Path Traversal
Monthly
Relative path traversal in Satel Netco Design versions prior to v2.1.7 lets an authenticated user holding only Viewer privileges write attacker-influenced files to any filesystem location reachable by the application service account, which can escalate to arbitrary code execution where a writable location is later executed or loaded by the service. The flaw affects the product's data export functionality (CWE-23) and is remotely reachable over the network, but requires a valid low-privileged account (CVSS 3.1 vector PR:L), so anonymous access is not sufficient. Rated 8.7 under CVSS 4.0 and reported through CISA ICS-CERT advisory ICSA-26-281-03; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. The full RCE outcome is conditional on deployment-specific file-write-then-execute paths; absent those, impact is confined to unauthorized file creation or modification within application-accessible directories.
Path traversal (CWE-22) in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a remote, unauthenticated attacker to write arbitrary files on the affected appliance or container by supplying crafted path components. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) exploitation is network-reachable, low-complexity and unauthenticated, with high integrity impact and no confirmed confidentiality or availability impact - a file-write primitive rather than a file-read or denial-of-service bug. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor has released a patch and the sole reference is IBM's advisory at https://www.ibm.com/support/pages/node/7291628. Exposure is bounded by network reachability: instances sitting behind reverse proxies or confined to internal/DMZ segments that attackers cannot reach are not directly exploitable.
Unauthenticated path traversal in IBM Guardium Data Protection 12.2 allows a remote attacker who can reach the GIM (Guardium Installation Manager) file-upload interface to escape the intended upload directory and write arbitrary files onto a Collector host. The assessed vector (AV:N/AC:L/PR:N/UI:N, integrity impact) confirms that no credentials or user interaction are required against that endpoint, so any 12.2 Collector whose GIM upload service is reachable is exposed until patched; the practical attack surface is driven almost entirely by network segmentation of GIM. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed as active - impact is file-system write access on the Collector, scoring CVSS 7.5.
Processing an attacker-controlled Protobuf schema with datamodel-code-generator 0.59.0 through 0.80.0 lets a crafted weak-import path escape the `__weak_imports__` temporary directory, creating directory trees and new files, or overwriting existing files that are writable by the running process (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N; the vendor-reported vector is 7.5 with a higher integrity rating). Exploitation requires a victim or automated CI job to invoke the tool with `--input-file-type protobuf` on a malicious .proto supplied locally via `--input` or remotely via `--url`, and the grpcio-tools package must be installed to enable Protobuf input support; the payload is limited to a `syntax = "proto2";` or `syntax = "proto3";` declaration, so fully attacker-controlled content and direct arbitrary code execution have not been demonstrated. No active exploitation is confirmed (not in CISA KEV), though the upstream GitHub advisory carries a proof-of-concept and technical write-up, and the fix ships in version 0.81.0.
Path traversal in decompress-zip through 0.3.3 allows a crafted ZIP archive to write files outside the intended extraction directory when a victim or application uses the package to extract it, potentially enabling arbitrary file overwrite, application compromise, or code execution in environments with a useful writable sibling path. The assessed vector is local (AV:L) with required user/application interaction (UI:R), no network exposure, and no special authentication (PR:N), so exploitation requires the attacker to deliver the archive into an extraction workflow; RCE is conditional, not guaranteed. No public exploit identified at time of analysis, and no CISA KEV active-exploitation report was provided; the overall risk is real but conditional rather than an urgent mass-exploitation threat.
Unauthenticated path traversal in the Ollama `/api/pull` endpoint lets a remote attacker write an arbitrary file outside the model store by submitting a crafted path-traversal sequence in the layer digest field, because the `digestToPath` function does not adequately validate digests before constructing a filesystem path. When the Ollama process can write to `/usr/lib/ollama` (described as the default in most Ollama Docker images) and the server or container is subsequently restarted, the planted binary is loaded and executed, yielding remote code execution as root; the same file-write primitive is available without authentication to anyone who can reach the API. The issue is fixed in Ollama 0.35.0, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none', and no EPSS score was supplied in the source data. Real-world risk is high but conditional: exploitation of the full RCE chain depends on write access to `/usr/lib/ollama` and a restart, so deployments not using the default Docker image, running Ollama as a non-privileged user without write access to that directory, or not exposing the API to untrusted networks face substantially reduced exposure.
Path traversal in Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 lets an unauthenticated attacker write arbitrary files to restricted host locations by embedding traversal sequences in entries of a support-bundle archive that ASCG ingests from remote endpoints, with the potential for follow-on remote code execution if a written path is later executed or loaded. The attack is not internet-facing: exploitation is scored AV:A (adjacent network) with the CVSS 4.0 AT:P precondition, meaning the attacker must already control or be able to man-in-the-middle support bundles originating from a compromised or spoofed ingesting endpoint. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the practical risk is a moderate, conditional one that depends on an attacker holding a management-network position and a compromised ingestion source rather than an urgent, broadly exploitable issue.
Path traversal in the HTTP service component of Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 allows an unauthenticated attacker positioned on the same local or adjacent network segment to send a manipulated API request that escapes intended path restrictions and performs arbitrary file read or file write operations (the description also references file deletion, although the assessed impact is high confidentiality and integrity with no availability effect). The flaw is exploitable without credentials or user interaction in default configurations of affected releases, but only from an adjacent network - it is not reachable from the public internet without first obtaining such a position. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score accompanied the available intelligence.
Arbitrary code execution on the Vault host is achievable in HashiCorp Vault and Vault Enterprise when a privileged operator restores a crafted Integrated Storage (Raft) snapshot in a deployment configured with Shamir seals and an external plugin directory, because stored plugin catalog entries are not consistently verified to reference binaries inside that configured directory (CWE-22 path traversal). The attacker must already hold the high privileges needed to restore a Raft snapshot (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), and exploitation also depends on the non-default Shamir-seal-plus-external-plugin-directory configuration, so this is a genuinely serious but condition-gated vulnerability rather than a mass-exploitation threat; clusters using auto-unseal or without an external plugin directory are not affected by this path. No public exploit identified at time of analysis, and vendor-released fixes are available in Vault Community Edition 2.1.2 and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-techdocs-node) lets an authenticated user who can register or modify documentation sources make a TechDocs build read files or fetch URLs outside the documentation boundary, potentially exposing backend-host data or internal network resources (path traversal, CWE-22). Affected versions are those before 1.14.6 on the 1.14 line and before 1.15.4 on the 1.15 line; the impact is changed-scope with high confidentiality loss and no integrity or availability impact, and it applies to deployments where the Backstage backend generates TechDocs from those sources rather than relying on externally sandboxed CI. Exploitation requires an authenticated principal with documentation-source registration or modification rights (PR:L), and no public exploit code has been identified at time of analysis; this is assessed as a credible, patch-worthy issue rather than an emergency, with vendor fixes released in @backstage/plugin-techdocs-node 1.14.6 and 1.15.4 plus pymdown-extensions 10.21.3 or newer.
Path traversal in Backstage's optional @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package (versions before 0.3.25) allows an authenticated user who can execute a template using the confluence:transform:markdown action and control the repository file location to write generated content outside the task workspace, potentially overwriting files writable by the Backstage backend process. The vulnerability is rated CVSS 7.1 with high integrity and low availability impact but no confidentiality impact; exploitation requires the module to be installed and enabled, and the attacker must supply directory-traversal sequences in the repoUrl input. The issue is fixed in version 0.3.25 (Backstage release v1.54.6), and no public exploit has been identified at time of analysis.
Remote code execution in SonicWall SMA1000 (Appliance Management Console) can be triggered by an authenticated administrator who uploads a crafted archive containing path traversal sequences, allowing files to be written outside the intended extraction directory and leading to code execution. The vulnerability is a classic Zip Slip (CWE-22) issue with a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker must already hold high/administrative privileges on the AMC-a significant precondition that sharply limits the pool of realistic attackers to compromised or malicious administrators. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none), so this is a conditional high-severity risk rather than a mass-exploitation emergency.
A time-of-check to time-of-use (TOCTOU) race condition in Anthropic's Claude Code CLI allows an attacker who already has write access to a shared project workspace to atomically replace a project file with a symlink after the agent has validated the path but before it writes, causing Claude Code to follow the link and write to an arbitrary file outside the sandbox - for example a shell configuration file that will later be sourced by a higher-privileged session. Exploitation is bounded: it requires local write access to a workspace shared with a more privileged Claude Code session, requires winning a narrow timing race rather than triggering deterministically, and requires the privileged session to actually perform a write to the targeted path; single-user installations with no shared workspace are not exposed. There is no indication of active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, though Anthropic has already shipped the fix through the standard auto-update channel, leaving only manual-update holdouts at risk.
Path traversal in the BugTracker.NET file download component allows an authenticated remote attacker to read files outside the intended download directory by supplying a manipulated filename parameter, exposing any file readable by the account running the web application. Exploitation requires a valid BugTracker.NET session (any account able to reach the download handler that accepts a user-supplied filename) and no user interaction; the blast radius is bounded by the operating-system permissions of the application's service account, so a hardened, least-privilege IIS identity materially limits the disclosure. The issue is rated 7.1 (CVSS 4.0) with high confidentiality impact and no integrity or availability effect, and there is no public exploit identified at time of analysis, though the low attack complexity and widespread wildcard CPE coverage make the class of bug attractive to post-authentication attackers who already hold a low-privileged account.
Authenticated Cloud Connect tenants can read arbitrary files on the Veeam Backup & Replication service provider host through a path traversal flaw (CWE-22). This affects service providers that deploy the Cloud Connect feature and serve tenants; standalone installations without Cloud Connect are not reachable via this tenant path. The attack is network-reachable and low-complexity with no user interaction, but impact is limited to read-only disclosure and no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a credible, above-average priority for Veeam Cloud Connect service providers, though not a drop-everything emergency on current signals.
Authenticated path traversal in the web portal of Satel Iberia's SenNet Datalogger Serie 200 allows a low-privileged portal user to read arbitrary files and list directories accessible to the web server's system account, exposing configuration or confidential data. The issue is scored CVSS 7.1 with a CVSS 4.0 vector of AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, and the independent assessment rates it a moderate-severity confidentiality issue rather than a top-priority emergency. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is highest where the device web interface is reachable from untrusted networks or where default, shared, or weak portal credentials are in use.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can execute an eligible template and influence an allowlisted Bitbucket repository to write files outside the expected working area, potentially compromising backend confidentiality, integrity, and availability. Affected are @backstage/plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server before 0.2.25 (shipped with Backstage before the v1.54.6 release). Exploitation requires an authenticated account with template-execution privileges, control over the contents of a repository already present in the Bitbucket allowlist, and the source-branch creation flow to be exercised, which is why the assessed vector carries high attack complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.5); this is not reachable by an anonymous remote attacker on a default install, and no public exploit code has been identified at time of analysis.
Unauthenticated path traversal in an API endpoint of HPE Aruba ClearPass Policy Manager allows a remote attacker to manipulate authorization logic and be assigned a role they were not intended to hold, yielding partial confidentiality, integrity, and availability impact (CVSS 7.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Because the vector is PR:N and UI:N, no credentials or user interaction are required - the practical barrier is network reachability of the ClearPass management/API interface, so internet-facing or broadly exposed deployments are the most at risk while those confined to isolated administrative networks are largely shielded. Exploitation status: no public exploit identified at time of analysis, and neither a CISA KEV listing nor an EPSS score was supplied with the source data; impact is bounded to role/authorization manipulation rather than full host compromise.
