before file operations. Exploitation requires authentication and allows remote attackers to execute arbitrary code with SYSTEM privileges.

CVE-2026-92195 is a high-severity path traversal vulnerability in Quest Foglight for Databases version 8.2.0. It affects the loadEvolveLicense script, which improperly validates user-supplied paths, allowing authenticated remote attackers to execute arbitrary code with SYSTEM privileges.

CVE-2026-92192 is a high-severity path traversal vulnerability in Quest Foglight for Databases version 8.2.0. It affects the installLicense script, allowing authenticated remote attackers to execute arbitrary code with SYSTEM privileges by exploiting improper validation of user-supplied paths in file operations.

CVE-2026-92187 is a high-severity path traversal vulnerability in Quest Foglight for Databases version 8.2.0. It affects the extractAndCreateUploadInfoList method, which fails to properly validate user-supplied paths before file operations. Exploitation requires authentication and can lead to remote code execution with SYSTEM privileges.

CGI versions prior to 5.00 for Perl have a path traversal vulnerability where uploaded filenames are returned with any client-supplied path, including directory traversal sequences like ../ and Windows paths. This allows an attacker to cause the application to write files outside the intended directory if it saves uploads using the provided filename parameter without validation.

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working directory's basename as a prefix can skip the filesystem entitlement check. Exploitation requires specific matching filenames next to the current project directory. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.

A path traversal vulnerability (CWE-22) exists in isomorphic-git versions prior to 1.38.6. The issue occurs during git.checkout operations where symlinked leading directory components are not properly checked, allowing writes outside the intended working tree on Linux or macOS. This can lead to arbitrary file writes and potential code execution on the host. The vulnerability is fixed in version 1.38.6.

A path traversal vulnerability (CWE-22) exists in isomorphic-git versions prior to 1.38.6. The tree parser in src/models/GitTree.js improperly accepts standalone '..' entries, allowing malicious remote repositories to write files outside the working directory during clone or checkout operations. This can lead to arbitrary file overwrite and potential code execution. The issue is fixed in version 1.38.6. GitHub-hosted repositories are not affected due to their integrity checks rejecting '..' entries.

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1.