Monthly
Zip-slip path traversal in Frauscher FDS 102 enables a high-privileged remote attacker to overwrite arbitrary files on the server and achieve full system compromise. By uploading a specially crafted ZIP archive containing entries with directory traversal sequences (e.g., ../../etc/cron.d/backdoor), an authenticated attacker can escape the intended extraction directory and plant executable content in sensitive filesystem locations. No public exploit code or active exploitation has been identified at time of analysis, but the direct path from file write to code execution makes this a critical post-authentication escalation risk in industrial environments.
Arbitrary file deletion on Splunk cluster managers is possible for any authenticated, low-privileged user - no admin or power role required - by submitting a crafted knowledge bundle delta containing path traversal sequences. Affected versions span four active release branches: 9.4.x before 9.4.14, 10.0.x before 10.0.9, 10.2.x before 10.2.6, and 10.4.x before 10.4.2. An attacker exploiting this flaw can delete files accessible to the Splunk process outside the intended staging directory, degrading system integrity or triggering service disruption on the cluster manager node. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Zimbra Collaboration Suite (ZCS) Briefcase document editing exposes sensitive web application files to authenticated low-privileged users. The vulnerability stems from improper validation of the `packages` parameter, enabling directory escape via crafted traversal sequences. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has released a fix in version 10.1.17.
Directory traversal in Exim before 4.99.5 enables low-privileged local users to escape the mail spool directory boundary and read or manipulate arbitrary files on the host filesystem, ultimately achieving privilege escalation. The flaw is rooted in improper validation of queue-name arguments (CWE-24), affecting Exim from version 4.88 through 4.99.4. No public exploit has been identified at time of analysis, and EPSS at 0.27% (19th percentile) reflects limited exploitation activity, though SSVC assesses the technical impact as total given successful exploitation yields full system compromise.
Local file inclusion in Emlog 2.6.13 and earlier lets an authenticated author supply a path-traversal template value that is stored unvalidated by api_controller.php and later passed to View::getView() in log_controller.php, causing an arbitrary local .php file to be included when the article is viewed. Because included PHP is executed, an attacker who can place or influence a .php file on the host can escalate this to code execution. No public exploit has been identified at time of analysis, and no fixed version currently exists.
Path traversal in XWiki running on Jetty 12+ lets remote users read arbitrary files the Jetty process can access by sending doubly URL-encoded '../' sequences to the skin resource endpoint (e.g. /xwiki/bin/skin/..%252f/..). Depending on how deep the webapp sits below root, this exposes both in-webapp secrets such as WEB-INF/xwiki.cfg and Hibernate configuration, and out-of-webapp OS files like /etc/passwd. No public exploit or active exploitation is tracked, but the vendor advisory (GHSA-qj4x-9g63-25g6) itself publishes working request URLs, so weaponization is trivial.
Path traversal in libzypp's .repo file processing enables low-privileged network-accessible attackers to write content into arbitrary directories on the host filesystem beyond the intended zypp cache boundary. Affected versions span the 17.x series before 17.38.13 and the 16.x series before 16.22.19, covering systems running SUSE Linux Enterprise and openSUSE derivatives that use zypper as their package manager. The primary real-world impact is disk exhaustion across unexpected filesystem paths, causing a denial of service; no confidentiality impact is attributed in the CVSS assessment. No public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in Webmin's mailboxes component before version 2.640 lets an authenticated user write saved attachment files outside the intended directory by controlling the attachment's filename. The flaw lives in mailboxes/detachall.cgi, which constructs the on-disk filename directly from the email attachment's MIME name without stripping path separators, so a crafted name can redirect the write to an attacker-chosen location. Carrying a CVSS 4.0 base score of 9.4 with total technical impact, the issue is fixed in 2.640; CISA's SSVC framework currently lists exploitation status as none and no public exploit has been identified.
Path traversal in XWiki Platform's WebJars API enables a subwiki admin who can publish and install a malicious WebJar extension to write arbitrary files anywhere on the server filesystem. The affected Maven component `xwiki-platform-webjars-api` fails to validate that JAR entry paths extracted during extension installation remain within the intended export directory, allowing overwrite of configuration files or potential superadmin credential manipulation. No public exploit is identified and no CISA KEV listing exists; vendor-released patches are available across three version branches.
Path traversal vulnerability in Joplin's OneNote importer (versions 3.2.2 through 3.5.6) allows local attackers with authenticated access to overwrite arbitrary files on disk by importing malicious .one files containing directory traversal sequences in embedded file names. The vulnerability can lead to remote code execution by overwriting system files like .bashrc. Publicly available exploit code exists, with vendor-released patch available in version 3.5.7.
