Monthly
Authenticated users of Blinko through version 1.8.8 can achieve remote code execution as root by supplying a plugin name containing '../' sequences to the plugin.installPlugin tRPC procedure, which constructs the install path from the unsanitized name and writes downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an attacker can overwrite a root-owned startup file and gain code execution at the highest privilege level; the endpoint is open to any authenticated account and the referenced sign-in code indicates self-registration may be enabled, potentially letting an unauthenticated outsider obtain the required account. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8), reflecting a genuine high-priority issue rather than a CVSS-inflated paper risk; no confirmed active exploitation is indicated by CISA KEV, though the references include a public repository dedicated to this path-traversal RCE chain that should be treated as potential exploit material.
Path traversal in the BugTracker.NET file download component allows an authenticated remote attacker to read files outside the intended download directory by supplying a manipulated filename parameter, exposing any file readable by the account running the web application. Exploitation requires a valid BugTracker.NET session (any account able to reach the download handler that accepts a user-supplied filename) and no user interaction; the blast radius is bounded by the operating-system permissions of the application's service account, so a hardened, least-privilege IIS identity materially limits the disclosure. The issue is rated 7.1 (CVSS 4.0) with high confidentiality impact and no integrity or availability effect, and there is no public exploit identified at time of analysis, though the low attack complexity and widespread wildcard CPE coverage make the class of bug attractive to post-authentication attackers who already hold a low-privileged account.
Papermerge 3.5.3 permits an authenticated standard user to achieve remote code execution by uploading a crafted file to /api/documents/upload with directory-traversal sequences in the filename, causing a malicious Python .pth file to be written into the interpreter's site-packages directory; the embedded code executes only when the Python interpreter next starts, for example on an application or worker restart. Publicly available exploit code exists via a GitHub PoC repository and accompanying PDF, and the flaw is conditionally gated by requiring the Papermerge process to have write access to site-packages and by the attacker not controlling restart timing, making it a credible but conditionally-gated RCE rather than an immediately triggerable one.
Directory traversal in Handlebars.java before 4.5.5 lets unauthenticated remote attackers read arbitrary files outside the configured template base directory in Spring MVC applications that use the handlebars-springmvc integration. The flaw specifically affects handlebars-springmvc 4.5.3 and 4.5.4, where the path-containment check added for CVE-2026-63490 validates template locations as raw percent-encoded strings while the template file is ultimately opened through a URL handler that percent-decodes the path, so a request-derived view name containing %2e%2e/ slips past both the view-resolver and loader-side checks. Exploitation is not confirmed in the wild and no public exploit code has been identified at time of analysis, but it requires two non-default conditions to hold simultaneously: a file: template location prefix and a Handlebars view name derived from untrusted request input, which keeps real-world priority moderate despite the 7.5 CVSS score. Impact is limited to confidentiality (arbitrary file read); integrity and availability are unaffected.
PHP code execution on Netgate pfSense Plus and pfSense CE firewalls can be achieved by an authenticated, highly privileged webGUI user who can modify Dashboard widget settings and plant a crafted .widget.php file on the filesystem, then set a widget sequence value containing path traversal so Dashboard index.php include()s and executes that file. The vendor rates this High (CVSS 8.5), while the independent assessment keeps AV:N/AC:H but raises the privilege requirement to PR:H, reflecting that the attacker already needs substantial Dashboard and file-write access; it is not remotely exploitable without authentication. No public exploit or KEV-listed active exploitation was identified in the provided data, and Netgate has released fixed versions.
Zip-slip path traversal in Frauscher FDS 102 enables a high-privileged remote attacker to overwrite arbitrary files on the server and achieve full system compromise. By uploading a specially crafted ZIP archive containing entries with directory traversal sequences (e.g., ../../etc/cron.d/backdoor), an authenticated attacker can escape the intended extraction directory and plant executable content in sensitive filesystem locations. No public exploit code or active exploitation has been identified at time of analysis, but the direct path from file write to code execution makes this a critical post-authentication escalation risk in industrial environments.
