CWE-36

Absolute path traversal in NVIDIA Triton Inference Server for Linux exposes arbitrary filesystem files to low-privileged local attackers, with the vendor flagging potential code execution as a secondary consequence. The vulnerability is classified under CWE-36 and affects all versions captured by the wildcard CPE, meaning no upper-bound patched version is confirmed from current data. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, though the discrepancy between the RCE tag and the CVSS confidentiality-only impact metrics leaves the true blast radius unresolved.

Absolute path traversal in NVIDIA Triton Inference Server for Linux enables remote unauthenticated attackers to read or write files outside intended directories. Exploitation may lead to arbitrary code execution and information disclosure, elevating the practical risk above what the moderate CVSS score of 6.5 might suggest given the RCE tag. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible attack vector with no authentication requirement makes this a credible threat to exposed inference server deployments.

Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privilege remote attackers to create directories in arbitrary filesystem locations, including sensitive Windows system paths such as C:\Windows and other users' directories. All TeamDavid releases through Rollout 524 are affected, as confirmed by NCSC.ch and detailed in InfoGuard's research disclosing 22 CVEs across the David platform. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.5 reflects significant potential impact on both the vulnerable host and downstream systems.

Path traversal in pip (CWE-36) allows a malicious package index to write downloaded wheel files to arbitrary filesystem locations outside the intended download directory. The root cause is pip's `Link.filename` property double-decoding percent-encoded URL path segments, letting an attacker embed encoded path separators that survive initial URL parsing but resolve during the second `urllib.parse.unquote()` call. Practical impact is most material for `pip download --only-binary` workflows pointed at untrusted indexes; no public exploit or active exploitation has been identified at time of analysis.

Server-side file path manipulation and forced server-side requests in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 stem from insufficient validation of the language (DictionaryLanguage) parameter in the spell check handler, letting remote attackers coerce the server into resolving attacker-influenced file paths and issuing unintended outbound requests. Classified as information disclosure (CWE-36, absolute path traversal) with a CVSS 7.5 confidentiality-only impact, it exposes sensitive server-side file contents. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Server-side request forgery and NTLM credential exposure in the RabbitMQ management plugin (versions 4.1.0 to before 4.1.11 and 4.2.0 to before 4.2.6) on Windows lets remote actors coerce the broker into outbound DNS and SMB connections to attacker-controlled UNC paths. The static file handler rabbit_mgmt_wm_static passes URL-encoded backslashes to erl_prim_loader:read_file_info before path validation, but only when multiple management extension plugins are enabled. No public exploit has been identified at time of analysis, and the EPSS score is low (0.28%, 20th percentile) despite the CVSS 10.0 rating.

Path traversal via the unsanitized 'X-FILENAME' HTTP header in the ARMember WordPress membership plugin allows unauthenticated remote attackers to upload and overwrite files outside the intended 'wp-content/uploads/armember' directory on affected WordPress installations running versions 4.0.27 and earlier. The integrity impact is limited by the plugin's handling of 'certain files (e.g., CSS)' rather than arbitrary file types, capping the CVSS score at 5.3 Medium; however, successful exploitation can enable website defacement or manipulation of frontend assets without any authentication. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Absolute path traversal in Microsoft Edge for Android (Chromium-based) prior to version 150.0.4078.48 enables local, unauthenticated information disclosure by allowing crafted paths to escape the application's intended directory scope. The CVSS vector (AV:L/C:H/I:N/A:N) confirms the impact is limited to confidentiality loss on the local device, with no integrity or availability consequences. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Absolute path traversal (CWE-36) in Silverpeas through 6.4.6 allows authenticated remote users to read arbitrary files from the server filesystem by exploiting the 'Personal space' fallback path in the FileServer servlet, activated when no componentId parameter is supplied. The CVSS vector confirms network-reachable, low-complexity exploitation requiring only low-privilege credentials, with high confidentiality impact and no integrity or availability loss. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Absolute Path Traversal in DreamMaker (developed by Interinfo) allows unauthenticated remote attackers to enumerate file names under arbitrary filesystem paths on the host. The vulnerability stems from CWE-36 (Absolute Path Traversal) and is exploitable over the network without any credentials or user interaction, as confirmed by the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). Confidentiality impact is limited to file name disclosure rather than full file content retrieval, per the VC:L scoring. No public exploit code or CISA KEV listing has been identified at time of analysis.