Path Traversal

Directory traversal in Cloud Commander (coderaiser/cloudcmd) before 19.20.2 lets remote unauthenticated attackers read, write, move, or copy files outside the configured root directory by supplying path-traversal sequences to REST file-operation and markdown endpoints. The root cause is missing path-normalization enforcement before filesystem operations, giving full arbitrary file read/write on the host filesystem. No public exploit identified at time of analysis, but a vendor-released patch (v19.20.2) and a fixing commit with a working url-encoded traversal test case are publicly available, lowering the barrier to reproduction.

Directory traversal in the cohttp OCaml HTTP library before version 6.3.0 allows unauthenticated remote attackers to read arbitrary files outside the configured document root by supplying percent-encoded path traversal sequences such as `..%2f..%2f` in HTTP request URIs. The root cause (CWE-180) is that `Cohttp.Path.resolve_local_file` validated and stripped `.` and `..` segments before percent-decoding the URI, meaning encoded traversal bypassed sanitization entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a straightforward read primitive for any server using cohttp's static file resolution.

Path traversal in IBM Langflow OSS 1.0.0 through 1.11.1 exposes arbitrary server-side files to unauthenticated remote attackers over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity exploitation requiring no credentials or user interaction, with high confidentiality impact limited to file reads - no write or availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated network vector and low attack complexity make internet-facing instances a realistic opportunistic target once details circulate.

Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.

Unauthenticated directory traversal in Yamcs versions up to and including 5.8.6 (per advisory scope, < 5.11.13 per package metadata) allows any remote attacker to read arbitrary files from the underlying host operating system by sending a crafted HTTP request. The flaw resides in StaticFileHandler.java, which resolves user-supplied URL paths against a static file root without verifying the resolved path stays within that root - a double-slash prefix (e.g., //etc/passwd) is sufficient to escape the boundary. No public exploit identified at time of analysis, though the steps-to-reproduce are fully published in the GitHub Security Advisory and the vulnerability was demonstrated in a public CTF challenge at DEFCON 33.

Archive symlink traversal in aquaproj/aqua prior to v2.60.1 enables an attacker who controls a tool archive to write arbitrary files outside the extraction directory with the privileges of the user running aqua. The vulnerable combination in `pkg/unarchive/archives.go` - creating a symlink without destination validation, then following it with a regular file write - allows a malicious tar.gz to overwrite files such as shell startup scripts or PATH entries, resulting in user-level code execution. A working PoC is confirmed in GHSA-mf5c-hw34-4hpp; no CISA KEV listing is present and EPSS data is unavailable for this CVE.

Arbitrary file write in BuilderIO gpt-crawler through 1.5.1 allows unauthenticated remote attackers to overwrite any file on the server filesystem by supplying absolute paths or path traversal sequences in the unsanitized `outputFileName` parameter of the POST /crawl endpoint. File content is sourced from attacker-controlled URLs, making this a combined path traversal and server-side fetch primitive capable of depositing web shells, poisoning cron jobs, or corrupting application configs. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 8.8 reflects high integrity impact with no authentication barrier.

Path traversal in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to read arbitrary files from the server filesystem by supplying absolute paths to the Gradio document-parsing interface. The flaw exists in the simple_doc_parser and supporting utility code, which pass caller-controlled paths directly to file-open operations without restricting access to an intended directory. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N) reflects a zero-prerequisite, network-accessible attack surface; no active exploitation is confirmed in CISA KEV and no public POC has been identified at time of analysis.

Path traversal in Duplicacy's restore function through version 3.2.5 allows arbitrary file writes outside the designated restore directory when a user restores from a compromised or attacker-controlled snapshot repository. Duplicacy fails to sanitize file paths deserialized from snapshot entries, so crafted traversal sequences (e.g., '../../') cause files to be written to any location accessible by the restoring OS user. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the integrity and availability impact is rated High in the CVSS 4.0 assessment.

Path traversal in houtini-lm (versions up to 2.13.2) allows an authenticated remote user to supply crafted absolute paths to the code_task_files tool, causing the server to read files outside its intended working directory. Because code_task_files forwards file contents directly to the configured LLM endpoint - which may be a remote provider such as OpenRouter - a successful traversal can silently exfiltrate sensitive files (SSH keys, environment files, cloud credentials) off the machine to a third-party service. No public exploit has been identified and the CVE has not been added to the CISA KEV catalog; an upstream fix is available in commit 35d97bca.

Path traversal in iswalle getnote-mcp up to version 1.5.0 allows attackers with low-privilege MCP call access to read arbitrary files from the host filesystem via the upload_image tool's unsanitized image_path parameter. The vulnerable fs.readFileSync call in src/index.ts accepts absolute paths and directory traversal sequences, and critically, the read file is automatically uploaded to a public CDN - making this an arbitrary file read with built-in exfiltration, exposing SSH keys, /etc/passwd, and similar sensitive data. A public exploit exists (GitHub issue #10) and vendor-released patch version 1.5.1 is confirmed available; no CISA KEV listing has been identified.

Path traversal and trust inheritance flaws in gitoxide's Rust crates gix (≤ 0.72.0) and gix-validate (≤ 0.10.0) allow an attacker who supplies a malicious repository to read arbitrary git configuration files - including embedded credentials - from a victim system. The attack chains three bugs: a first-occurrence-only `find(b"..")` check in submodule name validation that is bypassed by names like `a..b/../../../.git/`, the fact that this validation function is never invoked in production code, and a trust inheritance flaw in `Submodule::open()` that propagates the parent repository's `Trust::Full` to the traversed path while skipping ownership verification entirely. No public exploit has been identified at time of analysis, though a compiled PoC was referenced (truncated) in the GHSA advisory.

