Threats Tagged 'cwe-23'

The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files.

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto temp_dst/.git/logs/, allowing a malicious server to make GitHacker read an arbitrary local file when a victim runs the tool against the server's URL. add_hashes_parsed then scans the file for 40-character hexadecimal substrings and requests each match through .git/objects using the first two characters and remaining characters as path components, creating an attacker-observable existence oracle and disclosing matching hexadecimal fragments. Complete file contents are not returned, and the add_folder and add_task write path in shipped version 1.1.7 does not permit an escape. This issue is fixed in repository version 1.1.9.

Two vulnerabilities were identified in the open-source tool projen affecting versions before 0.101.37 and 0.103.0. CVE-2026-89065 is a relative path traversal issue in the generated file manifest cleanup component that may allow attackers to delete files outside the project directory. CVE-2026-89066 is an OS command injection vulnerability in the task synthesis component that could enable arbitrary command execution on developer workstations or CI runners via shell metacharacters in project configuration or repository file names. Fixes are available in projen versions 0.101.37 and 0.103.0 respectively. Users must upgrade and, for CVE-2026-89066, re-synthesize their projects to regenerate safe task definitions.

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this. Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.

CVE-2026-15913 is a path traversal vulnerability in Fortra GoAnywhere MFT versions prior to 7.10.2. It affects the /attachRemoteFiles endpoint, allowing authenticated web users with Secure Folders and Secure Mail permissions to escape their sandboxed home directory and read arbitrary files. This vulnerability has a high severity score of 7.7 and impacts confidentiality but not integrity or availability.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker.

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files.

CVE-2026-47680 is a medium severity vulnerability in fluxcd source-controller versions 0.0.17 through 1.8.4. It allows an attacker who can influence a referenced bucket to cause the source-controller to write files outside its intended working directory. Additionally, from version 1.6.0 onward, a user with permission to create or update GitRepository resources can enumerate file paths on the controller pod via the sparse-checkout feature. The vulnerability was fixed in version 1.8.5. No in-product workaround exists, but admission policies can mitigate some attack vectors.

Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally.