Monthly
Path traversal in the aws:downloadContent plugin of amazon-ssm-agent before 3.3.4515.0 allows an authenticated attacker with a specifically scoped ssm:SendCommand IAM permission to write arbitrary files outside the intended download directory with root privileges on targeted managed instances. By directing the AWS-DownloadContent SSM document to retrieve from a controlled S3 source containing crafted object keys with path traversal sequences, an attacker can overwrite sensitive system files and escalate to full remote code execution as root. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root-privilege arbitrary write primitive represents a high-impact capability in compromised-credential scenarios.
Zip extraction in AWS diagram-as-code (awsdac) versions 0.10 through 0.23 is vulnerable to relative path traversal (CWE-23), enabling a third party to write arbitrary files outside the intended extraction directory by embedding crafted path sequences in zip entry names within a malicious diagram bundle. Exploitation requires user interaction - a victim must actively process the attacker-supplied bundle - making this a social-engineering-dependent local attack. AWS has released a patched version 0.24; no active exploitation or public exploit code has been identified at time of analysis.
Arbitrary file write via path traversal in the Apache Camel Google Cloud Storage consumer component affects versions 4.0.0 through 4.21.x, allowing anyone who can influence GCS bucket object names to cause the Camel process to create or overwrite files outside the configured download directory. The consumer appends blob names verbatim to the local path using the unsanitized ${file:name} token without directory containment checks, and the filter option that could restrict object names is disabled by default. No public exploit is identified at time of analysis; SSVC rates the flaw automatable once malicious object names are present in the consumed bucket, and vendor-released patches are available at 4.14.9, 4.18.4, and 4.22.0.
Arbitrary file write via path traversal in the Apache Camel camel-azure-storage-blob component lets an attacker who can influence blob names in a consumed Azure Storage container force Camel to create or overwrite files outside the configured download directory, with the privileges of the Camel process. It affects Apache Camel 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0, where BlobOperations.downloadBlobToFile joined the fileDir option with the raw remote blob name without normalization or containment checks. No public exploit has been identified at time of analysis and the CVSS is 9.1, but EPSS is low (0.18%, 7th percentile), indicating no observed exploitation activity yet.
Path traversal in Apache Camel's camel-azure-storage-datalake component allows anyone with write access to a consumed Azure Data Lake Storage Gen2 filesystem to direct the Camel process to write or overwrite files at arbitrary locations on the local filesystem. The downloadToFile operation constructs local paths by joining the configured fileDir with the remote file name exactly as returned by the Azure SDK - without lexical normalization or any boundary check - meaning a remote path name containing parent-directory segments (e.g., '../../etc/cron.d/payload') resolves outside fileDir. Depending on what the Camel process can write, this integrity violation can escalate to code execution or service disruption. No active exploitation has been identified at time of analysis, and vendor-released patches are available in versions 4.14.9, 4.18.4, and 4.22.0.
Unauthenticated remote file read in 4MOSAn Management Center (all versions prior to build 20260621) allows any network-reachable attacker to download arbitrary system files via a Relative Path Traversal flaw (CWE-23). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms no authentication, no user interaction, and no special configuration is required to trigger the vulnerability. A vendor-issued patch was released as of build 20260621 per TWCERT advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in LeafWiki's asset rename endpoint allows authenticated editors to relocate any file readable by the server process into a page's public asset directory, making it downloadable over HTTP. All releases from 0.3.0 through 0.10.0 (CPE: cpe:2.3:a:perber:leafwiki:*:*:*:*:*:*:*:*) are affected; version 0.10.1 contains the fix. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low exploitation complexity and high-impact outcome - including potential exposure of the application database - make prompt patching urgent for any multi-user deployment.
Path traversal in the `apport-unpack` utility of Canonical Apport enables arbitrary file creation and overwrite by exploiting attacker-controlled key names embedded in crafted crash report files. Affected versions span all Apport releases before 2.28.4, 2.34.2, and 2.36.0 - software that ships by default with Ubuntu desktop and server editions. An attacker who delivers a malicious `.crash` file and induces a user or automated pipeline to unpack it can write files to any location accessible by the executing user, creating a realistic privilege-escalation primitive on multi-user or developer Ubuntu systems. No public exploit is identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Privilege elevation in Microsoft Fabric lets an authenticated, low-privileged user abuse a relative path traversal weakness (CWE-23) over the network to reach resources outside their intended scope and gain higher privileges. Microsoft rates this CVSS 9.9 with a scope change, reflecting that a compromised tenant identity can cross authorization boundaries in the multi-tenant analytics platform. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a high-priority fix.
Arbitrary file read in Apache InLong 2.0.0 through 2.3.x exposes the Agent host filesystem to unauthenticated remote attackers via a relative path traversal flaw. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no credentials or user interaction, making any network-exposed InLong Agent endpoint a direct confidentiality risk. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS sits at 0.21% (12th percentile), indicating low observed exploitation probability despite the high base score.
