Monthly
Path traversal in Laravel Excel (versions 3.1.8-3.1.69) allows authenticated low-privilege users to overwrite arbitrary existing files on the server by supplying a crafted destination path to `Excel::store()`, `$export->store()`, or `storeExcel()`. The vulnerable `Disk::copy()` method resolves caller-controlled paths via `realpath()` against the process working directory, then opens matched files directly with `fopen(rb+)` and `stream_copy_to_stream()`, bypassing Flysystem's path confinement entirely. When the overwritten target is a web-accessible PHP file, this escalates to remote code execution; no public exploit is identified at time of analysis.
Path traversal in Vitest's interceptorPlugin exposes local files on any development server with a network-accessible HMR WebSocket. The `vitest:interceptor:register` handler in `packages/mocker/src/node/interceptorPlugin.ts` accepts redirect mock registrations over Vite's unauthenticated HMR socket without calling `isFileLoadingAllowed()`, allowing a remote unauthenticated attacker who can reach the dev server to submit opaque-scheme URLs (e.g., `traversal:../../../etc/passwd`) whose `..` segments survive `URL.pathname` parsing and resolve outside the project root via `path.join()`. The plugin's `load` hook then returns `readFile(mock.redirect, 'utf-8')` as JavaScript module source, disclosing any file readable by the dev-server process. No public exploit or CISA KEV listing has been identified, but the GitHub fix PR includes a complete, working e2e test that serves as a functional PoC.
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. %5c) bypass the sanitizer. Publicly available exploit code exists in the form of the e2e regression test shipped with the fix; no CISA KEV listing or EPSS score was provided.
Path traversal in Hono's toSSG() static site generator allows untrusted ssgParams values - such as slugs sourced from a CMS, external API, or user submission - to create or overwrite files outside the configured output directory at build time. Versions 4.12.12 through 4.13.4 are affected; the root cause is an incomplete fix for CVE-2026-39408 that fails to collapse consecutive parent-directory segments (e.g., 'a/b/../../../') in route parameter values, and also mishandles Windows drive-relative and UNC path roots. No public exploit has been identified and the vulnerability is not confirmed in the CISA KEV catalog; a complete patch is available in v4.13.5.
Path traversal in HPE Networking Fabric Composer's API endpoint allows an unauthenticated adjacent attacker to manipulate user-generated files and potentially alter critical system configurations. Exploitation is constrained by the AV:A vector (attacker must be on the same network segment), high attack complexity requiring preconditions outside the attacker's control, and mandatory user interaction - factors that collectively reduce the practical risk below the I:H integrity impact might suggest. No public exploit code has been identified and the vulnerability is not listed in CISA KEV. The CVSS base score of 4.8 reflects these limiting conditions accurately.
Second-order path traversal in Kibana allows a low-privileged user with tag creation rights to cause an administrator's routine tag management action to operate on an unintended privileged resource, resulting in permanent deletion of administrator accounts or other organizational assets. Affected versions span the Elastic Stack deployment across the 8.x and 9.x series, with patches released in Kibana 8.19.16, 9.3.5, and 9.4.2. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog, but the potential to delete administrative accounts elevates this beyond a typical medium-severity finding in multi-tenant deployments.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability carries a CVSS 3.1 score of 7.8 with a local attack vector, indicating that an attacker with an existing foothold on the system can escalate impact significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full CIA triad impact (High/High/High) makes this a high-priority remediation target for any organization running Megatron Bridge in research or production AI training environments.
Path traversal in appium-mcp-server through 0.1.61 allows any caller of the write_file or write_files_batch MCP tools to overwrite arbitrary files on the host system by supplying absolute paths or parent-directory sequences (../) that escape the intended PROJECT_ROOT boundary. The server user's full filesystem write permissions are exposed, enabling an attacker to corrupt shell profiles, inject cron jobs, or overwrite application configuration files. No public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable given the absence of any path validation logic in the affected tools.
Unauthenticated arbitrary file deletion in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.12) allows remote attackers to remove any server-accessible file via path traversal in the move_folders function. Deleting critical files such as wp-config.php triggers WordPress's reinstallation routine, cascading directly to full remote code execution and site takeover. No CISA KEV listing or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero-authentication requirement on publicly visible forms make this a critical-priority remediation.
Path traversal in Sage Employee Self Service's custom logo functionality exposes arbitrary server-side files to unauthenticated remote attackers. The flaw stems from insufficient sanitization of file path parameters, allowing directory traversal sequences and their URL-encoded equivalents to escape the application's intended filesystem scope and read sensitive data such as configuration files, environment settings, and logs. No public exploit or CISA KEV listing is present; Sage has remediated the issue via enhanced path validation shipped in the Q2 2026 HRMS product update.
