Monthly
Directory traversal in Cloud Commander (coderaiser/cloudcmd) before 19.20.2 lets remote unauthenticated attackers read, write, move, or copy files outside the configured root directory by supplying path-traversal sequences to REST file-operation and markdown endpoints. The root cause is missing path-normalization enforcement before filesystem operations, giving full arbitrary file read/write on the host filesystem. No public exploit identified at time of analysis, but a vendor-released patch (v19.20.2) and a fixing commit with a working url-encoded traversal test case are publicly available, lowering the barrier to reproduction.
Path traversal in IBM Langflow OSS 1.0.0 through 1.11.1 exposes arbitrary server-side files to unauthenticated remote attackers over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity exploitation requiring no credentials or user interaction, with high confidentiality impact limited to file reads - no write or availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated network vector and low attack complexity make internet-facing instances a realistic opportunistic target once details circulate.
Unauthenticated directory traversal in Yamcs versions up to and including 5.8.6 (per advisory scope, < 5.11.13 per package metadata) allows any remote attacker to read arbitrary files from the underlying host operating system by sending a crafted HTTP request. The flaw resides in StaticFileHandler.java, which resolves user-supplied URL paths against a static file root without verifying the resolved path stays within that root - a double-slash prefix (e.g., //etc/passwd) is sufficient to escape the boundary. No public exploit identified at time of analysis, though the steps-to-reproduce are fully published in the GitHub Security Advisory and the vulnerability was demonstrated in a public CTF challenge at DEFCON 33.
Archive symlink traversal in aquaproj/aqua prior to v2.60.1 enables an attacker who controls a tool archive to write arbitrary files outside the extraction directory with the privileges of the user running aqua. The vulnerable combination in `pkg/unarchive/archives.go` - creating a symlink without destination validation, then following it with a regular file write - allows a malicious tar.gz to overwrite files such as shell startup scripts or PATH entries, resulting in user-level code execution. A working PoC is confirmed in GHSA-mf5c-hw34-4hpp; no CISA KEV listing is present and EPSS data is unavailable for this CVE.
Arbitrary file write in BuilderIO gpt-crawler through 1.5.1 allows unauthenticated remote attackers to overwrite any file on the server filesystem by supplying absolute paths or path traversal sequences in the unsanitized `outputFileName` parameter of the POST /crawl endpoint. File content is sourced from attacker-controlled URLs, making this a combined path traversal and server-side fetch primitive capable of depositing web shells, poisoning cron jobs, or corrupting application configs. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 8.8 reflects high integrity impact with no authentication barrier.
Path traversal in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to read arbitrary files from the server filesystem by supplying absolute paths to the Gradio document-parsing interface. The flaw exists in the simple_doc_parser and supporting utility code, which pass caller-controlled paths directly to file-open operations without restricting access to an intended directory. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N) reflects a zero-prerequisite, network-accessible attack surface; no active exploitation is confirmed in CISA KEV and no public POC has been identified at time of analysis.
Path traversal in Duplicacy's restore function through version 3.2.5 allows arbitrary file writes outside the designated restore directory when a user restores from a compromised or attacker-controlled snapshot repository. Duplicacy fails to sanitize file paths deserialized from snapshot entries, so crafted traversal sequences (e.g., '../../') cause files to be written to any location accessible by the restoring OS user. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the integrity and availability impact is rated High in the CVSS 4.0 assessment.
Path traversal in houtini-lm (versions up to 2.13.2) allows an authenticated remote user to supply crafted absolute paths to the code_task_files tool, causing the server to read files outside its intended working directory. Because code_task_files forwards file contents directly to the configured LLM endpoint - which may be a remote provider such as OpenRouter - a successful traversal can silently exfiltrate sensitive files (SSH keys, environment files, cloud credentials) off the machine to a third-party service. No public exploit has been identified and the CVE has not been added to the CISA KEV catalog; an upstream fix is available in commit 35d97bca.
Path traversal in iswalle getnote-mcp up to version 1.5.0 allows attackers with low-privilege MCP call access to read arbitrary files from the host filesystem via the upload_image tool's unsanitized image_path parameter. The vulnerable fs.readFileSync call in src/index.ts accepts absolute paths and directory traversal sequences, and critically, the read file is automatically uploaded to a public CDN - making this an arbitrary file read with built-in exfiltration, exposing SSH keys, /etc/passwd, and similar sensitive data. A public exploit exists (GitHub issue #10) and vendor-released patch version 1.5.1 is confirmed available; no CISA KEV listing has been identified.
Path traversal and trust inheritance flaws in gitoxide's Rust crates gix (≤ 0.72.0) and gix-validate (≤ 0.10.0) allow an attacker who supplies a malicious repository to read arbitrary git configuration files - including embedded credentials - from a victim system. The attack chains three bugs: a first-occurrence-only `find(b"..")` check in submodule name validation that is bypassed by names like `a..b/../../../.git/`, the fact that this validation function is never invoked in production code, and a trust inheritance flaw in `Submodule::open()` that propagates the parent repository's `Trust::Full` to the traversed path while skipping ownership verification entirely. No public exploit has been identified at time of analysis, though a compiled PoC was referenced (truncated) in the GHSA advisory.