Path traversal in gitoxide before 0.52.1 and gix before 0.83.0 allows an attacker who supplies a malicious git repository to redirect submodule git directory resolution outside .git/modules, exposing arbitrary on-disk repository structure to inspection. The flaw stems from submodule names read from .gitmodules being joined directly as filesystem path components with no normalization or confinement check, so a name such as '../../../escaped-target.git' escapes the expected directory boundary. A proof-of-concept is publicly available via GHSA-fr8x-3vfx-f45h; no confirmed active exploitation at time of analysis.

Path traversal in SiYuan's asset.upload MCP tool before v3.8.1 allows an attacker to exfiltrate arbitrary host files - including SSH keys and credentials - by supplying absolute paths that bypass workspace boundary validation. The attack is delivered via prompt injection against an AI Agent connected to SiYuan's MCP server, meaning exploitation depends on an AI agent processing attacker-controlled content. No public exploit or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (CVSS 4.0: 6.9) reflects the potential to read any file the SiYuan process can access.

Path traversal in flutter_file_picker's Android implementation (all versions through 10.3.10) allows a malicious Android app on the same device to write arbitrary files into the victim app's internal storage directories. The openFileStream() method in FileUtils.kt constructs file paths using the DISPLAY_NAME value returned by ContentResolver.query() without sanitization, making it trivially exploitable by a crafted ContentProvider that returns filenames containing ../ sequences. No public exploit has been identified at time of analysis; SSVC classifies exploitation as none and the attack is not automatable, keeping real-world risk constrained despite the clear code-level flaw.

Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. This is an incomplete fix for CVE-2026-30893, and no public exploit has been identified at time of analysis; it is fixed in 4.14.7.

Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or delete arbitrary files as root by injecting directory traversal sequences into the srcip field of alert-triggering log events. Versions prior to 4.14.7 are affected when ip-customblock is configured as an active response - the block action creates an empty file at an attacker-controlled path, while the unblock action deletes it, both executing as root and enabling destruction of credentials, configuration, or other critical files. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the missing validation is trivially observable by comparing ip-customblock.c against its sibling scripts.

Path traversal in MAA-AI MaaMCP (versions up to 1.1.1.dev6+g2e4a41287) allows low-privileged remote users to read or write files outside the intended pipeline directory by supplying crafted path inputs to the save_pipeline and load_pipeline functions in pipeline_tools.py. Publicly available exploit code exists (referenced in GitHub issue #31), though no active exploitation has been confirmed by CISA KEV. The CVSS 4.0 score of 5.1 (Medium) reflects the authentication requirement and limited per-impact severity, but the public POC elevates practical risk above the base score alone.

Path traversal in arben-adm mcp-sequential-thinking versions up to and including 0.5.0 allows remote low-privileged attackers to read or write arbitrary files on the server by supplying unsanitized path sequences to the `import_session` and `export_session` functions in `server.py`. A publicly disclosed proof-of-concept exists (GitHub issue #17), and the fix is available in v0.6.0 via commit 2fad3ee8. The CVE is not listed in CISA KEV, indicating no confirmed mass exploitation, but the public PoC meaningfully elevates practical risk above the moderate CVSS score alone.

Path traversal in RooCodeInc Roo-Code through version 3.51.1 allows remote unauthenticated attackers to read and write files outside the intended working directory by manipulating input processed by the path.resolve function in ApplyPatchTool.ts. The vendor has confirmed they archived the repository and discontinued all support, meaning no patch will ever be released. Publicly available exploit code exists via a GitHub Gist, and no vendor-released patch identified at time of analysis - organizations still running this tool are permanently exposed.

Path traversal via unsanitized MIME attachment filenames in Dolibarr's EmailCollector module allows any email sender to write attacker-controlled files outside the intended attachment directory, affecting versions 9.0.0 through 23.0.4. Because the EmailCollector is designed to ingest mail from unauthenticated external senders - such as a support or ticket inbox - no Dolibarr account is required to exploit this flaw. On hardened deployments with a read-only htdocs tree, the attacker can corrupt or forge documents belonging to other objects; on installations where htdocs is writable, the same write primitive reaches web-executable PHP paths, enabling remote code execution. No public exploit identified at time of analysis.

Zip extraction in AWS diagram-as-code (awsdac) versions 0.10 through 0.23 is vulnerable to relative path traversal (CWE-23), enabling a third party to write arbitrary files outside the intended extraction directory by embedding crafted path sequences in zip entry names within a malicious diagram bundle. Exploitation requires user interaction - a victim must actively process the attacker-supplied bundle - making this a social-engineering-dependent local attack. AWS has released a patched version 0.24; no active exploitation or public exploit code has been identified at time of analysis.

Path traversal in Spring AI's ResourceCacheService allows an authenticated low-privileged network attacker to write files outside the intended cache directory. The getCacheName() method appends URI fragments verbatim - including '../' sequences and path separators - to a base directory path before passing the result to new File(resourceParentFolder, newFileName) and writing downloaded bytes there. Affected versions span Spring AI 1.0.9 and earlier, 1.1.0 through 1.1.8, and 2.0.0; no public exploit or CISA KEV listing has been identified at time of analysis.