Directory traversal in Exim before 4.99.5 enables low-privileged local users to escape the mail spool directory boundary and read or manipulate arbitrary files on the host filesystem, ultimately achieving privilege escalation. The flaw is rooted in improper validation of queue-name arguments (CWE-24), affecting Exim from version 4.88 through 4.99.4. No public exploit has been identified at time of analysis, and EPSS at 0.27% (19th percentile) reflects limited exploitation activity, though SSVC assesses the technical impact as total given successful exploitation yields full system compromise.
Local file inclusion in Emlog 2.6.13 and earlier lets an authenticated author supply a path-traversal template value that is stored unvalidated by api_controller.php and later passed to View::getView() in log_controller.php, causing an arbitrary local .php file to be included when the article is viewed. Because included PHP is executed, an attacker who can place or influence a .php file on the host can escalate this to code execution. No public exploit has been identified at time of analysis, and no fixed version currently exists.
Path traversal in XWiki running on Jetty 12+ lets remote users read arbitrary files the Jetty process can access by sending doubly URL-encoded '../' sequences to the skin resource endpoint (e.g. /xwiki/bin/skin/..%252f/..). Depending on how deep the webapp sits below root, this exposes both in-webapp secrets such as WEB-INF/xwiki.cfg and Hibernate configuration, and out-of-webapp OS files like /etc/passwd. No public exploit or active exploitation is tracked, but the vendor advisory (GHSA-qj4x-9g63-25g6) itself publishes working request URLs, so weaponization is trivial.
Path traversal in Webmin's mailboxes component before version 2.640 lets an authenticated user write saved attachment files outside the intended directory by controlling the attachment's filename. The flaw lives in mailboxes/detachall.cgi, which constructs the on-disk filename directly from the email attachment's MIME name without stripping path separators, so a crafted name can redirect the write to an attacker-chosen location. Carrying a CVSS 4.0 base score of 9.4 with total technical impact, the issue is fixed in 2.640; CISA's SSVC framework currently lists exploitation status as none and no public exploit has been identified.
Authenticated users of Blinko through version 1.8.8 can achieve remote code execution as root by supplying a plugin name containing '../' sequences to the plugin.installPlugin tRPC procedure, which constructs the install path from the unsanitized name and writes downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an attacker can overwrite a root-owned startup file and gain code execution at the highest privilege level; the endpoint is open to any authenticated account and the referenced sign-in code indicates self-registration may be enabled, potentially letting an unauthenticated outsider obtain the required account. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8), reflecting a genuine high-priority issue rather than a CVSS-inflated paper risk; no confirmed active exploitation is indicated by CISA KEV, though the references include a public repository dedicated to this path-traversal RCE chain that should be treated as potential exploit material.
Path traversal in the BugTracker.NET file download component allows an authenticated remote attacker to read files outside the intended download directory by supplying a manipulated filename parameter, exposing any file readable by the account running the web application. Exploitation requires a valid BugTracker.NET session (any account able to reach the download handler that accepts a user-supplied filename) and no user interaction; the blast radius is bounded by the operating-system permissions of the application's service account, so a hardened, least-privilege IIS identity materially limits the disclosure. The issue is rated 7.1 (CVSS 4.0) with high confidentiality impact and no integrity or availability effect, and there is no public exploit identified at time of analysis, though the low attack complexity and widespread wildcard CPE coverage make the class of bug attractive to post-authentication attackers who already hold a low-privileged account.
Papermerge 3.5.3 permits an authenticated standard user to achieve remote code execution by uploading a crafted file to /api/documents/upload with directory-traversal sequences in the filename, causing a malicious Python .pth file to be written into the interpreter's site-packages directory; the embedded code executes only when the Python interpreter next starts, for example on an application or worker restart. Publicly available exploit code exists via a GitHub PoC repository and accompanying PDF, and the flaw is conditionally gated by requiring the Papermerge process to have write access to site-packages and by the attacker not controlling restart timing, making it a credible but conditionally-gated RCE rather than an immediately triggerable one.