Path traversal in HPE Aruba ClearPass Policy Manager allows an authenticated attacker with access to the management interface to read and modify files on the underlying operating system. The independent assessment rates this as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, requiring a valid session and network reachability to the management plane; the vendor's stated vector with PR:N conflicts with the description's authentication prerequisite. No public exploit code or CISA KEV entry is identified at time of analysis.
Authenticated path traversal in the ClearPass Policy Manager command line interface allows a low-privileged remote user to escape the intended file path context and execute arbitrary code with elevated privileges on the underlying operating system. The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is network-reachable, low complexity, requires only valid low-privilege CLI credentials and no user interaction, and yields full confidentiality, integrity, and availability impact. Exploitation prerequisites are non-trivial: the attacker must already hold valid authenticated access to the ClearPass CLI, so exposure is bounded by how broadly low-privilege appliance accounts are provisioned and by how tightly management-plane access is restricted; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Path traversal in the Software Management Studio Software Repository (CWE-22) allows an authenticated remote user with repository-level privileges to read and write files anywhere on the underlying platform filesystem, far outside the repository's intended storage scope, by sending specially crafted requests or crafted file uploads. Successful exploitation results in complete loss of confidentiality, integrity and availability for the affected system (CVSS 4.0 base 8.6; independently assessed as CVSS 3.1 8.6 with AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The decisive limiting factor is the high-privilege prerequisite (PR:H) combined with the absence of any public exploit identified at time of analysis, so realistic risk is concentrated in insider misuse or reuse of already-compromised privileged repository credentials rather than opportunistic external attack; this is a conditional priority, not a drive-by threat.
Authenticated high-privilege users on Arista EOS can exploit a path traversal (CWE-22) in the Network Provisioning Image Repository to read or write files anywhere on the platform filesystem, escaping the intended storage scope via crafted requests or malicious file uploads. The issue requires valid credentials with image-repository permissions (CVSS PR:H), so the exploit population is limited to insiders or attackers who have already compromised a privileged account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the high confidentiality and integrity impact makes this a mid-to-high priority for affected deployments.
Unintended data can be extracted from Arista CloudVision Sensor by authenticated high-privilege users exploiting a path traversal flaw in CloudVision Portal (on-premises) and CloudVision Sensor, though the requirement for high privileges and additional preconditions limits the risk to moderate priority. No public exploit code has been identified, and the vulnerability is not confirmed as actively exploited. The flaw primarily impacts confidentiality, with no integrity or availability impact on the vulnerable component according to the independent assessment.
Path traversal in Dell System Update (DSU) versions prior to 2.3.0.0 allows an unauthenticated remote attacker to escape the intended restricted directory when the DSU client processes crafted pathnames in update content, resulting in filesystem access. Because DSU operates with elevated privileges, exploited path traversal can escalate to arbitrary code execution as root, potentially compromising both the application and the underlying operating system. Exploitation is not automatic: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) shows remote, unauthenticated reach but a mandatory user interaction step, and no public exploit code was identified at time of analysis. Dell has published a fixed release, and this is a genuinely high-priority flaw rather than merely a high-CVSS outlier.
Local privilege escalation and code execution in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local user to supply a crafted pathname that escapes the directory DSU intends to restrict, causing the elevated DSU process to read, write, or execute content from an attacker-controlled location. Exploitation yields complete loss of confidentiality, integrity, and availability on the affected host (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but it is not remotely reachable and requires the attacker to already hold a local low-privileged account or code-execution foothold; no public exploit code has been identified at time of analysis, EPSS is low at 0.22% (11th percentile), and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. Vendor-released patch: 2.3.0.0.
Path traversal in @quasar/icongenie versions before 6.1.1 lets a crafted profile cause the icongenie generate --profile command to write generated image content to any path writable by the invoking developer, enabling overwrite of shell startup files, build scripts, or other executable configuration. Exploitation requires the developer to run the command against an attacker-supplied profile (UI:R) and gives no direct remote access; no public exploit code identified at time of analysis, and the issue is fixed in 6.1.1.
Authenticated arbitrary file deletion in Payload CMS before version 3.90.0 (and canary releases before 4.0.0-canary.34) lets a user who can update or delete uploads stored on the local filesystem cause the file-cleanup routine to remove files outside the configured upload directory, resulting in data loss or service disruption. The flaw is a path traversal in the upload deletion logic that requires a valid account holding update/delete permission on an upload-enabled collection (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, score 8.1), so it is not exploitable by anonymous visitors. There is no public exploit identified at time of analysis and the issue is not reported as actively exploited; deployments using cloud/object storage adapters or restricting upload management to trusted operators are largely unaffected. Vendor-released patches are available in 3.90.0 and 4.0.0-canary.34.
Arbitrary file write through path traversal in lrzsz before 0.13.0 lets a malicious ZMODEM sender place files outside the current directory - including by absolute pathname - when the victim runs the lrz receive utility in restricted mode. Exploitation requires the victim to actively initiate or accept a ZMODEM transfer (UI:P/AT:P), the binary to be built without the --enable-pubdir option (the default, since only that build hardens checkpath()), and the attacker to control the sending side; the primitive is limited to files the receiving user account can already write, though overwriting SSH keys, shell profiles, or cron entries can extend impact. No public exploit identified at time of analysis, and the risk is a conditional integrity/availability issue rather than a mass-exploitation emergency given the user-interaction and build-configuration prerequisites.
Arbitrary file read in Rundeck before 6.2.0 lets an authenticated user who holds only the project 'configure' ACL read any file on the server by setting the resources.source.N.config.file property to an absolute path outside the project directory, then retrieving the contents through the editProjectNodeSourceFile or apiSourceGetContent endpoints. Recoverable data includes database passwords, LDAP bind credentials and configuration belonging to other projects, making this a meaningful lateral-movement aid for anyone with delegated project administration rights; there is no user-interaction requirement and no non-default configuration needed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but VulnCheck reported it and the vendor-released fix ships in Rundeck 6.2.0.
Unauthenticated arbitrary file deletion in the WordPress plugin Simple File List (versions through 6.3.11) lets remote attackers remove files from a vulnerable site without authenticating, without user interaction, and without any non-default configuration. The issue is rated 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H), with the limited integrity sub-score reflecting that the real damage depends on which files the web server user can delete - deleting wp-config.php or core files is far more severe than deleting an uploaded asset. No public exploit identified at time of analysis and the plugin is not listed in CISA KEV; this is nonetheless a genuine high-priority issue for WordPress sites running the affected plugin.
Arbitrary file deletion in Jobs for WordPress 2.8.2 and earlier allows authenticated Contributor-level users to delete arbitrary files via a path traversal flaw (CWE-22). The vulnerability is network-reachable, requires no user interaction, and has a CVSS score of 7.7 with high availability impact but no confidentiality or integrity impact. No public exploit has been identified at the time of analysis, and no vendor-released patch is available.
Unauthenticated directory traversal in kkFileView 5.0.0 through 5.0.2 lets remote attackers create arbitrary directories and write files outside the intended fileDir root via the fileUpload, createFolder, and existsFile endpoints, which concatenate an attacker-supplied 'path' parameter into the upload base path without any validation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms that no credentials and no user interaction are needed, and that the impact is integrity-only (C:N/A:N), meaning the attacker can plant content beyond the configured storage root but gains no direct read or availability effect. Exploitation is gated chiefly by exposure rather than configuration - kkFileView is typically deployed as an internal document-preview service - and no public exploit code was identified at time of analysis, so internet-facing, unauthenticated reachability of the upload endpoints is the real-world precondition for mass abuse.
Local file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered page image. When an application explicitly sets HTMLBackendOptions(render_page=True), has the optional Playwright dependency installed, and passes untrusted HTML as a filesystem Path, the HTML backend's browser request filter fails to enforce the enable_local_fetch setting or confine file:// access to the source document's directory, so an <iframe src="file:///..."> can pull in .env files, credentials, or other users' documents that Chromium then renders visibly into the output image. Publicly available exploit code exists and the issue is fixed in 2.118.1; EPSS is low (0.30%, 21st percentile) and there is no indication of active exploitation, so real-world priority is comparatively low despite the 7.5 CVSS, because exploitation demands a specific non-default configuration and disclosure is passive, read-only, and limited to text content Chromium renders in the viewport.
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter process and create or overwrite writable files when the caller has explicitly opted into Tectonic rendering via LatexBackendOptions(tikz_engine="tectonic"); enabling the additional tikz_engine_allow_shell_escape option escalates this to shell command execution through TeX. The default Docling configuration does not enable Tectonic rendering and is not affected, and exploitation further requires a victim or operator to feed the crafted document into the pipeline (UI:R), which is why the practical risk is conditional despite the high CVSS base score. Both docling and docling-slim are affected; the flaw is fully fixed in 2.132.0, EPSS is a low 0.30% (21st percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Code execution in Newell Brands DYMO ID 1.5.1.71 occurs because the application resolves its plugin Modules directory relative to the process working directory, letting an attacker who places a malicious plugin module or DLL alongside a crafted job file load arbitrary code at the victim's privilege level once that job file is opened. The issue is local and file-delivery based rather than network-reachable, requires explicit victim interaction (opening the crafted job), and grants only the privileges the victim already holds, so it cannot self-propagate; no public exploit code and no CISA KEV entry were identified at time of analysis. The vendor has released a fix in DYMO ID 1.6.0.
Authenticated Ghost Administrators on versions 6.10.3 through 6.63.x can achieve remote code execution by installing a crafted theme that abuses how Ghost resolves theme translation (i18n) files, allowing path traversal into attacker-controlled code. Exploitation requires a high-privilege Administrator account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) and no victim interaction beyond the attacker's own admin actions; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). Because the attacker population is limited to trusted or already-compromised admin accounts rather than anonymous remote users, this is a high-severity but access-gated issue rather than a mass-exploitation priority.
Authenticated high-privilege attackers with access to the Mitel MiVoice Office 400 web portal on TCP 443 can exploit a directory traversal in Maintenance → File Management → File Browser to delete files outside the intended directory, including application and Linux system files, causing denial of service. The flaw affects MiVoice Office 400 deployments exposing the portal, requires a valid administrative/maintenance account, and has no public exploit identified at time of analysis. The independent assessment rates it as a moderate-priority, authentication-gated destructive issue rather than a mass-exploitation threat.
Arbitrary file write in Mitel MiVoice Office 400 backup restoration can lead to root-level code execution if an attacker can supply a malicious TGZ archive to the configured backup repository; however, exploitation requires privileged access to the backup repository and a restore operation, making it a high-severity issue but not an indiscriminate internet-facing threat. No public exploit identified at time of analysis.
Papermerge 3.5.3 permits an authenticated standard user to achieve remote code execution by uploading a crafted file to /api/documents/upload with directory-traversal sequences in the filename, causing a malicious Python .pth file to be written into the interpreter's site-packages directory; the embedded code executes only when the Python interpreter next starts, for example on an application or worker restart. Publicly available exploit code exists via a GitHub PoC repository and accompanying PDF, and the flaw is conditionally gated by requiring the Papermerge process to have write access to site-packages and by the attacker not controlling restart timing, making it a credible but conditionally-gated RCE rather than an immediately triggerable one.