Unauthenticated remote code execution in Unitree G1 EDU firmware through 1.5.2 allows any network-adjacent attacker to gain a root shell on the robot by chaining three design flaws without credentials or user interaction. The attack exploits an open WebRTC-to-DDS bridge on TCP port 9991, a hardcoded world-readable AES-128 key, and a path traversal flaw in the chat_go knowledge upload API to plant and execute arbitrary scripts as uid 0 via the bashrunner service. Publicly available exploit code (UniBLEed on GitHub) and a full technical writeup confirm reliable exploitation; no KEV listing has been observed, but the adjacent-network vector makes this a real priority for any institution operating these robots on shared campus or lab networks.

Arbitrary file write in the libreoffice-convert npm package (all versions prior to 1.8.2) allows any caller who supplies a user-controlled `fileName` option to escape the intended temporary directory and overwrite arbitrary filesystem paths accessible to the Node.js process. The root cause is unsanitized use of `path.join(tempDir.name, fileName)` - a `../`-laden filename resolves outside the temp dir without restriction. With no public exploit identified at time of analysis and no CISA KEV listing, risk is contingent on whether consuming applications expose `fileName` to untrusted input, but the write primitive is trivially exploitable in document-conversion web services.

Grafana Alloy's prometheus.operator.servicemonitors component exposes an arbitrary local file read path that leads to credential theft and potential Kubernetes privilege escalation. Any Kubernetes user with ServiceMonitor create or modify rights in a namespace watched by Alloy can point the bearerTokenFile field at any file accessible to the Alloy process - most critically Alloy's own projected Kubernetes service account token - and receive that file's contents exfiltrated via HTTP Bearer token to an attacker-controlled scrape endpoint. The CVSS 7.7 Scope:Changed rating correctly reflects that successful exploitation transcends the compromised namespace, potentially granting the attacker cluster-level API access commensurate with Alloy's own RBAC permissions. No public exploit has been identified at time of analysis.

Path traversal in n8n-nodes-sqlite3 (all versions prior to 1.0.0) exposes multi-tenant n8n deployments to arbitrary file read and overwrite through the unsanitized db_path node parameter. When a workflow author explicitly maps untrusted end-user input to the SQLite node's database path field, an attacker can supply a crafted traversal string to redirect SQLite to open any file accessible to the n8n process-potentially exposing credentials, configuration files, or enabling data destruction. No public exploit has been identified at time of analysis, and the vendor-confirmed fix is available in v1.0.0 via commit 145a887.

Path traversal in Spring Framework's FreeMarker integration allows authenticated remote attackers to read arbitrary files from the server's template path when a controller passes user-controlled input directly as a view name. Affected versions span every maintained Spring Framework branch from 5.2.x through 7.0.8, making the exposure broad in the Java ecosystem. No public exploit code or active exploitation has been identified; CISA's SSVC assessment rates technical impact as partial and the vulnerability as non-automatable, consistent with the configuration dependency required to trigger it.

Path traversal in NLTK through version 3.10.3 allows attackers who control caller-supplied file paths to read or write files outside the boundaries enforced by the pathsec sandbox module. The affected APIs - TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter loading - perform raw file I/O directly on caller-provided paths without routing through pathsec enforcement, undermining the intended access control boundary. The CVSS 4.0 score of 8.3 reflects high confidentiality impact; no public exploit code or CISA KEV listing has been identified at time of analysis.

Path traversal in the openssl-encrypt pip package (versions before 1.4.9) enables a sandboxed plugin to escape its intended isolation and access or modify a sibling plugin's files when the two plugin directories share a name prefix. The flaw in PluginSandbox._is_safe_path performs a bare string-prefix match rather than an exact directory boundary comparison, so a plugin allowed under .../plugins/foo incorrectly passes the safety check for .../plugins/foobar. Vendor-released patch version 1.4.9 corrects the flaw; no public exploit code has been identified and the package is absent from the CISA KEV catalog.

Path traversal in Eclipse SW360's optional filesystem attachment store allows authenticated low-privilege users to write files to arbitrary paths on the host operating system by crafting malicious filenames during attachment upload. Affected versions span 19.0.0 through 20.1.0 exclusively when the non-default `enable.attachment.store.to.file.system` configuration key is active. The CVSS 4.0 score of 6.0 (AT:P, PR:L, VI:H) reflects meaningful integrity impact gated behind a specific configuration requirement; no public exploit has been identified at time of analysis.

Path traversal in Volmarg Personal Management System exposes arbitrary server-side files to any authenticated user through the GET /public/get-file/{path} endpoint. The Symfony PHP controller forwards the route parameter directly to file_get_contents() without canonicalization or base-directory enforcement, making absolute filesystem paths such as /etc/passwd or application .env files fully retrievable within the PHP-FPM worker's permission boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this an urgent remediation target for any self-hosted deployment storing sensitive personal or credential data.

Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrator who redirects the LOG_FILE configuration setting to an arbitrary filesystem path and injects server-side template syntax through attacker-controlled logged content. The upstream commit explicitly documents this multi-step exploitation chain - redirecting log output to a template file and triggering application rendering to execute injected code - making weaponization technically straightforward for any attacker holding admin credentials. No public exploit or CISA KEV listing is identified at time of analysis; upstream fix is available as a GitHub commit from the Flowintel maintainer CIRCL.