Path traversal in the aws:downloadContent plugin of amazon-ssm-agent before 3.3.4515.0 allows an authenticated attacker with a specifically scoped ssm:SendCommand IAM permission to write arbitrary files outside the intended download directory with root privileges on targeted managed instances. By directing the AWS-DownloadContent SSM document to retrieve from a controlled S3 source containing crafted object keys with path traversal sequences, an attacker can overwrite sensitive system files and escalate to full remote code execution as root. No public exploit code or CISA KEV listing has been identified at time of analysis, but the root-privilege arbitrary write primitive represents a high-impact capability in compromised-credential scenarios.
Zip extraction in AWS diagram-as-code (awsdac) versions 0.10 through 0.23 is vulnerable to relative path traversal (CWE-23), enabling a third party to write arbitrary files outside the intended extraction directory by embedding crafted path sequences in zip entry names within a malicious diagram bundle. Exploitation requires user interaction - a victim must actively process the attacker-supplied bundle - making this a social-engineering-dependent local attack. AWS has released a patched version 0.24; no active exploitation or public exploit code has been identified at time of analysis.
Arbitrary file write via path traversal in the Apache Camel Google Cloud Storage consumer component affects versions 4.0.0 through 4.21.x, allowing anyone who can influence GCS bucket object names to cause the Camel process to create or overwrite files outside the configured download directory. The consumer appends blob names verbatim to the local path using the unsanitized ${file:name} token without directory containment checks, and the filter option that could restrict object names is disabled by default. No public exploit is identified at time of analysis; SSVC rates the flaw automatable once malicious object names are present in the consumed bucket, and vendor-released patches are available at 4.14.9, 4.18.4, and 4.22.0.
Arbitrary file write via path traversal in the Apache Camel camel-azure-storage-blob component lets an attacker who can influence blob names in a consumed Azure Storage container force Camel to create or overwrite files outside the configured download directory, with the privileges of the Camel process. It affects Apache Camel 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0, where BlobOperations.downloadBlobToFile joined the fileDir option with the raw remote blob name without normalization or containment checks. No public exploit has been identified at time of analysis and the CVSS is 9.1, but EPSS is low (0.18%, 7th percentile), indicating no observed exploitation activity yet.
Path traversal in Apache Camel's camel-azure-storage-datalake component allows anyone with write access to a consumed Azure Data Lake Storage Gen2 filesystem to direct the Camel process to write or overwrite files at arbitrary locations on the local filesystem. The downloadToFile operation constructs local paths by joining the configured fileDir with the remote file name exactly as returned by the Azure SDK - without lexical normalization or any boundary check - meaning a remote path name containing parent-directory segments (e.g., '../../etc/cron.d/payload') resolves outside fileDir. Depending on what the Camel process can write, this integrity violation can escalate to code execution or service disruption. No active exploitation has been identified at time of analysis, and vendor-released patches are available in versions 4.14.9, 4.18.4, and 4.22.0.
Unauthenticated remote file read in 4MOSAn Management Center (all versions prior to build 20260621) allows any network-reachable attacker to download arbitrary system files via a Relative Path Traversal flaw (CWE-23). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms no authentication, no user interaction, and no special configuration is required to trigger the vulnerability. A vendor-issued patch was released as of build 20260621 per TWCERT advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in LeafWiki's asset rename endpoint allows authenticated editors to relocate any file readable by the server process into a page's public asset directory, making it downloadable over HTTP. All releases from 0.3.0 through 0.10.0 (CPE: cpe:2.3:a:perber:leafwiki:*:*:*:*:*:*:*:*) are affected; version 0.10.1 contains the fix. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low exploitation complexity and high-impact outcome - including potential exposure of the application database - make prompt patching urgent for any multi-user deployment.
Path traversal in the `apport-unpack` utility of Canonical Apport enables arbitrary file creation and overwrite by exploiting attacker-controlled key names embedded in crafted crash report files. Affected versions span all Apport releases before 2.28.4, 2.34.2, and 2.36.0 - software that ships by default with Ubuntu desktop and server editions. An attacker who delivers a malicious `.crash` file and induces a user or automated pipeline to unpack it can write files to any location accessible by the executing user, creating a realistic privilege-escalation primitive on multi-user or developer Ubuntu systems. No public exploit is identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Privilege elevation in Microsoft Fabric lets an authenticated, low-privileged user abuse a relative path traversal weakness (CWE-23) over the network to reach resources outside their intended scope and gain higher privileges. Microsoft rates this CVSS 9.9 with a scope change, reflecting that a compromised tenant identity can cross authorization boundaries in the multi-tenant analytics platform. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a high-priority fix.
Arbitrary file read in Apache InLong 2.0.0 through 2.3.x exposes the Agent host filesystem to unauthenticated remote attackers via a relative path traversal flaw. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no credentials or user interaction, making any network-exposed InLong Agent endpoint a direct confidentiality risk. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS sits at 0.21% (12th percentile), indicating low observed exploitation probability despite the high base score.