Threats tagged 'cwe-26'

Vvveb CMS versions 1.0.8.6 and earlier contain a path traversal vulnerability in the backup controller's nextRestore() and nextBackup() functions. These functions accept a file parameter that is concatenated to the backup directory path without proper sanitization, allowing an authenticated administrator to read arbitrary files or write SQL dump content to arbitrary locations. This flaw contrasts with other related functions that correctly sanitize file names. The issue has been patched in a subsequent commit.

The Super Forms – Drag & Drop Form Builder WordPress plugin is affected by a critical directory traversal vulnerability (CVE-2026-15896) in all versions up to 6.3.316. This flaw allows unauthenticated attackers to read arbitrary files on the server via the parse_request function. By default, no authentication is required to exploit this, though enabling the optional 'file_upload_auth' setting can mitigate unauthenticated access but does not fix the underlying vulnerability. Exploitation conditions differ between Linux and Windows environments but are generally feasible when file upload is enabled.

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the `GET /api/sftp/uploadFiles` endpoint used for directory listing. This allows path traversal through crafted input, enabling access to unintended file system locations.

django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.

NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path traversal vulnerability in the propose_edits endpoint allows unauthenticated users to overwrite files in directories writable by the application user (e.g., /cdn). By supplying unsanitized file keys containing traversal sequences (e.g., ../../) in the JSON payload, an attacker can escape the intended temporary directory and replace public facing images or fill the server's storage. This issue has been patched via commit 86f34c7.

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official implementation, may be affected. This allows the leakage of passwords and users that may be stored on the system. Versions 3.10.3 and 4.0.0-beta.3 contain a patch.