Path traversal in blackms aistack's Static File Handler (src/web/server.ts) exposes arbitrary server-side files to unauthenticated remote attackers via unsanitized req.url processing. All versions through 1.6.1 are confirmed affected per NVD CPE data, and a public proof-of-concept exploit exists in GitHub issue #57. The project received responsible disclosure but has not responded, meaning no patch is available at time of analysis.

Flowintel's PDF export pipeline passes attacker-controlled note content to Pandoc with the raw_tex extension enabled, allowing authenticated users to inject XeLaTeX directives such as \input{} or \verbatiminput{} that cause the server to read arbitrary local files and embed their contents into the exported PDF. Any authenticated user with note-editing access can exploit this to exfiltrate sensitive server-side files - credentials, keys, or intelligence data stored on the host. No public exploit has been identified at time of analysis, but the LaTeX injection-to-file-read technique is well-documented and requires no specialized tooling.

Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated Editor-level users to delete files anywhere on the server via path traversal. The changed scope (S:C in the CVSS vector) indicates that deletion can extend to files outside the WordPress installation - including potentially critical OS-level or application files - causing severe availability impact. No public exploit code or CISA KEV listing is identified at time of analysis.

Server-side request forgery and remote code execution affect the Spring Framework's XsltView component across the 5.2.x through 7.0.x branches (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8). When a Spring MVC application maps '/**' to view rendering and does not explicitly set a view name, an attacker can steer view resolution to XsltView and supply a path that triggers outbound requests and code execution. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%), but SSVC rates the technical impact as total and automatable.

Path traversal in boxpositron/with-context-mcp up to version 3.0.7 exposes the host filesystem through four note-management functions - ingest_notes, teleport_notes, sync_notes, and project_folder - in src/index.ts, allowing unauthenticated remote attackers to read or write files outside the intended working directory. The affected package is a Model Context Protocol (MCP) server, meaning exploitation is triggered via tool-call requests sent to the MCP endpoint, a vector inherently accessible to any AI agent or client connected to the server. A publicly available proof-of-concept has been disclosed via a GitHub issue; the vendor had not responded to the coordinated disclosure at time of reporting, leaving affected versions unpatched.

Path traversal in bsmi021's mcp-file-context-server 1.0.0 allows remote unauthenticated attackers to read arbitrary files on the host system by supplying crafted path arguments to the read_context function in src/index.ts. The Path Resolution component fails to canonicalize or boundary-check caller-supplied paths, enabling directory escape via sequences such as '../'. A public exploit exists (GitHub issue #15), the project maintainer has not responded to disclosure, and no vendor-released patch is available.

Path traversal in linkedin-ads-mcp 1.0.0 allows remote unauthenticated callers to read arbitrary files from the server's filesystem. The vulnerability exists in the Media Upload component where the `filePath` argument is passed directly to Node.js `fs.readFileSync` without sanitization, enabling directory traversal sequences to escape the intended media directory. A publicly available proof-of-concept exploit exists via a GitHub issue report; the maintainer has not responded to the disclosure.

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended preview directory via the /api/static/{deployKey}/ static-resource endpoint, which concatenates attacker-controlled path segments to the preview root without normalization. Publicly available exploit code exists, though the flaw is not listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), indicating no evidence of widespread active exploitation. The practical impact is unauthenticated disclosure of sensitive server-side files (source code, configuration, secrets), not code execution.

A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.

Path traversal in Lektor's built-in preview and development HTTP server on Windows exposes arbitrary files to unauthenticated network attackers in all versions prior to 3.3.14. Crafted HTTP requests containing path traversal sequences exploit Windows-specific path separator handling to escape the configured web root and read any file accessible to the Lektor process, including system files and deployment configuration files that may contain credentials. A public proof-of-concept exploit is available; no confirmed active exploitation via CISA KEV has been recorded.

Path traversal in Spring Integration's ZipTransformer allows a low-privileged attacker who controls the file_name message header to write ZIP archive output to arbitrary filesystem paths outside the configured workDirectory. Affected versions span the 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines of Spring Integration, and exploitation is viable by default since ZipResultType.FILE is the standard configuration. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 2026.7, allowing project administrators to exfiltrate host files outside their repository boundary. The vulnerability is an incomplete fix for CVE-2026-34242 - the original patch blocked path traversal via '..' sequences but failed to prevent symlink-based traversal, leaving the arbitrary file read primitive intact. No public exploit has been identified at time of analysis; the CVSS score of 7.7 High reflects scope change due to cross-boundary file disclosure, while the project-administrator privilege requirement limits the exploitable population.

Path traversal in Mage AI through version 0.9.79 allows any authenticated Viewer-role user to read arbitrary files accessible to the server process by supplying absolute paths to the browser-items API endpoint. The BrowserItemResource class in mage_ai/api/resources/BrowserItemResource.py omits the containment check that sibling classes FileContentResource and FileResource both apply, and the role-based access control enforcement that would otherwise restrict this route is disabled by default. No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege bar and default-off RBAC enforcement make this a meaningful risk for any multi-user Mage AI deployment.

Path traversal in ZLMediaKit's downloadFile API allows an authenticated operator holding the API secret to read files from sibling directories outside the configured root, because the root path is built without a trailing separator and the confinement check is a bare prefix comparison. The flaw is isolated to server/WebApi.cpp and does not affect the standard static file server in src/Http/HttpFileManager.cpp. No patch version has been confirmed and no public exploit has been identified at time of analysis, but because the reference container runs as root, a secret-holding attacker can read arbitrary host filesystem content.

Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources.

Directory traversal in Formidable Charts (WordPress plugin, versions up to and including 2.0.1) allows unauthenticated network attackers to read arbitrary server-side files via the unsanitized `frm_graph` parameter, exposing sensitive data such as WordPress configuration credentials. Exploitation requires three co-active plugins and a pre-existing image-chart uploads directory, making this a targeted but credible risk for active users of the full Formidable Forms and Charts stack. No public exploit code or CISA KEV listing has been identified at time of analysis; fix version 2.0.2 is available per the official Formidable Forms changelog.

Path traversal in RustDesk's macOS clipboard file-paste feature allows a remote session peer to write files outside the intended target directory by supplying crafted file descriptor names containing parent-directory components or absolute paths. Versions 1.3.9 through 1.4.9 on macOS are affected; exploitation requires an active RustDesk session and passive victim interaction (initiating a clipboard paste). No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor fix is available via commit 6f1eb164.

Path traversal in TeamViewer Desktop Clients prior to version 15.81.5 allows an authenticated remote session participant to write files to arbitrary locations on the victim's local filesystem via the file transfer and virtual file clipboard features. The affected product family spans Full Client, Host, QuickSupport, and Portable editions across Windows, Linux, and macOS, covering the v13, v14, and current v15 release lines. Arbitrary file write can be chained to code execution at the privilege level of the user running TeamViewer; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Path traversal in the Directorist WordPress plugin (versions 8.5 through before 8.9.3) allows subscriber-level authenticated users to relocate arbitrary server-readable image files into a publicly accessible directory and delete them from their original location. The flaw stems from unsanitized user-supplied image references passed directly to a file-move operation, exposing sensitive server files to unauthenticated public access after the move. Publicly available exploit code exists per WPScan reporting; however, EPSS sits at 0.19% (9th percentile), and the requirement for a subscriber-level account limits opportunistic mass exploitation.

Path traversal in the AI Engine WordPress plugin (versions 3.3.3 through 3.7.1) allows arbitrary server file reads with subsequent exfiltration to an external service. When the plugin's non-default public API feature is enabled, subscriber-level users can supply a crafted URL that the plugin maps to a local filesystem path without confinement, reads, and forwards to an external AI endpoint. In default configurations the flaw is limited to administrator-level users, but on WordPress multisite networks this allows unprivileged subsite administrators to extract network-wide configuration secrets. A publicly available POC exists, though EPSS at 0.19% indicates no widespread automated exploitation at time of analysis.

Arbitrary file write and directory deletion in compliance-trestle's catalog-generate, profile-generate, and ssp-generate author commands exposes CI/CD pipelines to workspace-escape attacks when output arguments are derived from untrusted data. The affected commands construct output paths by joining a user-supplied argument onto the Trestle workspace root, but apply only a task-name-collision check rather than the PathSecurityValidator guard already used by the jinja command - allowing absolute paths or traversal sequences to escape the workspace entirely. With --force-overwrite, the primitive escalates to recursive deletion of an attacker-chosen directory tree followed by file creation, enabling indirect code execution by overwriting files (e.g., .github/workflows, .git/hooks, shell profile scripts) that a downstream pipeline subsequently executes. No public exploit is identified at time of analysis, though the GHSA advisory for the related jinja variant (GHSA-4q5v-7g7x-j79w) contains a detailed reproduction procedure.

Unauthenticated path traversal in yx-image-recognition v1.0 exposes arbitrary files on the host filesystem to remote attackers. Parameters `dir` and `filePath` are passed unsanitized directly to Java's `new File()` constructor, enabling directory traversal sequences (e.g., `../../`) to escape the intended working directory. No public exploit identified at time of analysis, and EPSS of 0.14% (4th percentile) indicates low observed exploitation probability, though a researcher-published report with technical detail exists on GitHub.

Path traversal in UnPoller 2.33.0's password field enables unauthenticated remote attackers to read arbitrary files from the host filesystem and exfiltrate their contents over the network. The CVSS 7.5 (High) vector reflects a fully network-accessible, zero-authentication attack with high confidentiality impact against the affected version. A public exploit repository (github.com/SyntaxSaiyan/CVE-2026-36851) exists, though EPSS stands at just 0.22% (12th percentile) and no CISA KEV listing is present, indicating no public exploit identified at time of analysis as having been broadly weaponized.

Arbitrary file read via path traversal in DocSys-master V2.02.85 exposes the server filesystem to unauthenticated remote attackers through the downloadDocEx endpoint in DocController.java, which fails to sanitize user-supplied path parameters. Publicly available exploit code exists per SSVC poc status and the GitHub reference. Despite a CVSS 7.5 score with high confidentiality impact, EPSS of 0.14% (4th percentile) indicates very low observed exploitation activity, likely reflecting the product's obscure deployment footprint rather than low exploitability.

Unauthenticated arbitrary file write in DB-GPT 0.8.0 lets remote attackers achieve remote code execution through the skill_upload endpoint, which builds an upload path by joining the user-controlled multipart filename to the upload directory without canonicalisation or containment checks. Because the route's only auth dependency (get_user_from_headers) returns an admin-role request even when no credentials are supplied, an attacker with no account can write a .py file such as ../../../tmp/x or /tmp/x anywhere the server process can write, then plant or overwrite a Python module that executes when next imported. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially exploitable and fixed in v0.8.1.