Path traversal in the Mitel MiVoice Office 400 web administration portal (https://<ip>:8443, reached through Administration -> View Logs) lets an authenticated administrator view or download sensitive system files that the portal's service context can read. Exploitation requires a high-privileged admin session and no user interaction, so the practical risk is access-gated: insiders, or attackers who have already stolen admin credentials or hijacked an admin session, are the realistic threat actors. The CNA rates it CVSS 4.0 8.4 with PR:H and a proof-of-concept-level exploit maturity metric (E:P), while our independent CVSS 3.1 assessment (7.2, AV:N/AC:L/PR:H/UI:N/C:H/I:N/A:N) characterizes it as a genuine but access-gated risk; no confirmed active exploitation (CISA KEV) or evidence of widespread attack activity appears in the available intelligence.
Path traversal in Legcord's theme IPC handlers (versions 1.1.0 through 1.3.0) allows an attacker who already has script execution inside the embedded Discord page - for example via XSS - to supply unvalidated theme ids to themes.folder, themes.uninstall, and themes.install and escape the themes directory. That yields arbitrary file writes, recursive directory deletion, and local executable launch, i.e. host code execution; CVSS 4.0 scores it 9.2 (Critical) with full confidentiality, integrity, and availability impact, and PR:N means no further authentication is required once the script foothold exists, while AC:H and AT:P capture that prerequisite. No public exploit code was identified at time of analysis and no CISA KEV listing is present.
ApiAdmin 5.0 and earlier allow any logged-in administrator to achieve remote code execution by uploading a .php payload to POST /admin/Index/upload; the handler takes the client-supplied extension verbatim with no whitelist, blacklist, or content inspection, and move_uploaded_file() places the file into the web-served public/upload/Ymd/ directory, where it can be requested directly over HTTP. The attack path is gated by an authenticated admin session (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2), so practical exposure hinges on credential compromise, reuse, or insider access rather than an unauthenticated vector. EPSS is low at 0.35% (26th percentile) and the issue is not listed in CISA KEV; no public exploit code is identified at time of analysis, though a public proof-of-concept write-up is referenced (GitHub fangtang7/CVE) and the European vulnerability entry EUVD-2026-92468 tracks the same CVE.
Path traversal in Unimall v4's FileUploadController.local() enables remote attackers to read arbitrary files outside the intended upload directory; the supplied CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, though that remains unconfirmed against the vendor's actual routing. Although the description claims arbitrary code execution, the same vector shows only high confidentiality impact (C:H/I:N/A:N), so RCE would require an unconfirmed write-into-webroot capability; our independent assessment notes that if such a write is possible, integrity and availability impacts could follow. No public exploit or CISA KEV listing was identified, and EPSS is low at 0.24% (13th percentile).
Directory traversal in WookTeam 1.6.6 and earlier lets a remote attacker read arbitrary files from the server through the /api/project/task/export endpoint by supplying the data parameter with a crafted JSON payload whose file value contains ../ sequences, which are concatenated into storage_path() and streamed back via response()->download(). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), so the flaw is treated as unauthenticated and read-only, though the independent assessment flags that real-world deployments of this team-collaboration app may require a session to reach the export route and defenders should confirm whether their instance exposes it pre-authentication. Exploitation pressure currently looks low - EPSS is only 0.21% (11th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis, even though a public technical write-up of the file-read behavior is linked from the CVE record; the practical risk is limited to files readable by the web-server process user.
Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.
Arbitrary file read and deletion in Formwork panel versions before 2.3.13 affect authenticated users who hold backup download or backup delete permissions. Exploitation requires a Linux deployment, where PHP basename() fails to treat backslashes as directory separators, allowing a base64-encoded backslash-separated traversal payload to escape the configured backup directory. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the impact is confined to file read and deletion with no code execution.
Path traversal (CWE-22) in image-downloader 4.3.0 allows an attacker who controls the download URL to write response data outside the configured destination directory, resulting in arbitrary file overwrite or corruption (CVSS 9.1, I:H/A:H, C:N). Per the CVSS vector, the flaw is network-reachable, low-complexity, unauthenticated, and requires no user interaction against the library, but exploitation is limited to applications that forward untrusted URLs to it. No public exploit code or active exploitation (CISA KEV) has been identified, and an upstream fix commit (fb44543) is available.
Authenticated Ghost administrators can obtain remote code execution by uploading a crafted theme whose translation (i18n/locale) files abuse path traversal (CWE-22) to load attacker-controlled content that the Node.js server then executes. The vulnerability affects Ghost 6.10.3 through every release before 6.64.0, and exploitation requires a full administrator account with access to the theme upload/management feature - anonymous visitors, members, authors, and editors cannot trigger it, and no end-user interaction is needed once admin rights are held. No public exploit code has been identified at time of analysis, and this is an access-gated risk rather than a drive-by threat; the vendor has shipped a fixed release, with details in advisory GHSA-jj74-hc2q-xrvm and a parallel VulnCheck advisory.
Unauthenticated path traversal in the Super Forms - Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316) allows remote attackers to read the contents of arbitrary files on the hosting server through the plugin's parse_request handling of form file uploads. In the default configuration the optional 'file_upload_auth' setting is empty, so no credentials are needed, although the vulnerable code path is only reachable when a form with the file upload feature is enabled on the site. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV entry); the practical impact is information disclosure of sensitive files such as configuration and credential material rather than modification or denial of service, and the supplied severity signals are internally inconsistent (the vendor score of 9.1 asserts integrity and availability impact while our assessment finds confidentiality-only impact).
Path traversal in the TaskingAI QR Code Generator plugin v0.3.0 allows an authenticated, low-privileged attacker to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter, affecting deployments where the plugin is enabled. Publicly available exploit code exists, and CISA's SSVC framework classifies the attack as non-automatable. Impact is primarily integrity (file overwrite) and availability (disk consumption or service disruption), with a CVSS of 8.1; the write is constrained to image-format content but may enable further compromise if sensitive paths are writable.
Path traversal in TaskingAI v0.3.0's DALL-E 3 image-generation tool lets an attacker who can invoke that tool write downloaded images to arbitrary locations on the server filesystem by injecting traversal sequences into the project_id parameter passed to save_url_image (CWE-22). The independent assessment scores this as an integrity-only file-write issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), which is materially more conservative than the CNA's 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) that asserts no privileges required and full confidentiality plus integrity impact - the vector conflict matters because it changes who is realistically in scope. Exploitation is not unconditional: the DALL-E 3 tool must be enabled and configured with valid image-generation API credentials and the attacker must be able to drive that pipeline with a controlled project_id; EPSS is 0.14% (3rd percentile), there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unvalidated pathnames in the Teledyne FLIR Aware2 web interface let remote unauthenticated attackers read configuration and security parameters from PackBot robots running Aware2 through 6.9.0.2 and FirstLook robots running Aware2 through 1.7.9 via path traversal. The CVSS 4.0 vector rates this 10.0, but the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting information disclosure only with no write or command-execution capability described. No authentication, credentials, or user interaction are required (PR:N/UI:N); there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so real-world risk is governed mainly by whether the robot's management web interface is reachable from an untrusted network.
Stored local file inclusion in GetSimple CMS CE 3.3.22 and earlier lets any authenticated account holding page-editing rights save an arbitrary filesystem path into a page's template attribute, which the public front-end then passes unsanitized to PHP include() whenever that page is requested - including by anonymous visitors. The payoff is disclosure of any readable local file and, if the included target contains PHP (a log, an uploaded file, or attacker-planted content), code execution in the web server's context. Publicly available exploit code exists and no vendor-released patch was identified at time of analysis; the main limiting factor is that the attacker must first possess a legitimate page-editing account, which keeps this a real but conditional risk rather than an unauthenticated emergency.
Remote code execution in GetSimple CMS CE prior to 1.5 allows an attacker to plant and execute PHP code as the web-server user by getting the UpdateCE.php handler to process a malicious ZIP archive. The handler extracts archive contents into the web-accessible root without validating file types or paths, so PHP webshells and ../ traversal writes are possible; publicly available exploit code exists, and SSVC rates it not automatable. Exploitation is high impact (CVSS 9.1) but constrained by the need to trigger the update through an administrator session or high existing privileges, so it is not mass-exploitable; version 1.5 contains the fix.
Unauthenticated path traversal in Fortinet FortiMail (7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6 and 8.0.0-8.0.1) lets a remote attacker write arbitrary files on the underlying system via crafted HTTP or HTTPS requests, yielding CVSS 9.8 with full confidentiality, integrity and availability impact. CISA has added the CVE to its Known Exploited Vulnerabilities catalog, so it is confirmed actively exploited (CISA KEV), and publicly available exploit code exists, making unpatched internet-reachable gateways an urgent remediation priority. Exploitation requires only that the FortiMail HTTP/HTTPS interface be network-reachable - no authentication (PR:N) and no user interaction (UI:N) - so environments that confine management/web access to trusted networks or a VPN substantially reduce exposure.
Authenticated path traversal in Vvveb CMS prior to version 1.0.8.6 allows an admin-panel user with backup access (default role site_admin or higher) to read and delete arbitrary files on the server, enabling database credential theft from config/db.php, disclosure of host files such as /etc/passwd, and site takeover by deleting the database configuration to force the installer back into setup mode. The vulnerability sits in the central path sanitizer used by the backup/file functionality and is reachable only with the high privilege level reflected in its CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis. The vendor released a patch in 1.0.8.6 that adds recursive filtering to sanitizeFileName(), so unpatched instances below that version remain exposed.
Authenticated WordPress administrators can abuse the Prime Mover plugin before 2.2.1 to delete arbitrary directories outside the intended extraction path by importing a crafted WPRIME/TAR package whose wprime-config.json contains manipulated tar_root_folder values, ultimately tricking primeMoverDoDelete() into removing critical directories such as wp-admin, which can render the site inoperable. Exploitation requires a high-privileged WordPress administrator account (CVSS PR:H) that performs the package import, so this is not reachable by unauthenticated or low-privileged users; no user interaction beyond the admin's own import action is required. This is a moderate, not top-tier, priority issue: no public exploit code has been identified and there is no CISA KEV listing, though the confidentiality impact is nil while integrity and availability impacts are high, and the vendor has released a fix in version 2.2.1.
Authenticated WordPress administrators using the Prime Mover migration plugin before version 2.2.1 can abuse a Zip Slip path traversal (CWE-22) to write attacker-controlled files to arbitrary filesystem locations outside the intended extraction directory, which may escalate to remote code execution when the written path is PHP-executable by the web server. The flaw is reached through the plugin's migration ZIP import workflow, where malicious ZIP entry names are processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php. Exploitation requires a high-privileged admin account (CVSS PR:H, AV:N, UI:N) and crafted archive contents; no public exploit code was identified at time of analysis, and the vendor has released a patch. The risk is genuine but access-gated, since the admin prerequisite is the primary limiting factor and full RCE additionally depends on the hosting configuration.