Directory traversal in Handlebars.java before 4.5.5 lets unauthenticated remote attackers read arbitrary files outside the configured template base directory in Spring MVC applications that use the handlebars-springmvc integration. The flaw specifically affects handlebars-springmvc 4.5.3 and 4.5.4, where the path-containment check added for CVE-2026-63490 validates template locations as raw percent-encoded strings while the template file is ultimately opened through a URL handler that percent-decodes the path, so a request-derived view name containing %2e%2e/ slips past both the view-resolver and loader-side checks. Exploitation is not confirmed in the wild and no public exploit code has been identified at time of analysis, but it requires two non-default conditions to hold simultaneously: a file: template location prefix and a Handlebars view name derived from untrusted request input, which keeps real-world priority moderate despite the 7.5 CVSS score. Impact is limited to confidentiality (arbitrary file read); integrity and availability are unaffected.
PHP code execution on Netgate pfSense Plus and pfSense CE firewalls can be achieved by an authenticated, highly privileged webGUI user who can modify Dashboard widget settings and plant a crafted .widget.php file on the filesystem, then set a widget sequence value containing path traversal so Dashboard index.php include()s and executes that file. The vendor rates this High (CVSS 8.5), while the independent assessment keeps AV:N/AC:H but raises the privilege requirement to PR:H, reflecting that the attacker already needs substantial Dashboard and file-write access; it is not remotely exploitable without authentication. No public exploit or KEV-listed active exploitation was identified in the provided data, and Netgate has released fixed versions.
Zip-slip path traversal in Frauscher FDS 102 enables a high-privileged remote attacker to overwrite arbitrary files on the server and achieve full system compromise. By uploading a specially crafted ZIP archive containing entries with directory traversal sequences (e.g., ../../etc/cron.d/backdoor), an authenticated attacker can escape the intended extraction directory and plant executable content in sensitive filesystem locations. No public exploit code or active exploitation has been identified at time of analysis, but the direct path from file write to code execution makes this a critical post-authentication escalation risk in industrial environments.
Directory traversal in Exim before 4.99.5 enables low-privileged local users to escape the mail spool directory boundary and read or manipulate arbitrary files on the host filesystem, ultimately achieving privilege escalation. The flaw is rooted in improper validation of queue-name arguments (CWE-24), affecting Exim from version 4.88 through 4.99.4. No public exploit has been identified at time of analysis, and EPSS at 0.27% (19th percentile) reflects limited exploitation activity, though SSVC assesses the technical impact as total given successful exploitation yields full system compromise.
Local file inclusion in Emlog 2.6.13 and earlier lets an authenticated author supply a path-traversal template value that is stored unvalidated by api_controller.php and later passed to View::getView() in log_controller.php, causing an arbitrary local .php file to be included when the article is viewed. Because included PHP is executed, an attacker who can place or influence a .php file on the host can escalate this to code execution. No public exploit has been identified at time of analysis, and no fixed version currently exists.
Path traversal in XWiki running on Jetty 12+ lets remote users read arbitrary files the Jetty process can access by sending doubly URL-encoded '../' sequences to the skin resource endpoint (e.g. /xwiki/bin/skin/..%252f/..). Depending on how deep the webapp sits below root, this exposes both in-webapp secrets such as WEB-INF/xwiki.cfg and Hibernate configuration, and out-of-webapp OS files like /etc/passwd. No public exploit or active exploitation is tracked, but the vendor advisory (GHSA-qj4x-9g63-25g6) itself publishes working request URLs, so weaponization is trivial.
Path traversal in Webmin's mailboxes component before version 2.640 lets an authenticated user write saved attachment files outside the intended directory by controlling the attachment's filename. The flaw lives in mailboxes/detachall.cgi, which constructs the on-disk filename directly from the email attachment's MIME name without stripping path separators, so a crafted name can redirect the write to an attacker-chosen location. Carrying a CVSS 4.0 base score of 9.4 with total technical impact, the issue is fixed in 2.640; CISA's SSVC framework currently lists exploitation status as none and no public exploit has been identified.