Arbitrary root file write in SonicWall NetExtender Linux client (versions 10.3.5 and earlier) is achievable by an unauthenticated remote attacker who delivers a malicious OPSWAT tarball containing path-traversal sequences, exploiting CWE-29 to escape the intended extraction directory and overwrite system files as root. Exploitation requires user interaction (CVSS UI:R) to trigger tarball processing, and no public exploit code or CISA KEV listing has been identified at time of analysis. EPSS stands at 0.20% (9th percentile), consistent with the SSVC assessment of exploitation status 'none' and automatable 'no', though the technical impact is rated total.

Path traversal in NVIDIA OpenShell Sandbox for Linux permits low-privileged network-authenticated attackers to bypass L7 REST network policy enforcement, reaching REST endpoints that policy rules were designed to block. The Changed Scope (S:C) in the CVSS vector signals that the real impact falls on downstream services or data stores protected by the bypassed policy, yielding high confidentiality exposure (C:H) and limited integrity impact (I:L) on resources outside the sandbox trust boundary. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis.

Arbitrary file write in sublinear-time-solver's MCP export_state and import_state tools allows any caller able to invoke the MCP interface to overwrite files accessible to the server process - including sensitive targets such as ~/.ssh/authorized_keys or application binaries - by supplying a path-traversal filepath argument. Affected packages are consciousness-explorer (npm) < 1.1.2, sublinear-time-solver (npm) < 1.6.0, and the Rust crate sublinear < 0.2.0. No public exploit or CISA KEV listing has been identified at time of analysis, but the write-anywhere primitive carries inherent high-impact potential against deployments that expose the MCP server to untrusted callers.

Arbitrary file write in browse-mcp (npm, versions ≤ 0.8.1) allows a malicious MCP client - or an autonomous LLM agent steered by indirect prompt injection on a visited page - to write attacker-controlled bytes to any filesystem path the process can reach, including shell init files, autostart entries, and cron files, enabling host code execution. The root cause is CWE-22 path traversal in browser_download (unvalidated save_dir argument) and browser_save_state/browser_load_state (unvalidated path argument), compounded by the force_fetch fallback bypassing the BROWSE_MCP_ALLOWED_ORIGINS origin fence entirely. No public exploit has been identified at time of analysis; vendor-released patch 0.8.2 is confirmed available.

Path traversal in rclone's serve s3 command (versions before 1.74.4) allows unauthenticated remote attackers to both read and overwrite files at the serve root directory by embedding dot-dot sequences in S3 object keys. Go's path.Join() in the S3 backend normalizes traversal sequences that the S3 protocol treats as opaque identifiers, so a request like GET /bucket/../root-secret.txt resolves outside the intended bucket scope to a root-level file. A public proof-of-concept is available; no active exploitation has been confirmed in CISA KEV, but the unauthenticated default configuration and low attack complexity make exposed instances high-priority for patching.

Local file inclusion in Winter CMS before 1.2.13 allows authenticated backend users holding the cms.manage_assets permission to exfiltrate arbitrary server-readable files - including .env - by embedding =include or =require path-traversal directives in theme JavaScript assets. The critical escalation is that the resulting combined asset output is served unauthenticated via the public combine/{file} route, meaning a single privileged write operation exposes APP_KEY and database credentials to any unauthenticated visitor. This is the JavaScript-importer counterpart of two prior Winter CMS LFI bugs (GHSA-58fp-mcx6-7qf9, CVE-2023-52085) in the same asset combiner pipeline. No public exploit identified at time of analysis; vendor-released patch available in 1.2.13.

Path traversal via symlink bypass in NLTK corpus readers before 3.10.3 permits disclosure of arbitrary files outside the trusted corpus data root through standard API calls. Affected corpus reader methods - channels(), domains(), and synonyms() - reopen root-derived paths with Python's built-in open() rather than the secure nltk.pathsec.open(), which enforces symlink restrictions. An attacker who can stage symlinked files inside a trusted corpus directory can leverage this gap to read files the NLTK process can access on the host filesystem. No public exploit has been identified at time of analysis, and a vendor-released patch is available in NLTK 3.10.3.

Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any process-writable filesystem location by supplying a crafted user_id containing ../ sequences to the FileMemory constructor. All versions of the praisonaiagents pip package below 1.6.58 are affected; the vulnerability exists in the core library's FileMemory class, not an example or optional component. A detailed proof-of-concept is included in the GitHub Security Advisory (GHSA-gxmw-5f7x-6g22), and no public exploit identified at time of analysis beyond that PoC; no CISA KEV listing exists.

Workspace boundary escape in PraisonAI's praisonai.code CODE_TOOLS exposes three independent path traversal vectors affecting all file operation and command execution tools exported for use by AI agents. Agents configured with a workspace parameter - intended as a filesystem security boundary - can be manipulated via prompt injection or untrusted input to read, write, enumerate, and execute commands outside that boundary, bounded only by the process user's OS permissions. Publicly available proof-of-concept code demonstrates all six bypass paths against real praisonai.code agent tools; no CISA KEV listing exists at time of analysis.