Arbitrary file write as the grading teacher in Classroom 50 (the `gh teacher` CLI) before 1.11.0 lets an enrolled student escalate from a writable assignment repository to code execution in the teacher's session: because `gh teacher download` writes autograde artifacts (`result.json` and `results.json`) into the just-cloned student working tree without guarding pre-existing entries, a student who commits either name as a symlink, hardlink, FIFO or directory redirects that write to any path the teacher can reach - `~/.ssh/authorized_keys`, `~/.zshrc`, a cron file, or an in-clone `.git/hooks/*` script that git then executes. The written bytes are attacker-controlled (the student's uploaded release asset for `result.json`, or student-chosen submit-tag names for `results.json`), and the compromised `gh` token carries `admin:org`, `repo` and `workflow` across the whole classroom organization. Rated 9.4 under CVSS 4.0 and high priority by our independent review, exploitation is not anonymous and not zero-click: it requires classroom enrollment, a planted malicious entry, and the teacher running the vulnerable command against that untrusted repository (UI:P); no public exploit code was identified at time of analysis, no CISA KEV listing is present, and no EPSS score was supplied. Version 1.11.0 contains the patch.
Unauthenticated remote attackers can delete arbitrary files on any WordPress site running the AcyMailing SMTP Newsletter plugin 11.0.5 or earlier, because the plugin does not properly constrain caller-supplied file paths before deleting them (CWE-22 path traversal). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N shows no authentication, no user interaction and no special configuration is required - only that the vulnerable plugin version is installed and the vulnerable HTTP endpoint is reachable and not firewalled or WAF-blocked. Deletion is bounded by the web server process's filesystem permissions, but that still covers wp-config.php, .htaccess, plugin/theme files and uploads, so successful exploitation leads to site outages, data loss or a path to full site takeover; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated local file disclosure in Tornado before 6.5.9 lets remote attackers read files outside a configured static root by requesting a symbolic link that lives inside that root but resolves elsewhere, exposing configuration files, private keys, and application secrets readable by the Tornado process user. Exploitation is a single GET request requiring no authentication and no user interaction (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), but it depends on a precondition rather than being turnkey: an out-of-root symlink must already exist inside the static directory, a situation the upstream advisory says arises in applications serving user-uploadable content or where build/deploy pipelines (npm link, webpack, Docker volume mounts, CDN sync tools) create symlinks. The issue is fixed in 6.5.9, public reproduction steps are published in the upstream GitHub Security Advisory, and there is no CISA KEV listing.
Path traversal in the n8n node of the n8n workflow automation platform lets an attacker supply a crafted resource identifier that redirects the node's authenticated API calls to unintended resources, exposing workflows, execution data, and stored credential secrets that fall inside the scope of the API key in use. Affected deployments are n8n before 1.123.80, 2.0.0 through 2.39.6, and 2.40.0 through 2.40.1; patched builds (1.123.80, 2.39.6, 2.40.1) remove the exposure. The CVSS 4.0 vector scores it 8.1 (AV:N/AC:L/AT:P/PR:N/UI:N with high confidentiality and integrity impact and low availability impact), and because exploitation presupposes an n8n node configured with an n8n API key credential (AT:P), impact is bounded by that key's authorization scope; no confirmed active exploitation (CISA KEV) was identified, though the vector's E:P metric indicates proof-of-concept-level exploit maturity and the EPSS-style risk picture is driven by the high confidentiality/integrity weighting.
Path traversal in the n8n Supabase node allows unauthenticated remote attackers to pivot to Supabase Auth and Storage APIs when a workflow binds the tableId parameter to untrusted input, bypassing Row Level Security and enabling unauthorized data access and modification. Affects n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; fixed in 1.123.80, 2.39.6, and 2.40.1. No public exploit identified at time of analysis. Exploitation requires the Supabase credential to use the administrative serviceRole key and a workflow with a dynamic tableId - a victim-side configuration dependency that is the primary limiting factor, consistent with the assessed attack requirement (AT:P) and high attack complexity (AC:H).
Cross-project approval forgery in n8n's Send-and-Wait approval feature allows an authenticated attacker with workflow-creation permissions to mint valid signed resume URLs for approval gates in projects they cannot access by supplying caller-controlled node IDs that contain unresolved path-traversal sequences. Affected releases are n8n before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1; the issue is meaningful primarily in multi-project or multi-tenant deployments where project isolation is relied upon as a security boundary. The independent assessment rates this as a genuine but moderate-severity issue with low likelihood of mass exploitation; no public exploit identified at time of analysis, and vendor patches are available.
Unauthenticated path traversal in Hitachi Coding Software Suite through 3.3.0 lets remote attackers read, create, modify, or delete arbitrary files on the affected host, a near worst-case profile with high confidentiality, integrity, and availability impact (CVSS 4.0 base 9.3; assessed CVSS 3.1 9.8-class vector AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The flaw requires only network reachability to the suite's file-handling interface - no authentication, user interaction, or special configuration is needed - so an attacker who can reach the service can fully control file content on the coding/marking system. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the real-world risk hinges on exposure: this industrial coding/marking software is typically deployed on isolated OT or plant networks, so hosts reachable from an attacker-controlled segment carry the greatest risk.
Absolute path traversal in langflow-ai Langflow through v1.8.4 lets a remote attacker write or overwrite files anywhere the Langflow process can reach by supplying an attacker-controlled absolute path or filename to the knowledge-base creation endpoint (HTTP POST /api/v1/knowledge_bases, handler at src/backend/base/langflow/api/v1/knowledge_bases.py:51), which forwards that input into host file creation without enforcing a workspace or storage boundary. The CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) rates it unauthenticated with high integrity impact, although the independent assessment notes that installations enforcing API login make a valid session the practical prerequisite and that the blast radius is capped by the OS privileges of the Langflow service account. Exploitation pressure is currently low per EPSS (0.23%, 13th percentile), and no public exploit has been identified at time of analysis.
Path traversal in Langchain-Chatchat 0.3.0 and 0.3.1 allows unauthenticated remote attackers to write knowledge base content to arbitrary filesystem locations outside the configured knowledge base root by injecting traversal sequences such as `..\` into the `knowledge_base_name` parameter of the knowledge base creation and document upload interfaces. The independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (9.1), i.e. no confidentiality loss but high integrity and availability impact, since arbitrary file writes can overwrite or clobber existing files and, depending on which paths the service process can reach, may be escalated toward code execution. Not listed in CISA KEV and no public exploit identified at time of analysis; EPSS is 0.14% (roughly the 3rd percentile), so automated mass exploitation is unlikely, but the advisory references an upstream GitHub issue and a public gist that may carry additional technical detail.
Unauthenticated path traversal in the OpenAI-compatible /v1/files upload endpoint of Langchain-Chatchat 0.3.0 allows remote attackers to write files to arbitrary locations outside the intended openai_files directory by supplying crafted filenames. The published CVSS is 9.1, but an independent assessment re-scores the issue at 8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - because the primitive is a file write rather than a read or direct code execution, so confidentiality is unaffected and availability impact is limited. There is no confirmed active exploitation (CVE-2026-51882 is not in CISA KEV) and no public exploit identified at time of analysis, and with an EPSS score of 0.14% (3rd percentile) real-world urgency is driven mainly by whether the API server is network-reachable and how much filesystem write access the service account has.
Path traversal in Devika v1.0's Patcher Agent allows remote attackers to write files outside the intended project workspace by supplying paths containing ../ traversal sequences to the save_code_to_project routine. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5), indicating high integrity impact with no confidentiality or availability effect, and publicly available exploit code exists (SSVC Exploitation: poc) - but there is no CISA KEV entry confirming active exploitation. EPSS is very low at 0.15% (4th percentile), and real-world urgency is bounded by deployment reality: Devika is typically self-hosted by an individual developer, so the practical risk depends on whether the instance is network-reachable and whether its agent actually processes attacker-influenceable tasks or repository content.
Unauthenticated remote clients can escape the intended bot workspace and write or overwrite arbitrary absolute filesystem paths through DeepTutor 1.4.0's live 'tutorbot' WebSocket interface, because the EditFileTool.execute path-traversal flaw (CWE-22) fails to contain caller-supplied paths to the workspace root; with CVSS 3.1 AV:N/AC:L/PR:N/UI:N and total confidentiality/integrity/availability impact, this rates 9.8 and can corrupt configuration, application code, or authentication material. Publicly available exploit code exists (SSVC Exploitation: poc, Automatable: yes) and the issue is tracked upstream as HKUDS/DeepTutor issue 517 with a public proof-of-concept gist, but there is no KEV-confirmed active exploitation and EPSS is low at 0.14% (3rd percentile), so the practical risk is concentrated on instances whose tutorbot WebSocket is internet-reachable rather than restricted to localhost or a trusted network.
Unauthenticated path traversal in Langchain-Chatchat 0.3.1 lets a remote attacker write files to arbitrary filesystem locations by submitting crafted filenames to the /knowledge_base/upload_temp_docs temporary document upload endpoint, escaping the intended temporary directory. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the endpoint is reachable over the network with no authentication and no user interaction required, and that a successful write can corrupt or replace application or system files, with potential escalation to code execution if an overwritten file is later imported or executed by the service. Independent risk signals are mixed: EPSS is low at 0.15% (4th percentile) and there is no CISA KEV listing, so no public exploit identified at time of analysis, but the associated GitHub issue and gist references document the endpoint's traversal behavior and raise the likelihood of straightforward replication by anyone with network access to a default deployment.
Path traversal in the Devika v1.0 Feature Agent's save_code_to_project routine lets a remote caller who can submit a task or feature request to a Devika instance cause the agent to write files outside the intended project workspace, using the privileges of the local Devika process. The flaw is unauthenticated per the scored CVSS vector (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists; CISA's SSVC rates it automatable with total technical impact, although EPSS is low at 0.14% (3rd percentile) and there is no KEV confirmation of active exploitation. Our independent assessment rates confidentiality impact as limited while integrity and availability impacts are high, and the decisive real-world factor is exposure: Devika is normally a single-developer tool bound to localhost, so remote exploitation depends on an operator having published the web UI/API to a network.
Arbitrary file write through directory traversal in Devika v1.0's Coder.save_code_to_project function lets an attacker who can steer the agent's generated filename or project path - using sequences such as '../' - save files outside the intended project workspace. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) requires low-privilege access per PR:L, but Devika v1.0 ships without authentication by default, so any instance reachable over the network is effectively exposed; the real limiting factor is deployment posture, since Devika is commonly bound to localhost for a single developer, which eliminates remote reachability. Exploitation is not confirmed active: there is no CISA KEV entry, no public exploit code identified at time of analysis, and EPSS is only 0.26% (16th percentile), so the composite signal set sits noticeably below the 8.8 headline score.
An authenticated administrator of Kiteworks Email Protection Gateway can exploit a path-traversal weakness to write a file outside its intended location and have the application execute it, resulting in remote code execution as the gateway's underlying service account. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): it is network reachable and low complexity, but gated behind high-privilege administrator credentials, which substantially constrains real-world exposure and makes this a moderate, not urgent, priority. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Path traversal (CWE-22) in Kiteworks Email Protection Gateway allows an authenticated administrator to move files to locations outside the designated directory of an optional, non-default administrative file-move feature, which can potentially be leveraged to execute arbitrary code on the underlying host. The vulnerability is network-reachable with no user interaction (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but exploitation requires high-privileged administrator credentials and that the optional feature be enabled - environments running default configurations without this feature are not exposed. Only the CVE.org advisory and a CISA CSAF record are available at time of analysis, and no public exploit code has been identified; the admin-privilege prerequisite and non-default feature gate are the primary factors limiting real-world exploitation.
