The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline.
KurrentDB version 26.1.0 contains a vulnerability where an authorized user with read access to the $all stream can leverage Secondary Indexing queries to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. This capability is limited by default to administrators. The vulnerability does not allow file writes or exposure of environment variables. The issue is fixed in version 26.1.1.
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassword hashes, to any filesystem path the OFBiz process can write, including a web-served docroot, and to create arbitrary directories or truncate arbitrary existing files at those paths, because the XmlDsDump screen action writes the requested entity data via new FileOutputStream on unvalidated outpath and filename request parameters before the screen's ENTITY_MAINT permission check runs, unlike the equivalent Java service entityExportAll, which enforces both a permission check and a file-path allow-list. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
CVE-2026-97356 is a vulnerability in Apache OFBiz 24.09.07 and earlier that allows an authenticated user with LABEL_MANAGER_VIEW permission to read arbitrary properties and XML files on the server via the fileName parameter in the ViewFile component. This includes access to the JWT signing key, enabling forgery of administrator sessions. The issue is fixed in version 24.09.08.
Node Version Manager (nvm) versions 0.27.0 through 0.40.8 contain a vulnerability where the 'nvm use --delete-prefix' command can cause npm to rewrite arbitrary configuration files chosen by a project's .npmrc file. This can corrupt files such as ~/.bashrc or leave configuration files with insecure permissions, potentially allowing local users on shared machines to modify them. The vulnerability is fixed in version 0.41.0, which prevents a project .npmrc from selecting which config file is edited.
CVE-2026-114425 is a critical vulnerability in SEPPmail Secure Email Gateway (SEG) versions before 15.1.1. It involves external control of file name or path via Large File Transfer (LFT) attachment metadata. An unauthenticated remote sender can exploit this flaw to cause the mail-processing worker, which runs as root, to disclose, move, or delete accessible regular files when LFT is enabled and the message is processed by the affected secure-mail path. This vulnerability is fixed in version 15.1.1.
CVE-2026-92189 is a critical remote code execution vulnerability in Quest Foglight for Databases version 8.2.0. It arises from improper validation of user-supplied file paths in the writeTopologySectionToFile method, allowing unauthenticated attackers to execute arbitrary code with SYSTEM privileges.
CVE-2026-92193 is a vulnerability in Quest Foglight for Databases version 8.2.0 involving improper validation of user-supplied file paths in the FileServlet class. This flaw allows authenticated remote attackers to disclose sensitive information with SYSTEM privileges. The vulnerability is classified under CWE-73 (External Control of File Name or Path).
MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard output instead of a local file. If standard output is captured in a location accessible to that user, this may disclose GridFS content the user cannot read directly. Exploitation requires a higher-privileged operator to retrieve the affected file without an explicit local destination and attacker access to the captured output. This issue affects MongoDB Database Tools from version 3.1.4 through versions before 100.20.1.
Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\SYSTEM privileges.
Two attack vectors have been identified:
*
Improper authorization of configuration checksum updates: The privileged service does not properly validate the authorization of connecting clients when updating the checksum of an OpenVPN configuration. This allows a non-privileged local user to modify an OpenVPN configuration and set a valid checksum without administrator privileges. The modified configuration is subsequently processed with NT AUTHORITY\SYSTEM privileges.
*
Argument injection via proxy settings: The client does not properly validate or sanitize proxy settings before passing them as arguments to OpenVPN. A non-privileged local user can inject additional arguments through the proxy settings, influencing the execution of OpenVPN with NT AUTHORITY\SYSTEM privileges. This attack vector does not require direct communication with the privileged service or modification of the protected OpenVPN configuration.
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0.
CVE-2026-116249 is a path traversal vulnerability in pgAdmin 4 server mode prior to version 9.19. It allows an attacker to specify file paths outside the intended user storage directory, potentially accessing another user's password file, SSL certificates, keys, or SSH tunnel identity files. Additionally, crafted connection parameter names could bypass validation, enabling injection of extra parameters. The issue is fixed in version 9.19 by enforcing path confinement and strict parameter name validation.
Immich versions prior to 3.3.0 contain a path traversal vulnerability in the unauthenticated /predict endpoint of the machine-learning component. This flaw allows an attacker with network access to specify an arbitrary writable path for cache_dir, potentially leading to deletion of attacker-selected directories or modification of files via clear_cache() after model-loading failures. The vulnerability is mitigated by a model-name allowlist that prevents arbitrary model deserialization or code execution. The issue is fixed in version 3.3.0.
CVE-2026-119298 is a vulnerability in croc versions prior to 11.5.2 where the receive-side file-readiness loop improperly trusts sender-controlled basenames starting with 'croc-stdin-'. This allows a remote sender, upon user acceptance of the transfer, to overwrite or truncate existing files or replace them with empty files or symlinks without confirmation. The issue is limited to predictable filenames in the 'croc-stdin-' namespace and does not affect dotfiles or symlink targets outside the receive directory. The vulnerability is fixed in version 11.5.2.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuite.py` admits admin and analyst users and validates the uploaded content as `GCPScoutSuiteJSON`, but passes raw `file.filename` from the multipart header to `save_file_to_directory` in `backend/app/integrations/scoutsuite/services/scoutsuite.py`. The writer combines this filename with `scoutsuite-report` using `os.path.join` without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory. In the reported root-running backend, the researcher demonstrated root-owned writes outside that directory and into the application source directory. This permits host-file overwrite subject to the accepted JSON-content constraint and can disrupt application operation; the demonstrated primitive does not establish unrestricted executable contents or unconditional cross-tenant confidentiality loss. Version 0.1.77 removes caller-controlled filenames from the affected route; unrestricted-content and direct-code-execution claims require separate curator reconciliation.
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.
CVE-2026-118561 is a vulnerability in the Drupal Single Content Sync module that allows external control of file names or paths, leading to a path traversal issue. This affects versions from 0.0.0 up to but not including 1.4.19. The vulnerability has been fixed in version 1.4.19.
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.