Arbitrary file write via path traversal in the sos clean utility allows a local attacker to overwrite or create files at any location on the system by supplying a crafted tar archive to a privileged operator. The vulnerability exists across all supported Red Hat Enterprise Linux versions (6 through 10) and stems from sos clean's use of Python's fully_trusted_filter (or its legacy equivalent) during tar extraction, which performs no validation of symlink or hardlink targets - permitting escape from the intended extraction directory. Because sos clean commonly runs as root, successful exploitation yields full system compromise. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Remote code execution in Crater Invoice through 6.0.6 is achievable by any authenticated company owner via a Zip Slip attack against the self-update API's unzip endpoint. Crafted ZIP archives containing path-traversal sequences (`../`) in entry names are passed without sanitization to PHP's `ZipArchive::extractTo()`, enabling arbitrary PHP file writes into the web-accessible `public/` directory and subsequent webshell execution. A public proof-of-concept is available on GitHub; no CISA KEV listing was identified at time of analysis, though the combination of a low exploitation bar and public PoC makes this a priority finding.

Path traversal in dekdee's adobe-xd-mcp 1.0.0 exposes the server filesystem to remote unauthenticated attackers via unsanitized `outputFile` and `outputDir` parameters in the `file-access-from-request` endpoint of `src/parsers/xd-parser.ts`. A public proof-of-concept exploit is available through the project's GitHub issue tracker, and no patch has been released - the vendor has not responded to the disclosure. With a CVSS 4.0 score of 6.9, public exploit code (E:P), and no mitigating authentication requirement, any network-exposed instance is immediately at risk.

Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authentication - to read files outside the intended directory on self-hosted instances running version 3.0.22 or earlier. The affected endpoint (`server/src/nest/journey/journey-public.controller.ts`) fails to adequately sanitize path inputs, exposing server-side files to limited confidentiality disclosure. No public exploit has been identified and the CVE is not listed in the CISA KEV catalog; a vendor-released patch is available in v3.1.0.

Remote code execution in WatchGuard Agent lets an unauthenticated attacker positioned on an adjacent network chain a missing-authentication weakness (CWE-306) with path traversal into arbitrary code execution on the host. Rated CVSS 4.0 9.4 (Critical) by WatchGuard, the flaw combines an authentication bypass with directory traversal so no credentials or user interaction are required. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-adjacent, no-auth, high-impact profile makes it a high-priority patch item.

Path traversal in the TYPO3 Mask extension allows authenticated backend users with Mask module access to create or delete arbitrary .html files outside the configured template directory. The flaw stems from the extension's failure to validate client-supplied template element keys before using them to construct filesystem paths for saving and deleting Mask template files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity impact is concrete - an attacker can overwrite or remove .html files anywhere the TYPO3 web process has write access.

Path traversal in SKYSEA Client View and SKYMEC IT Manager enables a locally-authenticated Windows user to execute arbitrary code on remote Windows systems running the same software via UDP communication channels. This is an incomplete-fix bypass of CVE-2024-41726, reported by JPCERT/CC, meaning the original remediation failed to neutralize all traversal variants. No public exploit has been identified at time of analysis, but the subsequent-system impact is maximal (SC:H/SI:H/SA:H per CVSS 4.0), indicating full lateral compromise potential within enterprise environments deploying these management agents.

Lateral code execution via path traversal in SKYSEA Client View and SKYMEC IT Manager allows a low-privileged user authenticated to one Windows host running the software to execute arbitrary code on other Windows hosts where the product is installed, provided those targets are reachable via UDP. The vulnerability (CWE-22) is a bypass of the incomplete patch for CVE-2024-41726, meaning prior remediation efforts are insufficient. No public exploit code or CISA KEV listing has been identified at time of analysis, but the RCE-class impact on subsequent systems - reflected in CVSS 4.0 SC:H/SI:H/SA:H - makes this a meaningful lateral movement risk in enterprise environments running SKY Co. products.

Path traversal in peerigon unzip-crx and unzip-crx-3 (versions up to 0.2.0) enables a local, low-privileged attacker to write extracted archive files outside the intended destination directory by supplying a crafted path argument to the unzip() function. A publicly available proof-of-concept exploit exists via the GitHub issue tracker, and no vendor patch has been released as the project has not responded to the disclosure. The integrity impact is limited to arbitrary file placement on the local filesystem within the privileges of the invoking process.

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. The library's clone operations omit `--separate-git-dir` from the `unsafe_git_clone_options` blocklist, so any application that passes attacker-controlled values to `Repo.clone_from()` or `Repo.clone()` allows git to redirect repository metadata to an arbitrary filesystem path. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the path-traversal primitive combined with git-hook execution capability produces a realistic high-integrity-impact scenario in exposed applications.

Path traversal in Grav CMS before 2.0.16 exposes arbitrary server-side files to authenticated page authors through the `media_directory()` Twig function, which fails to validate attacker-supplied filesystem paths. Users holding page authoring privileges can supply arbitrary paths to `media_directory()` and then invoke the allow-listed filepath accessor on the resulting Medium object to read the contents of any file accessible to the web server process whose extension matches the CMS media allow-list. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low privilege requirement and high confidentiality impact make this a meaningful risk in any multi-author or externally-accessible Grav deployment.

Arbitrary file deletion in Grav CMS before 2.0.16 allows authenticated users holding media management permissions to delete files anywhere on the server filesystem via path traversal sequences in filenames passed to MediaUploadTrait::deleteFile(). The root cause is that deleteFile() validates only the basename of a supplied filename while passing the full, unvalidated path - including ../ sequences - directly to PHP's unlink(). No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity makes this straightforward to weaponize for any user who holds media upload/delete rights.