Directory traversal in Cloud Commander (coderaiser/cloudcmd) before 19.20.2 lets remote unauthenticated attackers read, write, move, or copy files outside the configured root directory by supplying path-traversal sequences to REST file-operation and markdown endpoints. The root cause is missing path-normalization enforcement before filesystem operations, giving full arbitrary file read/write on the host filesystem. No public exploit identified at time of analysis, but a vendor-released patch (v19.20.2) and a fixing commit with a working url-encoded traversal test case are publicly available, lowering the barrier to reproduction.
Path traversal in IBM Langflow OSS 1.0.0 through 1.11.1 exposes arbitrary server-side files to unauthenticated remote attackers over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity exploitation requiring no credentials or user interaction, with high confidentiality impact limited to file reads - no write or availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated network vector and low attack complexity make internet-facing instances a realistic opportunistic target once details circulate.
Unauthenticated directory traversal in Yamcs versions up to and including 5.8.6 (per advisory scope, < 5.11.13 per package metadata) allows any remote attacker to read arbitrary files from the underlying host operating system by sending a crafted HTTP request. The flaw resides in StaticFileHandler.java, which resolves user-supplied URL paths against a static file root without verifying the resolved path stays within that root - a double-slash prefix (e.g., //etc/passwd) is sufficient to escape the boundary. No public exploit identified at time of analysis, though the steps-to-reproduce are fully published in the GitHub Security Advisory and the vulnerability was demonstrated in a public CTF challenge at DEFCON 33.
Archive symlink traversal in aquaproj/aqua prior to v2.60.1 enables an attacker who controls a tool archive to write arbitrary files outside the extraction directory with the privileges of the user running aqua. The vulnerable combination in `pkg/unarchive/archives.go` - creating a symlink without destination validation, then following it with a regular file write - allows a malicious tar.gz to overwrite files such as shell startup scripts or PATH entries, resulting in user-level code execution. A working PoC is confirmed in GHSA-mf5c-hw34-4hpp; no CISA KEV listing is present and EPSS data is unavailable for this CVE.
Arbitrary file write in BuilderIO gpt-crawler through 1.5.1 allows unauthenticated remote attackers to overwrite any file on the server filesystem by supplying absolute paths or path traversal sequences in the unsanitized `outputFileName` parameter of the POST /crawl endpoint. File content is sourced from attacker-controlled URLs, making this a combined path traversal and server-side fetch primitive capable of depositing web shells, poisoning cron jobs, or corrupting application configs. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 8.8 reflects high integrity impact with no authentication barrier.
Path traversal in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to read arbitrary files from the server filesystem by supplying absolute paths to the Gradio document-parsing interface. The flaw exists in the simple_doc_parser and supporting utility code, which pass caller-controlled paths directly to file-open operations without restricting access to an intended directory. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N) reflects a zero-prerequisite, network-accessible attack surface; no active exploitation is confirmed in CISA KEV and no public POC has been identified at time of analysis.
Path traversal in Duplicacy's restore function through version 3.2.5 allows arbitrary file writes outside the designated restore directory when a user restores from a compromised or attacker-controlled snapshot repository. Duplicacy fails to sanitize file paths deserialized from snapshot entries, so crafted traversal sequences (e.g., '../../') cause files to be written to any location accessible by the restoring OS user. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the integrity and availability impact is rated High in the CVSS 4.0 assessment.
Path traversal in houtini-lm (versions up to 2.13.2) allows an authenticated remote user to supply crafted absolute paths to the code_task_files tool, causing the server to read files outside its intended working directory. Because code_task_files forwards file contents directly to the configured LLM endpoint - which may be a remote provider such as OpenRouter - a successful traversal can silently exfiltrate sensitive files (SSH keys, environment files, cloud credentials) off the machine to a third-party service. No public exploit has been identified and the CVE has not been added to the CISA KEV catalog; an upstream fix is available in commit 35d97bca.
Path traversal in iswalle getnote-mcp up to version 1.5.0 allows attackers with low-privilege MCP call access to read arbitrary files from the host filesystem via the upload_image tool's unsanitized image_path parameter. The vulnerable fs.readFileSync call in src/index.ts accepts absolute paths and directory traversal sequences, and critically, the read file is automatically uploaded to a public CDN - making this an arbitrary file read with built-in exfiltration, exposing SSH keys, /etc/passwd, and similar sensitive data. A public exploit exists (GitHub issue #10) and vendor-released patch version 1.5.1 is confirmed available; no CISA KEV listing has been identified.
Path traversal and trust inheritance flaws in gitoxide's Rust crates gix (≤ 0.72.0) and gix-validate (≤ 0.10.0) allow an attacker who supplies a malicious repository to read arbitrary git configuration files - including embedded credentials - from a victim system. The attack chains three bugs: a first-occurrence-only `find(b"..")` check in submodule name validation that is bypassed by names like `a..b/../../../.git/`, the fact that this validation function is never invoked in production code, and a trust inheritance flaw in `Submodule::open()` that propagates the parent repository's `Trust::Full` to the traversed path while skipping ownership verification entirely. No public exploit has been identified at time of analysis, though a compiled PoC was referenced (truncated) in the GHSA advisory.