Unauthenticated path traversal in the Kiteworks Core appliance setup interface allows an attacker who can reach that interface to write a file to any location writable by the appliance service account, enabling integrity compromise of the appliance or a denial-of-service condition that persists until an operator intervenes. The exposure is narrow: the setup interface is not reachable on a fully configured appliance in its default configuration, so exploitation is realistically limited to the transient provisioning window of a new appliance or a non-default configuration that leaves setup exposed, which is why AC:H applies despite PR:N and UI:N (CVSS 7.4). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw does not by itself provide code execution.
Arbitrary command execution on Kiteworks Email Protection Gateway is possible in all versions before 9.5.0: an authenticated administrator can import a crafted configuration file whose contents are insufficiently validated, allowing commands to run on the appliance with the privileges of the gateway service (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires PR:H, this is not a remote unauthenticated attack - it is realistically an insider, malicious-admin, or post-credential-compromise escalation from administrative access to full code execution on the gateway. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix is version 9.5.0.
Arbitrary file write in Kiteworks Core before 9.5.0 lets a holder of an existing administrative account steer the platform's administrative export feature to write files to any path on the underlying host, which can be chained into command execution on the appliance. The root cause is an improper restriction of a user-supplied file path (CWE-22), scored CVSS v3.1 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so the flaw is not reachable by unauthenticated or standard users and command execution is a downstream consequence of the write rather than a guaranteed outcome. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis; the primary constraint on real-world risk is the high-privilege prerequisite.
Path traversal in the administrative import function of Kiteworks Email Protection Gateway allows an authenticated administrator to write files to arbitrary filesystem locations, which can potentially be escalated to arbitrary code execution on the underlying server. All versions prior to 9.5.0 are affected; exploitation requires a high-privileged admin account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) and the impact on confidentiality, integrity, and availability is rated High. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the EPSS score was not provided in the available intelligence.
Arbitrary file write during plugin installation in ZeroClaw before 0.8.5 (when built with the plugins-wasm feature) lets attackers place files outside the plugins directory by supplying a crafted manifest.toml whose wasm_path field contains '..' or absolute/root/drive-prefix components; overwriting shell startup files or similar executed content yields code execution under the victim's account. The attack is local (AV:L) and unauthenticated per the assessed vector (PR:N), but it requires user interaction (UI:P/UI:R) - the victim must be persuaded to install the attacker-supplied plugin package - and only functions when plugin signature verification is left in its default Disabled mode, making the path check the sole gate. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in v0.8.5.
Arbitrary file write in oc-mirror allows an attacker who controls or tampers with an operator catalog image to write files outside the intended extraction directory when a user mirrors that catalog using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature). The issue is a path traversal (CWE-22) in tar entry extraction, assessed as local (AV:L), no privileges required (PR:N), but requiring user interaction (UI:R) because an administrator must run the mirror command; impact is high integrity and low availability, with no confidentiality impact per the independent assessment. No public exploit or active exploitation is identified at time of analysis, and the independent assessment characterizes this as a moderate, defender-actionable issue rather than an urgent internet-facing emergency.
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.2.19 and allows a user holding only Contributor-level privileges to manipulate file paths and reach files outside the intended directory, primarily exposing sensitive data with limited integrity and availability effects. Exploitation requires a valid low-privilege account - self-registration must be enabled or an account otherwise obtained - and is rated high complexity (AC:H), meaning success depends on specific, not-guaranteed conditions; the issue is remote, needs no user interaction, and no public exploit has been identified at time of analysis. It is not confirmed actively exploited (no CISA KEV listing), and while the vendor-supplied CVSS of 7.5 and the scorer's high confidentiality/integrity/availability ratings read alarming, the practical risk is moderate because the attack is gated behind an authenticated Contributor role and elevated complexity.
Unauthenticated arbitrary file download in the NextGEN Gallery WordPress plugin affects every site running version 4.5.0 or earlier, allowing a remote attacker with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, base score 7.5) to retrieve files that are readable by the web server process. Rooted in a path-traversal weakness (CWE-22) in the plugin's file download handling, the impact is confined to confidentiality - typical targets are wp-config.php, database credentials, environment files, and backup archives - with no file write or code execution. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, though the reachable default-configuration attack path makes it a genuine priority rather than a paper-tiger high-CVSS issue.
Arbitrary file read in Digiwin EasyFlow .NET allows an authenticated remote user to download files from the underlying host outside the intended document scope, exposing configuration files, credentials, or other sensitive data. Exploitation requires a valid low-privilege session (PR:L per the CVSS v4.0 vector and the corroborating CVSS v3.1 assessment) but no user interaction and only low attack complexity, so any party holding a legitimate account can reach the flaw over the network. Impact is confined to confidentiality - the vulnerability does not modify data or affect availability - and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Unauthenticated arbitrary file read in the Product Designer App plugin for WordPress (all versions up to and including 1.1.3) lets any remote visitor retrieve the contents of files on the web server through the plugin's 'svg' parameter. The only access control on the vulnerable AJAX endpoint is a nonce and token that the plugin prints as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, so an anonymous attacker who loads such a page can lift those values and pass them along with a crafted traversal path. Per the supplied assessment the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) reflects a fully remote, unauthenticated, low-complexity, no-interaction confidentiality-only flaw; no CISA KEV entry and no public exploit code were identified in the provided data, and no EPSS score was supplied, so exploitation status is assessed as unproven but technically trivial once a shortcode-bearing page exists.
Directory traversal in Handlebars.java before 4.5.5 lets unauthenticated remote attackers read arbitrary files outside the configured template base directory in Spring MVC applications that use the handlebars-springmvc integration. The flaw specifically affects handlebars-springmvc 4.5.3 and 4.5.4, where the path-containment check added for CVE-2026-63490 validates template locations as raw percent-encoded strings while the template file is ultimately opened through a URL handler that percent-decodes the path, so a request-derived view name containing %2e%2e/ slips past both the view-resolver and loader-side checks. Exploitation is not confirmed in the wild and no public exploit code has been identified at time of analysis, but it requires two non-default conditions to hold simultaneously: a file: template location prefix and a Handlebars view name derived from untrusted request input, which keeps real-world priority moderate despite the 7.5 CVSS score. Impact is limited to confidentiality (arbitrary file read); integrity and availability are unaffected.
Directory traversal in Agent Zero 1.7 through 1.10 lets the AI agent's file-browser component read files anywhere on the host, because FileBrowser is initialized with the host root as its workspace rather than a confined sandbox. The CVSS 3.1 vector is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), which models unauthenticated network access, but the practical risk is gated by whether the Agent Zero UI is exposed to untrusted networks; Agent Zero is often a local single-operator tool, so the AV:N/PR:N rating only applies when that interface is deliberately reachable without an authentication layer. At time of analysis there is no confirmed active exploitation (no CISA KEV entry) and no public exploit identified at time of analysis, and EPSS is 0.33% (24th percentile), indicating low predicted exploitation activity; reference material consists of a GitHub issue and a gist.
Directory traversal in Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 allows unauthenticated remote attackers to read arbitrary files from the server filesystem through the Linsight task-execution endpoint implemented in src/backend/bisheng/linsight/domain/task_exec.py. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates no authentication or user interaction is required against default configurations, with impact bounded to confidentiality - disclosure only, no code execution or file modification. Publicly available exploit code exists (SSVC exploitation status 'poc'; a public gist accompanies the report), but the vulnerability is not confirmed actively exploited (no CISA KEV entry), and EPSS is low at 0.33% (24th percentile), so priority should be driven by whether an organization actually exposes a Bisheng instance to untrusted networks.
Directory traversal in Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 lets a remote attacker use crafted filename/path input to break out of the intended download/cache directory through the save_download_file routine (src/backend/bisheng/core/cache/utils.py:290), yielding arbitrary file read and write with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector indicates an unauthenticated, network-reachable attack with no user interaction, though the practical limiting factor is whether the API route that reaches save_download_file is exposed without a login - defenders should verify that against their own deployment before assuming unauthenticated reachability. Exploitation status: no public exploit identified at time of analysis, and there is no CISA KEV entry; EPSS is 0.33% (24th percentile), so mass exploitation is not currently expected, but the impact per successful attack is severe given the high confidentiality and integrity ratings and the absence of any availability impact.
Path traversal in DB-GPT 0.7.5 and 0.8.0 lets remote attackers write arbitrary files outside the intended upload workspace through the OpenAPI python_file_upload endpoint at packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42. The affected service is the DB-GPT web API and the vector is rated critical (CVSS 9.1, AV:N/AC:L/PR:N/UI:N), so exploitation hinges on network reachability of the instance rather than on any attacker-held credentials - DB-GPT ships its API without enforced authentication by default, which is why the score is PR:N. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.47% (38th percentile), so this is a genuine but not yet mass-exploited issue. Note a scoring divergence: NVD rates confidentiality and integrity high with no availability impact, while our independent assessment rates integrity and availability high and confidentiality none.
Relative path traversal in Satel Netco Design versions prior to v2.1.7 lets an authenticated user holding only Viewer privileges write attacker-influenced files to any filesystem location reachable by the application service account, which can escalate to arbitrary code execution where a writable location is later executed or loaded by the service. The flaw affects the product's data export functionality (CWE-23) and is remotely reachable over the network, but requires a valid low-privileged account (CVSS 3.1 vector PR:L), so anonymous access is not sufficient. Rated 8.7 under CVSS 4.0 and reported through CISA ICS-CERT advisory ICSA-26-281-03; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. The full RCE outcome is conditional on deployment-specific file-write-then-execute paths; absent those, impact is confined to unauthorized file creation or modification within application-accessible directories.
Path traversal (CWE-22) in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 allows a remote, unauthenticated attacker to write arbitrary files on the affected appliance or container by supplying crafted path components. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) exploitation is network-reachable, low-complexity and unauthenticated, with high integrity impact and no confirmed confidentiality or availability impact - a file-write primitive rather than a file-read or denial-of-service bug. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor has released a patch and the sole reference is IBM's advisory at https://www.ibm.com/support/pages/node/7291628. Exposure is bounded by network reachability: instances sitting behind reverse proxies or confined to internal/DMZ segments that attackers cannot reach are not directly exploitable.
Unauthenticated path traversal in IBM Guardium Data Protection 12.2 allows a remote attacker who can reach the GIM (Guardium Installation Manager) file-upload interface to escape the intended upload directory and write arbitrary files onto a Collector host. The assessed vector (AV:N/AC:L/PR:N/UI:N, integrity impact) confirms that no credentials or user interaction are required against that endpoint, so any 12.2 Collector whose GIM upload service is reachable is exposed until patched; the practical attack surface is driven almost entirely by network segmentation of GIM. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed as active - impact is file-system write access on the Collector, scoring CVSS 7.5.
Processing an attacker-controlled Protobuf schema with datamodel-code-generator 0.59.0 through 0.80.0 lets a crafted weak-import path escape the `__weak_imports__` temporary directory, creating directory trees and new files, or overwriting existing files that are writable by the running process (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N; the vendor-reported vector is 7.5 with a higher integrity rating). Exploitation requires a victim or automated CI job to invoke the tool with `--input-file-type protobuf` on a malicious .proto supplied locally via `--input` or remotely via `--url`, and the grpcio-tools package must be installed to enable Protobuf input support; the payload is limited to a `syntax = "proto2";` or `syntax = "proto3";` declaration, so fully attacker-controlled content and direct arbitrary code execution have not been demonstrated. No active exploitation is confirmed (not in CISA KEV), though the upstream GitHub advisory carries a proof-of-concept and technical write-up, and the fix ships in version 0.81.0.