Arbitrary file deletion in Adminer before 5.4.3 exposes any file writable by the PHP process to authenticated attackers operating in SQLite mode by abusing unvalidated relative path input in the db[] parameter during database drop operations. The root cause is a missing file extension check in the SQLite drop action (CWE-22 path traversal), allowing directory traversal sequences to escape the intended SQLite database directory. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the deterministic nature of path traversal exploitation makes the vulnerability straightforward to weaponize once authenticated access is obtained.

Arbitrary file write in Adminer 5.3.0-5.4.2 allows any authenticated user to write attacker-controlled content to arbitrary writable filesystem paths via path traversal in the ns parameter of the sql-log plugin. The written files are constrained to a .sql extension, which limits but does not eliminate the integrity impact - an attacker can overwrite existing .sql files, pollute backup directories, or write large files to fill disk. No public exploit code or CISA KEV listing has been identified at time of analysis, and the attack surface is narrowed by both the authentication requirement and the non-default plugin dependency.

Path traversal in Faveo Helpdesk versions 2.0.0 through 2.0.3 enables remote authenticated administrators to delete arbitrary files on the server by manipulating the `data1` argument passed to PHP's `unlink()` function within the Logo Handler component (`SettingsController.php`). Exploitation is limited to accounts holding high privileges, constraining realistic impact despite network reachability. Publicly available exploit code exists via a GitHub issue report; the vendor has not responded to the disclosure as of time of analysis.

Unauthenticated arbitrary file deletion in the MasterStudy LMS WordPress plugin (versions ≤ 3.7.42) allows remote, unauthenticated attackers to delete arbitrary files on the server via path traversal. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:C/A:H) confirms no authentication or user interaction is required and that impact extends beyond the plugin's own scope to server-level files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack surface makes this a high-priority patch target for all WordPress deployments running the affected plugin.

Directory traversal in DrayTek VigorSwitch's getSyslogFile web management function exposes arbitrary device filesystem files to authenticated administrators who supply crafted path traversal sequences in the option parameter. Twenty-eight VigorSwitch managed-switch models across the G, P, Q, PQ, FX, and PX product lines are confirmed affected, with firmware versions fixed at 2.9.10, 2.10.6, 2.10.7, 3.9.10, and 3.10.6 depending on the model. No public exploit code has been identified at time of analysis and this CVE is absent from the CISA KEV catalog, but vendor-released patches are available and should be prioritized given the breadth of affected hardware.

Header injection via structured-mode CloudEvents in Apache Camel's Knative consumer enables unauthenticated SSRF, path traversal, and message-dispatch redirection against routes that forward to header-driven components. The flaw exists because CloudEvent extension fields in structured content mode (Content-Type: application/cloudevents+json) are copied directly into Camel Exchange headers without applying the KnativeHttpHeaderFilterStrategy that correctly guards the binary content-mode path - an incomplete fix of the same filter-bypass pattern addressed across multiple related CVEs (CVE-2025-27636, CVE-2025-29891, CVE-2025-30177, CVE-2026-40453, CVE-2026-47323). No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface - unauthenticated HTTP POST to a Knative endpoint - requires no special tooling.

Arbitrary file write via path traversal in the Apache Camel Google Cloud Storage consumer component affects versions 4.0.0 through 4.21.x, allowing anyone who can influence GCS bucket object names to cause the Camel process to create or overwrite files outside the configured download directory. The consumer appends blob names verbatim to the local path using the unsanitized ${file:name} token without directory containment checks, and the filter option that could restrict object names is disabled by default. No public exploit is identified at time of analysis; SSVC rates the flaw automatable once malicious object names are present in the consumed bucket, and vendor-released patches are available at 4.14.9, 4.18.4, and 4.22.0.

Arbitrary file write via path traversal in the Apache Camel camel-azure-storage-blob component lets an attacker who can influence blob names in a consumed Azure Storage container force Camel to create or overwrite files outside the configured download directory, with the privileges of the Camel process. It affects Apache Camel 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0, where BlobOperations.downloadBlobToFile joined the fileDir option with the raw remote blob name without normalization or containment checks. No public exploit has been identified at time of analysis and the CVSS is 9.1, but EPSS is low (0.18%, 7th percentile), indicating no observed exploitation activity yet.

Path traversal in Apache Camel's camel-azure-storage-datalake component allows anyone with write access to a consumed Azure Data Lake Storage Gen2 filesystem to direct the Camel process to write or overwrite files at arbitrary locations on the local filesystem. The downloadToFile operation constructs local paths by joining the configured fileDir with the remote file name exactly as returned by the Azure SDK - without lexical normalization or any boundary check - meaning a remote path name containing parent-directory segments (e.g., '../../etc/cron.d/payload') resolves outside fileDir. Depending on what the Camel process can write, this integrity violation can escalate to code execution or service disruption. No active exploitation has been identified at time of analysis, and vendor-released patches are available in versions 4.14.9, 4.18.4, and 4.22.0.

Authenticated path traversal in rConfig before 8.2.13 allows any logged-in user to read arbitrary files accessible by the application process by supplying crafted filenames containing directory traversal sequences to the export download endpoint. The fix is confirmed in rConfig V8 Core 8.2.13, released as a dedicated security update and documented in GitHub advisory GHSA-m5rw-jcrm-mmwc. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the release notes reveal that 8.2.13 simultaneously patched multiple related path-containment deficiencies across the application, indicating a systemic pattern rather than an isolated flaw.