zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.
CVE-2026-116635 is a relative path traversal vulnerability in the AWS Serverless MCP Server (aws-serverless-mcp-server) before version 0.2.1. It allows an attacker who can influence the MCP agent to read JSON files outside the intended deployment status directory and, if write access is enabled, to create or overwrite JSON files outside that directory. The vulnerability arises from improper limitation of pathname inputs, which can be exploited using directory traversal sequences or absolute paths in the project name input. AWS has released version 0.2.1 to address this issue.
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.
sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In `src/util/decompress.rs`, `decompress_impl` computes each destination with `dest.join(entry.name())` without normalizing the archive's UTF-16 entry name or verifying containment, and `default_entry_extract_fn` writes to it with `File::create`. Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points `decompress`, `decompress_file`, `decompress_with_password`, and `decompress_file_with_password` all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence. The archive bytes are the attacker-controlled trust boundary, including for applications that automatically unpack uploaded or otherwise untrusted archives. This issue is fixed in version 0.21.1.
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and certain LTS releases contain a Relative Path Traversal vulnerability in the certificate handling. This flaw allows a high privileged attacker with remote access to potentially cause a denial of service condition. The vulnerability is identified as CWE-23 and has a CVSS 3.1 score of 6.5, indicating medium severity. Fixed versions are available starting from 7.13.1.80, 8.3.1.40, 8.6.1.20, and 8.9.0.0 respectively for the affected release lines.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain a Relative Path Traversal vulnerability (CWE-23). This flaw allows a high privileged attacker with remote access to potentially tamper with information. The vulnerability has a low CVSS score of 3.8 and does not impact confidentiality but affects integrity and availability. Fixed versions are available starting from 8.9.0.0 and specific LTS patch versions.
Two vulnerabilities were found in the open-source tool projen affecting versions before 0.101.37 and 0.103.0. CVE-2026-89065 is a relative path traversal vulnerability that may allow deletion of files outside the project directory. CVE-2026-89066 is an OS command injection vulnerability that could enable arbitrary command execution on developer workstations or CI runners. Fixes are available in versions 0.101.37 and 0.103.0 respectively. Users should upgrade and re-synthesize projects for CVE-2026-89066 to ensure safe task definitions.
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.
Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
CVE-2026-114714 is a path traversal vulnerability in the squirrelmail_usercopy plugin of Roundcube Webmail versions before 1.6.20 and 1.7.5. The flaw allows a specially crafted login name containing a slash to cause files outside the intended data directory to be read and imported. This issue was fixed by rejecting login names with slashes in versions 1.6.20 and 1.7.5.
CVE-2026-111093 is a path traversal vulnerability in JetBrains Datalore versions before 2026.2.1. It allows unauthenticated attackers to read arbitrary files via the report blob endpoint. The vulnerability has a high severity with a CVSS score of 7.5, indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality only.
CVE-2026-103508 is a relative path traversal vulnerability in Perforce P4 Search (Helix core) that affects versions up to 2026.4.2. An authenticated user with administrative privileges on the connected P4 Server can supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. The issue is resolved in version 2026.4.3.
CVE-2026-41545 is a relative path traversal vulnerability in QNAP Systems Inc.'s QuMagie product. An attacker with administrator privileges can exploit this flaw to read unauthorized files or system data. The vulnerability has been fixed in QuMagie version 2.9.1 and later.
CVE-2026-39993 is a relative path traversal vulnerability in QNAP Systems Inc.'s Download Station. An attacker with a user account can exploit this flaw to read unauthorized files or system data. The vulnerability has been fixed in Download Station versions 5.10.2.313 and later, and 5.11.3.322 and later.
CVE-2026-83923 is a high-severity vulnerability in Microsoft Windows 10 Version 1809 involving a relative path traversal flaw in OpenSSH for Windows. This flaw allows an unauthorized attacker to execute code remotely over a network. Multiple Windows 10 builds are affected, with official fixes released in specific versions. The vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability.
CVE-2026-83873 is a relative path traversal vulnerability in the Windows Shell component of Microsoft Windows 10 Version 1607 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity with a CVSS score of 7.8. Microsoft has released official fixes for multiple affected versions to address this issue.
CVE-2026-70222 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds that involves a relative path traversal flaw in the Windows Shell. This vulnerability allows an authorized local attacker to elevate privileges by exploiting improper handling of file paths. The issue affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this vulnerability.
CVE-2026-83865 is a relative path traversal vulnerability in the Windows Internet component (wininet.dll) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to perform tampering by exploiting the path traversal issue. The vulnerability has a medium severity score of 4.7 and has been officially fixed in several Windows 10 builds.
CVE-2026-69968 is a relative path traversal vulnerability in the Windows Libarchive component affecting multiple builds of Windows 10 Version 1809 and related branches. This flaw allows an unauthorized attacker to perform tampering over a network. The vulnerability has a medium severity rating with a CVSS score of 6.5. Microsoft has issued official fixes for all affected versions.
Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could access file paths outside the intended directory and use observable application responses to determine whether files exist on the host system.