Path traversal in decompress-zip through 0.3.3 allows a crafted ZIP archive to write files outside the intended extraction directory when a victim or application uses the package to extract it, potentially enabling arbitrary file overwrite, application compromise, or code execution in environments with a useful writable sibling path. The assessed vector is local (AV:L) with required user/application interaction (UI:R), no network exposure, and no special authentication (PR:N), so exploitation requires the attacker to deliver the archive into an extraction workflow; RCE is conditional, not guaranteed. No public exploit identified at time of analysis, and no CISA KEV active-exploitation report was provided; the overall risk is real but conditional rather than an urgent mass-exploitation threat.
Unauthenticated path traversal in the Ollama `/api/pull` endpoint lets a remote attacker write an arbitrary file outside the model store by submitting a crafted path-traversal sequence in the layer digest field, because the `digestToPath` function does not adequately validate digests before constructing a filesystem path. When the Ollama process can write to `/usr/lib/ollama` (described as the default in most Ollama Docker images) and the server or container is subsequently restarted, the planted binary is loaded and executed, yielding remote code execution as root; the same file-write primitive is available without authentication to anyone who can reach the API. The issue is fixed in Ollama 0.35.0, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none', and no EPSS score was supplied in the source data. Real-world risk is high but conditional: exploitation of the full RCE chain depends on write access to `/usr/lib/ollama` and a restart, so deployments not using the default Docker image, running Ollama as a non-privileged user without write access to that directory, or not exposing the API to untrusted networks face substantially reduced exposure.
Path traversal in Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 lets an unauthenticated attacker write arbitrary files to restricted host locations by embedding traversal sequences in entries of a support-bundle archive that ASCG ingests from remote endpoints, with the potential for follow-on remote code execution if a written path is later executed or loaded. The attack is not internet-facing: exploitation is scored AV:A (adjacent network) with the CVSS 4.0 AT:P precondition, meaning the attacker must already control or be able to man-in-the-middle support bundles originating from a compromised or spoofed ingesting endpoint. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the practical risk is a moderate, conditional one that depends on an attacker holding a management-network position and a compromised ingestion source rather than an urgent, broadly exploitable issue.
Path traversal in the HTTP service component of Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 allows an unauthenticated attacker positioned on the same local or adjacent network segment to send a manipulated API request that escapes intended path restrictions and performs arbitrary file read or file write operations (the description also references file deletion, although the assessed impact is high confidentiality and integrity with no availability effect). The flaw is exploitable without credentials or user interaction in default configurations of affected releases, but only from an adjacent network - it is not reachable from the public internet without first obtaining such a position. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score accompanied the available intelligence.
Arbitrary code execution on the Vault host is achievable in HashiCorp Vault and Vault Enterprise when a privileged operator restores a crafted Integrated Storage (Raft) snapshot in a deployment configured with Shamir seals and an external plugin directory, because stored plugin catalog entries are not consistently verified to reference binaries inside that configured directory (CWE-22 path traversal). The attacker must already hold the high privileges needed to restore a Raft snapshot (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), and exploitation also depends on the non-default Shamir-seal-plus-external-plugin-directory configuration, so this is a genuinely serious but condition-gated vulnerability rather than a mass-exploitation threat; clusters using auto-unseal or without an external plugin directory are not affected by this path. No public exploit identified at time of analysis, and vendor-released fixes are available in Vault Community Edition 2.1.2 and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-techdocs-node) lets an authenticated user who can register or modify documentation sources make a TechDocs build read files or fetch URLs outside the documentation boundary, potentially exposing backend-host data or internal network resources (path traversal, CWE-22). Affected versions are those before 1.14.6 on the 1.14 line and before 1.15.4 on the 1.15 line; the impact is changed-scope with high confidentiality loss and no integrity or availability impact, and it applies to deployments where the Backstage backend generates TechDocs from those sources rather than relying on externally sandboxed CI. Exploitation requires an authenticated principal with documentation-source registration or modification rights (PR:L), and no public exploit code has been identified at time of analysis; this is assessed as a credible, patch-worthy issue rather than an emergency, with vendor fixes released in @backstage/plugin-techdocs-node 1.14.6 and 1.15.4 plus pymdown-extensions 10.21.3 or newer.
Path traversal in Backstage's optional @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package (versions before 0.3.25) allows an authenticated user who can execute a template using the confluence:transform:markdown action and control the repository file location to write generated content outside the task workspace, potentially overwriting files writable by the Backstage backend process. The vulnerability is rated CVSS 7.1 with high integrity and low availability impact but no confidentiality impact; exploitation requires the module to be installed and enabled, and the attacker must supply directory-traversal sequences in the repoUrl input. The issue is fixed in version 0.3.25 (Backstage release v1.54.6), and no public exploit has been identified at time of analysis.
Remote code execution in SonicWall SMA1000 (Appliance Management Console) can be triggered by an authenticated administrator who uploads a crafted archive containing path traversal sequences, allowing files to be written outside the intended extraction directory and leading to code execution. The vulnerability is a classic Zip Slip (CWE-22) issue with a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker must already hold high/administrative privileges on the AMC-a significant precondition that sharply limits the pool of realistic attackers to compromised or malicious administrators. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none), so this is a conditional high-severity risk rather than a mass-exploitation emergency.
A time-of-check to time-of-use (TOCTOU) race condition in Anthropic's Claude Code CLI allows an attacker who already has write access to a shared project workspace to atomically replace a project file with a symlink after the agent has validated the path but before it writes, causing Claude Code to follow the link and write to an arbitrary file outside the sandbox - for example a shell configuration file that will later be sourced by a higher-privileged session. Exploitation is bounded: it requires local write access to a workspace shared with a more privileged Claude Code session, requires winning a narrow timing race rather than triggering deterministically, and requires the privileged session to actually perform a write to the targeted path; single-user installations with no shared workspace are not exposed. There is no indication of active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, though Anthropic has already shipped the fix through the standard auto-update channel, leaving only manual-update holdouts at risk.
Path traversal in the BugTracker.NET file download component allows an authenticated remote attacker to read files outside the intended download directory by supplying a manipulated filename parameter, exposing any file readable by the account running the web application. Exploitation requires a valid BugTracker.NET session (any account able to reach the download handler that accepts a user-supplied filename) and no user interaction; the blast radius is bounded by the operating-system permissions of the application's service account, so a hardened, least-privilege IIS identity materially limits the disclosure. The issue is rated 7.1 (CVSS 4.0) with high confidentiality impact and no integrity or availability effect, and there is no public exploit identified at time of analysis, though the low attack complexity and widespread wildcard CPE coverage make the class of bug attractive to post-authentication attackers who already hold a low-privileged account.
Authenticated Cloud Connect tenants can read arbitrary files on the Veeam Backup & Replication service provider host through a path traversal flaw (CWE-22). This affects service providers that deploy the Cloud Connect feature and serve tenants; standalone installations without Cloud Connect are not reachable via this tenant path. The attack is network-reachable and low-complexity with no user interaction, but impact is limited to read-only disclosure and no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a credible, above-average priority for Veeam Cloud Connect service providers, though not a drop-everything emergency on current signals.
Authenticated path traversal in the web portal of Satel Iberia's SenNet Datalogger Serie 200 allows a low-privileged portal user to read arbitrary files and list directories accessible to the web server's system account, exposing configuration or confidential data. The issue is scored CVSS 7.1 with a CVSS 4.0 vector of AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, and the independent assessment rates it a moderate-severity confidentiality issue rather than a top-priority emergency. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is highest where the device web interface is reachable from untrusted networks or where default, shared, or weak portal credentials are in use.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can execute an eligible template and influence an allowlisted Bitbucket repository to write files outside the expected working area, potentially compromising backend confidentiality, integrity, and availability. Affected are @backstage/plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server before 0.2.25 (shipped with Backstage before the v1.54.6 release). Exploitation requires an authenticated account with template-execution privileges, control over the contents of a repository already present in the Bitbucket allowlist, and the source-branch creation flow to be exercised, which is why the assessed vector carries high attack complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.5); this is not reachable by an anonymous remote attacker on a default install, and no public exploit code has been identified at time of analysis.
Unauthenticated path traversal in an API endpoint of HPE Aruba ClearPass Policy Manager allows a remote attacker to manipulate authorization logic and be assigned a role they were not intended to hold, yielding partial confidentiality, integrity, and availability impact (CVSS 7.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Because the vector is PR:N and UI:N, no credentials or user interaction are required - the practical barrier is network reachability of the ClearPass management/API interface, so internet-facing or broadly exposed deployments are the most at risk while those confined to isolated administrative networks are largely shielded. Exploitation status: no public exploit identified at time of analysis, and neither a CISA KEV listing nor an EPSS score was supplied with the source data; impact is bounded to role/authorization manipulation rather than full host compromise.
Path traversal in HPE Aruba ClearPass Policy Manager allows an authenticated attacker with access to the management interface to read and modify files on the underlying operating system. The independent assessment rates this as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, requiring a valid session and network reachability to the management plane; the vendor's stated vector with PR:N conflicts with the description's authentication prerequisite. No public exploit code or CISA KEV entry is identified at time of analysis.
Authenticated path traversal in the ClearPass Policy Manager command line interface allows a low-privileged remote user to escape the intended file path context and execute arbitrary code with elevated privileges on the underlying operating system. The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is network-reachable, low complexity, requires only valid low-privilege CLI credentials and no user interaction, and yields full confidentiality, integrity, and availability impact. Exploitation prerequisites are non-trivial: the attacker must already hold valid authenticated access to the ClearPass CLI, so exposure is bounded by how broadly low-privilege appliance accounts are provisioned and by how tightly management-plane access is restricted; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Path traversal in the Software Management Studio Software Repository (CWE-22) allows an authenticated remote user with repository-level privileges to read and write files anywhere on the underlying platform filesystem, far outside the repository's intended storage scope, by sending specially crafted requests or crafted file uploads. Successful exploitation results in complete loss of confidentiality, integrity and availability for the affected system (CVSS 4.0 base 8.6; independently assessed as CVSS 3.1 8.6 with AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The decisive limiting factor is the high-privilege prerequisite (PR:H) combined with the absence of any public exploit identified at time of analysis, so realistic risk is concentrated in insider misuse or reuse of already-compromised privileged repository credentials rather than opportunistic external attack; this is a conditional priority, not a drive-by threat.
Authenticated high-privilege users on Arista EOS can exploit a path traversal (CWE-22) in the Network Provisioning Image Repository to read or write files anywhere on the platform filesystem, escaping the intended storage scope via crafted requests or malicious file uploads. The issue requires valid credentials with image-repository permissions (CVSS PR:H), so the exploit population is limited to insiders or attackers who have already compromised a privileged account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the high confidentiality and integrity impact makes this a mid-to-high priority for affected deployments.
Unintended data can be extracted from Arista CloudVision Sensor by authenticated high-privilege users exploiting a path traversal flaw in CloudVision Portal (on-premises) and CloudVision Sensor, though the requirement for high privileges and additional preconditions limits the risk to moderate priority. No public exploit code has been identified, and the vulnerability is not confirmed as actively exploited. The flaw primarily impacts confidentiality, with no integrity or availability impact on the vulnerable component according to the independent assessment.
