Threats Tagged 'cwe-29'

CVE-2026-66152 is a path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component. This flaw allows an attacker to write arbitrary files with root privileges by exploiting improper handling of file paths. The vulnerability affects versions 10.3.5 and earlier. It has a high severity with a CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.

CVE-2026-66152 is a path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component. This flaw allows an attacker to write arbitrary files with root privileges by exploiting improper handling of file paths. The vulnerability has a high severity score of 8.8 and impacts confidentiality, integrity, and availability. No affected versions or patch information are provided in the available data.

NVIDIA BioNeMo Core for Linux has a path traversal vulnerability (CWE-29) that allows a user to load a malicious file using a crafted path such as '\.. \filename'. Exploiting this vulnerability could lead to code execution, denial of service, information disclosure, and data tampering. The vulnerability has a high severity with a CVSS score of 8.8. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-5627 is a critical path traversal vulnerability in mintplex-labs/anything-llm up to version 1.9.1, specifically in the AgentFlows component. It allows attackers with high privileges to bypass directory restrictions via crafted input to loadFlow and deleteFlow methods, potentially accessing or deleting arbitrary JSON files on the server. This can lead to disclosure of sensitive configuration files containing API keys or denial of service by deleting important files like package.json. The vulnerability is fixed in version 1.12.1. No official patch link or advisory is provided in the data, and no known exploits are reported in the wild.

A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox directory in multi-tenant or shared cluster environments.

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. This issue has been patched in version 4.6.2.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-30828#cwe-29

CVE-2025-66608 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw stems from improper URL validation, allowing an unauthenticated attacker to send specially crafted requests to the web server and steal files. This vulnerability does not require user interaction or privileges, making it remotely exploitable over the network. The CVSS 4.0 base score is 8.7, indicating a significant risk to confidentiality without impacting integrity or availability. No known exploits are currently reported in the wild. European organizations using FAST/TOOLS in critical industrial control or SCADA environments could face data breaches and operational risks.

HighVulnerabilityGermanyFranceItaly+5#cve#cve-2025-66608#cwe-29

A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifically within the `name` parameter of the `@router.post("/reinstall_extension")` route. This vulnerability allows attackers to inject a malicious `name` parameter, leading to the server loading and executing arbitrary Python files from the upload directory for discussions. This issue arises due to the concatenation of `data.name` directly with `lollmsElfServer.lollms_paths.extensions_zoo_path` and its use as an argument for `ExtensionBuilder().build_extension()`. The server's handling of the `__init__.py` file in arbitrary locations, facilitated by `importlib.machinery.SourceFileLoader`, enables the execution of arbitrary code, such as command execution or creating a reverse-shell connection. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to Remote Code Execution (RCE) when the application is exposed to an external endpoint or the UI, especially when bound to `0.0.0.0` or in `headless mode`. No user interaction is required for exploitation.

CriticalVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2024-2356#cwe-29

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

LowVulnerabilityGermanyFranceItaly+2#cve#cve-2025-58291#cwe-29

A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utils.py`. This vulnerability allows an attacker to manipulate the `image_path` input to read arbitrary files on the server, including sensitive system files. The issue arises due to improper validation or sanitization of the file path, enabling path traversal sequences to access files outside the intended directory. The vulnerability is fixed in version 0.12.41.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-6209#cwe-29