Zip-slip path traversal in Frauscher FDS 102 enables a high-privileged remote attacker to overwrite arbitrary files on the server and achieve full system compromise. By uploading a specially crafted ZIP archive containing entries with directory traversal sequences (e.g., ../../etc/cron.d/backdoor), an authenticated attacker can escape the intended extraction directory and plant executable content in sensitive filesystem locations. No public exploit code or active exploitation has been identified at time of analysis, but the direct path from file write to code execution makes this a critical post-authentication escalation risk in industrial environments.
Arbitrary file deletion on Splunk cluster managers is possible for any authenticated, low-privileged user - no admin or power role required - by submitting a crafted knowledge bundle delta containing path traversal sequences. Affected versions span four active release branches: 9.4.x before 9.4.14, 10.0.x before 10.0.9, 10.2.x before 10.2.6, and 10.4.x before 10.4.2. An attacker exploiting this flaw can delete files accessible to the Splunk process outside the intended staging directory, degrading system integrity or triggering service disruption on the cluster manager node. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Zimbra Collaboration Suite (ZCS) Briefcase document editing exposes sensitive web application files to authenticated low-privileged users. The vulnerability stems from improper validation of the `packages` parameter, enabling directory escape via crafted traversal sequences. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has released a fix in version 10.1.17.
Directory traversal in Exim before 4.99.5 enables low-privileged local users to escape the mail spool directory boundary and read or manipulate arbitrary files on the host filesystem, ultimately achieving privilege escalation. The flaw is rooted in improper validation of queue-name arguments (CWE-24), affecting Exim from version 4.88 through 4.99.4. No public exploit has been identified at time of analysis, and EPSS at 0.27% (19th percentile) reflects limited exploitation activity, though SSVC assesses the technical impact as total given successful exploitation yields full system compromise.
Local file inclusion in Emlog 2.6.13 and earlier lets an authenticated author supply a path-traversal template value that is stored unvalidated by api_controller.php and later passed to View::getView() in log_controller.php, causing an arbitrary local .php file to be included when the article is viewed. Because included PHP is executed, an attacker who can place or influence a .php file on the host can escalate this to code execution. No public exploit has been identified at time of analysis, and no fixed version currently exists.
Path traversal in XWiki running on Jetty 12+ lets remote users read arbitrary files the Jetty process can access by sending doubly URL-encoded '../' sequences to the skin resource endpoint (e.g. /xwiki/bin/skin/..%252f/..). Depending on how deep the webapp sits below root, this exposes both in-webapp secrets such as WEB-INF/xwiki.cfg and Hibernate configuration, and out-of-webapp OS files like /etc/passwd. No public exploit or active exploitation is tracked, but the vendor advisory (GHSA-qj4x-9g63-25g6) itself publishes working request URLs, so weaponization is trivial.
Path traversal in libzypp's .repo file processing enables low-privileged network-accessible attackers to write content into arbitrary directories on the host filesystem beyond the intended zypp cache boundary. Affected versions span the 17.x series before 17.38.13 and the 16.x series before 16.22.19, covering systems running SUSE Linux Enterprise and openSUSE derivatives that use zypper as their package manager. The primary real-world impact is disk exhaustion across unexpected filesystem paths, causing a denial of service; no confidentiality impact is attributed in the CVSS assessment. No public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in Webmin's mailboxes component before version 2.640 lets an authenticated user write saved attachment files outside the intended directory by controlling the attachment's filename. The flaw lives in mailboxes/detachall.cgi, which constructs the on-disk filename directly from the email attachment's MIME name without stripping path separators, so a crafted name can redirect the write to an attacker-chosen location. Carrying a CVSS 4.0 base score of 9.4 with total technical impact, the issue is fixed in 2.640; CISA's SSVC framework currently lists exploitation status as none and no public exploit has been identified.
Path traversal in XWiki Platform's WebJars API enables a subwiki admin who can publish and install a malicious WebJar extension to write arbitrary files anywhere on the server filesystem. The affected Maven component `xwiki-platform-webjars-api` fails to validate that JAR entry paths extracted during extension installation remain within the intended export directory, allowing overwrite of configuration files or potential superadmin credential manipulation. No public exploit is identified and no CISA KEV listing exists; vendor-released patches are available across three version branches.
Path traversal vulnerability in Joplin's OneNote importer (versions 3.2.2 through 3.5.6) allows local attackers with authenticated access to overwrite arbitrary files on disk by importing malicious .one files containing directory traversal sequences in embedded file names. The vulnerability can lead to remote code execution by overwriting system files like .bashrc. Publicly available exploit code exists, with vendor-released patch available in version 3.5.7.