Path traversal in Dell System Update (DSU) versions prior to 2.3.0.0 allows an unauthenticated remote attacker to escape the intended restricted directory when the DSU client processes crafted pathnames in update content, resulting in filesystem access. Because DSU operates with elevated privileges, exploited path traversal can escalate to arbitrary code execution as root, potentially compromising both the application and the underlying operating system. Exploitation is not automatic: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) shows remote, unauthenticated reach but a mandatory user interaction step, and no public exploit code was identified at time of analysis. Dell has published a fixed release, and this is a genuinely high-priority flaw rather than merely a high-CVSS outlier.
Local privilege escalation and code execution in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local user to supply a crafted pathname that escapes the directory DSU intends to restrict, causing the elevated DSU process to read, write, or execute content from an attacker-controlled location. Exploitation yields complete loss of confidentiality, integrity, and availability on the affected host (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but it is not remotely reachable and requires the attacker to already hold a local low-privileged account or code-execution foothold; no public exploit code has been identified at time of analysis, EPSS is low at 0.22% (11th percentile), and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. Vendor-released patch: 2.3.0.0.
Path traversal in @quasar/icongenie versions before 6.1.1 lets a crafted profile cause the icongenie generate --profile command to write generated image content to any path writable by the invoking developer, enabling overwrite of shell startup files, build scripts, or other executable configuration. Exploitation requires the developer to run the command against an attacker-supplied profile (UI:R) and gives no direct remote access; no public exploit code identified at time of analysis, and the issue is fixed in 6.1.1.
Authenticated arbitrary file deletion in Payload CMS before version 3.90.0 (and canary releases before 4.0.0-canary.34) lets a user who can update or delete uploads stored on the local filesystem cause the file-cleanup routine to remove files outside the configured upload directory, resulting in data loss or service disruption. The flaw is a path traversal in the upload deletion logic that requires a valid account holding update/delete permission on an upload-enabled collection (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, score 8.1), so it is not exploitable by anonymous visitors. There is no public exploit identified at time of analysis and the issue is not reported as actively exploited; deployments using cloud/object storage adapters or restricting upload management to trusted operators are largely unaffected. Vendor-released patches are available in 3.90.0 and 4.0.0-canary.34.
Arbitrary file write through path traversal in lrzsz before 0.13.0 lets a malicious ZMODEM sender place files outside the current directory - including by absolute pathname - when the victim runs the lrz receive utility in restricted mode. Exploitation requires the victim to actively initiate or accept a ZMODEM transfer (UI:P/AT:P), the binary to be built without the --enable-pubdir option (the default, since only that build hardens checkpath()), and the attacker to control the sending side; the primitive is limited to files the receiving user account can already write, though overwriting SSH keys, shell profiles, or cron entries can extend impact. No public exploit identified at time of analysis, and the risk is a conditional integrity/availability issue rather than a mass-exploitation emergency given the user-interaction and build-configuration prerequisites.
Arbitrary file read in Rundeck before 6.2.0 lets an authenticated user who holds only the project 'configure' ACL read any file on the server by setting the resources.source.N.config.file property to an absolute path outside the project directory, then retrieving the contents through the editProjectNodeSourceFile or apiSourceGetContent endpoints. Recoverable data includes database passwords, LDAP bind credentials and configuration belonging to other projects, making this a meaningful lateral-movement aid for anyone with delegated project administration rights; there is no user-interaction requirement and no non-default configuration needed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but VulnCheck reported it and the vendor-released fix ships in Rundeck 6.2.0.
Unauthenticated arbitrary file deletion in the WordPress plugin Simple File List (versions through 6.3.11) lets remote attackers remove files from a vulnerable site without authenticating, without user interaction, and without any non-default configuration. The issue is rated 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H), with the limited integrity sub-score reflecting that the real damage depends on which files the web server user can delete - deleting wp-config.php or core files is far more severe than deleting an uploaded asset. No public exploit identified at time of analysis and the plugin is not listed in CISA KEV; this is nonetheless a genuine high-priority issue for WordPress sites running the affected plugin.
Arbitrary file deletion in Jobs for WordPress 2.8.2 and earlier allows authenticated Contributor-level users to delete arbitrary files via a path traversal flaw (CWE-22). The vulnerability is network-reachable, requires no user interaction, and has a CVSS score of 7.7 with high availability impact but no confidentiality or integrity impact. No public exploit has been identified at the time of analysis, and no vendor-released patch is available.
Unauthenticated directory traversal in kkFileView 5.0.0 through 5.0.2 lets remote attackers create arbitrary directories and write files outside the intended fileDir root via the fileUpload, createFolder, and existsFile endpoints, which concatenate an attacker-supplied 'path' parameter into the upload base path without any validation. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms that no credentials and no user interaction are needed, and that the impact is integrity-only (C:N/A:N), meaning the attacker can plant content beyond the configured storage root but gains no direct read or availability effect. Exploitation is gated chiefly by exposure rather than configuration - kkFileView is typically deployed as an internal document-preview service - and no public exploit code was identified at time of analysis, so internet-facing, unauthenticated reachability of the upload endpoints is the real-world precondition for mass abuse.
Local file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered page image. When an application explicitly sets HTMLBackendOptions(render_page=True), has the optional Playwright dependency installed, and passes untrusted HTML as a filesystem Path, the HTML backend's browser request filter fails to enforce the enable_local_fetch setting or confine file:// access to the source document's directory, so an <iframe src="file:///..."> can pull in .env files, credentials, or other users' documents that Chromium then renders visibly into the output image. Publicly available exploit code exists and the issue is fixed in 2.118.1; EPSS is low (0.30%, 21st percentile) and there is no indication of active exploitation, so real-world priority is comparatively low despite the 7.5 CVSS, because exploitation demands a specific non-default configuration and disclosure is passive, read-only, and limited to text content Chromium renders in the viewport.
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter process and create or overwrite writable files when the caller has explicitly opted into Tectonic rendering via LatexBackendOptions(tikz_engine="tectonic"); enabling the additional tikz_engine_allow_shell_escape option escalates this to shell command execution through TeX. The default Docling configuration does not enable Tectonic rendering and is not affected, and exploitation further requires a victim or operator to feed the crafted document into the pipeline (UI:R), which is why the practical risk is conditional despite the high CVSS base score. Both docling and docling-slim are affected; the flaw is fully fixed in 2.132.0, EPSS is a low 0.30% (21st percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Code execution in Newell Brands DYMO ID 1.5.1.71 occurs because the application resolves its plugin Modules directory relative to the process working directory, letting an attacker who places a malicious plugin module or DLL alongside a crafted job file load arbitrary code at the victim's privilege level once that job file is opened. The issue is local and file-delivery based rather than network-reachable, requires explicit victim interaction (opening the crafted job), and grants only the privileges the victim already holds, so it cannot self-propagate; no public exploit code and no CISA KEV entry were identified at time of analysis. The vendor has released a fix in DYMO ID 1.6.0.
Authenticated Ghost Administrators on versions 6.10.3 through 6.63.x can achieve remote code execution by installing a crafted theme that abuses how Ghost resolves theme translation (i18n) files, allowing path traversal into attacker-controlled code. Exploitation requires a high-privilege Administrator account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) and no victim interaction beyond the attacker's own admin actions; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). Because the attacker population is limited to trusted or already-compromised admin accounts rather than anonymous remote users, this is a high-severity but access-gated issue rather than a mass-exploitation priority.
Authenticated high-privilege attackers with access to the Mitel MiVoice Office 400 web portal on TCP 443 can exploit a directory traversal in Maintenance → File Management → File Browser to delete files outside the intended directory, including application and Linux system files, causing denial of service. The flaw affects MiVoice Office 400 deployments exposing the portal, requires a valid administrative/maintenance account, and has no public exploit identified at time of analysis. The independent assessment rates it as a moderate-priority, authentication-gated destructive issue rather than a mass-exploitation threat.
Arbitrary file write in Mitel MiVoice Office 400 backup restoration can lead to root-level code execution if an attacker can supply a malicious TGZ archive to the configured backup repository; however, exploitation requires privileged access to the backup repository and a restore operation, making it a high-severity issue but not an indiscriminate internet-facing threat. No public exploit identified at time of analysis.
Papermerge 3.5.3 permits an authenticated standard user to achieve remote code execution by uploading a crafted file to /api/documents/upload with directory-traversal sequences in the filename, causing a malicious Python .pth file to be written into the interpreter's site-packages directory; the embedded code executes only when the Python interpreter next starts, for example on an application or worker restart. Publicly available exploit code exists via a GitHub PoC repository and accompanying PDF, and the flaw is conditionally gated by requiring the Papermerge process to have write access to site-packages and by the attacker not controlling restart timing, making it a credible but conditionally-gated RCE rather than an immediately triggerable one.
Path traversal in the Mitel MiVoice Office 400 web administration portal (https://<ip>:8443, reached through Administration -> View Logs) lets an authenticated administrator view or download sensitive system files that the portal's service context can read. Exploitation requires a high-privileged admin session and no user interaction, so the practical risk is access-gated: insiders, or attackers who have already stolen admin credentials or hijacked an admin session, are the realistic threat actors. The CNA rates it CVSS 4.0 8.4 with PR:H and a proof-of-concept-level exploit maturity metric (E:P), while our independent CVSS 3.1 assessment (7.2, AV:N/AC:L/PR:H/UI:N/C:H/I:N/A:N) characterizes it as a genuine but access-gated risk; no confirmed active exploitation (CISA KEV) or evidence of widespread attack activity appears in the available intelligence.
Path traversal in Legcord's theme IPC handlers (versions 1.1.0 through 1.3.0) allows an attacker who already has script execution inside the embedded Discord page - for example via XSS - to supply unvalidated theme ids to themes.folder, themes.uninstall, and themes.install and escape the themes directory. That yields arbitrary file writes, recursive directory deletion, and local executable launch, i.e. host code execution; CVSS 4.0 scores it 9.2 (Critical) with full confidentiality, integrity, and availability impact, and PR:N means no further authentication is required once the script foothold exists, while AC:H and AT:P capture that prerequisite. No public exploit code was identified at time of analysis and no CISA KEV listing is present.
ApiAdmin 5.0 and earlier allow any logged-in administrator to achieve remote code execution by uploading a .php payload to POST /admin/Index/upload; the handler takes the client-supplied extension verbatim with no whitelist, blacklist, or content inspection, and move_uploaded_file() places the file into the web-served public/upload/Ymd/ directory, where it can be requested directly over HTTP. The attack path is gated by an authenticated admin session (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2), so practical exposure hinges on credential compromise, reuse, or insider access rather than an unauthenticated vector. EPSS is low at 0.35% (26th percentile) and the issue is not listed in CISA KEV; no public exploit code is identified at time of analysis, though a public proof-of-concept write-up is referenced (GitHub fangtang7/CVE) and the European vulnerability entry EUVD-2026-92468 tracks the same CVE.
Path traversal in Unimall v4's FileUploadController.local() enables remote attackers to read arbitrary files outside the intended upload directory; the supplied CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, though that remains unconfirmed against the vendor's actual routing. Although the description claims arbitrary code execution, the same vector shows only high confidentiality impact (C:H/I:N/A:N), so RCE would require an unconfirmed write-into-webroot capability; our independent assessment notes that if such a write is possible, integrity and availability impacts could follow. No public exploit or CISA KEV listing was identified, and EPSS is low at 0.24% (13th percentile).