Path traversal in Laravel Excel (versions 3.1.8-3.1.69) allows authenticated low-privilege users to overwrite arbitrary existing files on the server by supplying a crafted destination path to `Excel::store()`, `$export->store()`, or `storeExcel()`. The vulnerable `Disk::copy()` method resolves caller-controlled paths via `realpath()` against the process working directory, then opens matched files directly with `fopen(rb+)` and `stream_copy_to_stream()`, bypassing Flysystem's path confinement entirely. When the overwritten target is a web-accessible PHP file, this escalates to remote code execution; no public exploit is identified at time of analysis.
Path traversal in Vitest's interceptorPlugin exposes local files on any development server with a network-accessible HMR WebSocket. The `vitest:interceptor:register` handler in `packages/mocker/src/node/interceptorPlugin.ts` accepts redirect mock registrations over Vite's unauthenticated HMR socket without calling `isFileLoadingAllowed()`, allowing a remote unauthenticated attacker who can reach the dev server to submit opaque-scheme URLs (e.g., `traversal:../../../etc/passwd`) whose `..` segments survive `URL.pathname` parsing and resolve outside the project root via `path.join()`. The plugin's `load` hook then returns `readFile(mock.redirect, 'utf-8')` as JavaScript module source, disclosing any file readable by the dev-server process. No public exploit or CISA KEV listing has been identified, but the GitHub fix PR includes a complete, working e2e test that serves as a functional PoC.
Path traversal in Next.js (13.4.0 through 15.5.23 and 16.x before 16.3.3) running on Windows-hosted servers lets a remote unauthenticated attacker escape the incremental-cache root and read private build artifacts, most critically the server-reference-manifest encryption key, which can be leveraged for remote code execution in the application. The flaw stems from route segments not escaping backslashes before cache-path construction, so encoded Windows path separators (e.g. %5c) bypass the sanitizer. Publicly available exploit code exists in the form of the e2e regression test shipped with the fix; no CISA KEV listing or EPSS score was provided.
Path traversal in Hono's toSSG() static site generator allows untrusted ssgParams values - such as slugs sourced from a CMS, external API, or user submission - to create or overwrite files outside the configured output directory at build time. Versions 4.12.12 through 4.13.4 are affected; the root cause is an incomplete fix for CVE-2026-39408 that fails to collapse consecutive parent-directory segments (e.g., 'a/b/../../../') in route parameter values, and also mishandles Windows drive-relative and UNC path roots. No public exploit has been identified and the vulnerability is not confirmed in the CISA KEV catalog; a complete patch is available in v4.13.5.
Path traversal in HPE Networking Fabric Composer's API endpoint allows an unauthenticated adjacent attacker to manipulate user-generated files and potentially alter critical system configurations. Exploitation is constrained by the AV:A vector (attacker must be on the same network segment), high attack complexity requiring preconditions outside the attacker's control, and mandatory user interaction - factors that collectively reduce the practical risk below the I:H integrity impact might suggest. No public exploit code has been identified and the vulnerability is not listed in CISA KEV. The CVSS base score of 4.8 reflects these limiting conditions accurately.
Second-order path traversal in Kibana allows a low-privileged user with tag creation rights to cause an administrator's routine tag management action to operate on an unintended privileged resource, resulting in permanent deletion of administrator accounts or other organizational assets. Affected versions span the Elastic Stack deployment across the 8.x and 9.x series, with patches released in Kibana 8.19.16, 9.3.5, and 9.4.2. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog, but the potential to delete administrative accounts elevates this beyond a typical medium-severity finding in multi-tenant deployments.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability carries a CVSS 3.1 score of 7.8 with a local attack vector, indicating that an attacker with an existing foothold on the system can escalate impact significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full CIA triad impact (High/High/High) makes this a high-priority remediation target for any organization running Megatron Bridge in research or production AI training environments.
Path traversal in appium-mcp-server through 0.1.61 allows any caller of the write_file or write_files_batch MCP tools to overwrite arbitrary files on the host system by supplying absolute paths or parent-directory sequences (../) that escape the intended PROJECT_ROOT boundary. The server user's full filesystem write permissions are exposed, enabling an attacker to corrupt shell profiles, inject cron jobs, or overwrite application configuration files. No public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable given the absence of any path validation logic in the affected tools.
Unauthenticated arbitrary file deletion in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.12) allows remote attackers to remove any server-accessible file via path traversal in the move_folders function. Deleting critical files such as wp-config.php triggers WordPress's reinstallation routine, cascading directly to full remote code execution and site takeover. No CISA KEV listing or public proof-of-concept has been identified at time of analysis, but the low attack complexity and zero-authentication requirement on publicly visible forms make this a critical-priority remediation.
Path traversal in Sage Employee Self Service's custom logo functionality exposes arbitrary server-side files to unauthenticated remote attackers. The flaw stems from insufficient sanitization of file path parameters, allowing directory traversal sequences and their URL-encoded equivalents to escape the application's intended filesystem scope and read sensitive data such as configuration files, environment settings, and logs. No public exploit or CISA KEV listing is present; Sage has remediated the issue via enhanced path validation shipped in the Q2 2026 HRMS product update.