Directory traversal in WookTeam 1.6.6 and earlier lets a remote attacker read arbitrary files from the server through the /api/project/task/export endpoint by supplying the data parameter with a crafted JSON payload whose file value contains ../ sequences, which are concatenated into storage_path() and streamed back via response()->download(). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), so the flaw is treated as unauthenticated and read-only, though the independent assessment flags that real-world deployments of this team-collaboration app may require a session to reach the export route and defenders should confirm whether their instance exposes it pre-authentication. Exploitation pressure currently looks low - EPSS is only 0.21% (11th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis, even though a public technical write-up of the file-read behavior is linked from the CVE record; the practical risk is limited to files readable by the web-server process user.
Unauthenticated arbitrary file deletion in the VikAppointments Services Booking Calendar WordPress plugin (all versions up to and including 1.2.21) lets a remote attacker specify a server file path that the plugin will remove without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1), which can escalate to full site takeover when a critical file such as wp-config.php is deleted. Exploitation is conditional: the site must have published at least one File-type custom field on the confirmation-page shortcode, a configuration that is not created by default during plugin installation, so stock deployments are not directly reachable. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis, but the low complexity and unauthenticated reachability make prompt patching important on any site that uses custom File-type booking fields. Reported by Wordfence via the CVE program.
Arbitrary file read and deletion in Formwork panel versions before 2.3.13 affect authenticated users who hold backup download or backup delete permissions. Exploitation requires a Linux deployment, where PHP basename() fails to treat backslashes as directory separators, allowing a base64-encoded backslash-separated traversal payload to escape the configured backup directory. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the impact is confined to file read and deletion with no code execution.
Path traversal (CWE-22) in image-downloader 4.3.0 allows an attacker who controls the download URL to write response data outside the configured destination directory, resulting in arbitrary file overwrite or corruption (CVSS 9.1, I:H/A:H, C:N). Per the CVSS vector, the flaw is network-reachable, low-complexity, unauthenticated, and requires no user interaction against the library, but exploitation is limited to applications that forward untrusted URLs to it. No public exploit code or active exploitation (CISA KEV) has been identified, and an upstream fix commit (fb44543) is available.
Authenticated Ghost administrators can obtain remote code execution by uploading a crafted theme whose translation (i18n/locale) files abuse path traversal (CWE-22) to load attacker-controlled content that the Node.js server then executes. The vulnerability affects Ghost 6.10.3 through every release before 6.64.0, and exploitation requires a full administrator account with access to the theme upload/management feature - anonymous visitors, members, authors, and editors cannot trigger it, and no end-user interaction is needed once admin rights are held. No public exploit code has been identified at time of analysis, and this is an access-gated risk rather than a drive-by threat; the vendor has shipped a fixed release, with details in advisory GHSA-jj74-hc2q-xrvm and a parallel VulnCheck advisory.
Unauthenticated path traversal in the Super Forms - Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316) allows remote attackers to read the contents of arbitrary files on the hosting server through the plugin's parse_request handling of form file uploads. In the default configuration the optional 'file_upload_auth' setting is empty, so no credentials are needed, although the vulnerable code path is only reachable when a form with the file upload feature is enabled on the site. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV entry); the practical impact is information disclosure of sensitive files such as configuration and credential material rather than modification or denial of service, and the supplied severity signals are internally inconsistent (the vendor score of 9.1 asserts integrity and availability impact while our assessment finds confidentiality-only impact).
Path traversal in the TaskingAI QR Code Generator plugin v0.3.0 allows an authenticated, low-privileged attacker to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter, affecting deployments where the plugin is enabled. Publicly available exploit code exists, and CISA's SSVC framework classifies the attack as non-automatable. Impact is primarily integrity (file overwrite) and availability (disk consumption or service disruption), with a CVSS of 8.1; the write is constrained to image-format content but may enable further compromise if sensitive paths are writable.
Path traversal in TaskingAI v0.3.0's DALL-E 3 image-generation tool lets an attacker who can invoke that tool write downloaded images to arbitrary locations on the server filesystem by injecting traversal sequences into the project_id parameter passed to save_url_image (CWE-22). The independent assessment scores this as an integrity-only file-write issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), which is materially more conservative than the CNA's 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) that asserts no privileges required and full confidentiality plus integrity impact - the vector conflict matters because it changes who is realistically in scope. Exploitation is not unconditional: the DALL-E 3 tool must be enabled and configured with valid image-generation API credentials and the attacker must be able to drive that pipeline with a controlled project_id; EPSS is 0.14% (3rd percentile), there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unvalidated pathnames in the Teledyne FLIR Aware2 web interface let remote unauthenticated attackers read configuration and security parameters from PackBot robots running Aware2 through 6.9.0.2 and FirstLook robots running Aware2 through 1.7.9 via path traversal. The CVSS 4.0 vector rates this 10.0, but the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting information disclosure only with no write or command-execution capability described. No authentication, credentials, or user interaction are required (PR:N/UI:N); there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so real-world risk is governed mainly by whether the robot's management web interface is reachable from an untrusted network.
Stored local file inclusion in GetSimple CMS CE 3.3.22 and earlier lets any authenticated account holding page-editing rights save an arbitrary filesystem path into a page's template attribute, which the public front-end then passes unsanitized to PHP include() whenever that page is requested - including by anonymous visitors. The payoff is disclosure of any readable local file and, if the included target contains PHP (a log, an uploaded file, or attacker-planted content), code execution in the web server's context. Publicly available exploit code exists and no vendor-released patch was identified at time of analysis; the main limiting factor is that the attacker must first possess a legitimate page-editing account, which keeps this a real but conditional risk rather than an unauthenticated emergency.
Remote code execution in GetSimple CMS CE prior to 1.5 allows an attacker to plant and execute PHP code as the web-server user by getting the UpdateCE.php handler to process a malicious ZIP archive. The handler extracts archive contents into the web-accessible root without validating file types or paths, so PHP webshells and ../ traversal writes are possible; publicly available exploit code exists, and SSVC rates it not automatable. Exploitation is high impact (CVSS 9.1) but constrained by the need to trigger the update through an administrator session or high existing privileges, so it is not mass-exploitable; version 1.5 contains the fix.
Unauthenticated path traversal in Fortinet FortiMail (7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6 and 8.0.0-8.0.1) lets a remote attacker write arbitrary files on the underlying system via crafted HTTP or HTTPS requests, yielding CVSS 9.8 with full confidentiality, integrity and availability impact. CISA has added the CVE to its Known Exploited Vulnerabilities catalog, so it is confirmed actively exploited (CISA KEV), and publicly available exploit code exists, making unpatched internet-reachable gateways an urgent remediation priority. Exploitation requires only that the FortiMail HTTP/HTTPS interface be network-reachable - no authentication (PR:N) and no user interaction (UI:N) - so environments that confine management/web access to trusted networks or a VPN substantially reduce exposure.
Authenticated path traversal in Vvveb CMS prior to version 1.0.8.6 allows an admin-panel user with backup access (default role site_admin or higher) to read and delete arbitrary files on the server, enabling database credential theft from config/db.php, disclosure of host files such as /etc/passwd, and site takeover by deleting the database configuration to force the installer back into setup mode. The vulnerability sits in the central path sanitizer used by the backup/file functionality and is reachable only with the high privilege level reflected in its CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H); no public exploit code has been identified at time of analysis. The vendor released a patch in 1.0.8.6 that adds recursive filtering to sanitizeFileName(), so unpatched instances below that version remain exposed.
Authenticated WordPress administrators can abuse the Prime Mover plugin before 2.2.1 to delete arbitrary directories outside the intended extraction path by importing a crafted WPRIME/TAR package whose wprime-config.json contains manipulated tar_root_folder values, ultimately tricking primeMoverDoDelete() into removing critical directories such as wp-admin, which can render the site inoperable. Exploitation requires a high-privileged WordPress administrator account (CVSS PR:H) that performs the package import, so this is not reachable by unauthenticated or low-privileged users; no user interaction beyond the admin's own import action is required. This is a moderate, not top-tier, priority issue: no public exploit code has been identified and there is no CISA KEV listing, though the confidentiality impact is nil while integrity and availability impacts are high, and the vendor has released a fix in version 2.2.1.
Authenticated WordPress administrators using the Prime Mover migration plugin before version 2.2.1 can abuse a Zip Slip path traversal (CWE-22) to write attacker-controlled files to arbitrary filesystem locations outside the intended extraction directory, which may escalate to remote code execution when the written path is PHP-executable by the web server. The flaw is reached through the plugin's migration ZIP import workflow, where malicious ZIP entry names are processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php. Exploitation requires a high-privileged admin account (CVSS PR:H, AV:N, UI:N) and crafted archive contents; no public exploit code was identified at time of analysis, and the vendor has released a patch. The risk is genuine but access-gated, since the admin prerequisite is the primary limiting factor and full RCE additionally depends on the hosting configuration.
Arbitrary file write as the grading teacher in Classroom 50 (the `gh teacher` CLI) before 1.11.0 lets an enrolled student escalate from a writable assignment repository to code execution in the teacher's session: because `gh teacher download` writes autograde artifacts (`result.json` and `results.json`) into the just-cloned student working tree without guarding pre-existing entries, a student who commits either name as a symlink, hardlink, FIFO or directory redirects that write to any path the teacher can reach - `~/.ssh/authorized_keys`, `~/.zshrc`, a cron file, or an in-clone `.git/hooks/*` script that git then executes. The written bytes are attacker-controlled (the student's uploaded release asset for `result.json`, or student-chosen submit-tag names for `results.json`), and the compromised `gh` token carries `admin:org`, `repo` and `workflow` across the whole classroom organization. Rated 9.4 under CVSS 4.0 and high priority by our independent review, exploitation is not anonymous and not zero-click: it requires classroom enrollment, a planted malicious entry, and the teacher running the vulnerable command against that untrusted repository (UI:P); no public exploit code was identified at time of analysis, no CISA KEV listing is present, and no EPSS score was supplied. Version 1.11.0 contains the patch.
Unauthenticated remote attackers can delete arbitrary files on any WordPress site running the AcyMailing SMTP Newsletter plugin 11.0.5 or earlier, because the plugin does not properly constrain caller-supplied file paths before deleting them (CWE-22 path traversal). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N shows no authentication, no user interaction and no special configuration is required - only that the vulnerable plugin version is installed and the vulnerable HTTP endpoint is reachable and not firewalled or WAF-blocked. Deletion is bounded by the web server process's filesystem permissions, but that still covers wp-config.php, .htaccess, plugin/theme files and uploads, so successful exploitation leads to site outages, data loss or a path to full site takeover; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated local file disclosure in Tornado before 6.5.9 lets remote attackers read files outside a configured static root by requesting a symbolic link that lives inside that root but resolves elsewhere, exposing configuration files, private keys, and application secrets readable by the Tornado process user. Exploitation is a single GET request requiring no authentication and no user interaction (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), but it depends on a precondition rather than being turnkey: an out-of-root symlink must already exist inside the static directory, a situation the upstream advisory says arises in applications serving user-uploadable content or where build/deploy pipelines (npm link, webpack, Docker volume mounts, CDN sync tools) create symlinks. The issue is fixed in 6.5.9, public reproduction steps are published in the upstream GitHub Security Advisory, and there is no CISA KEV listing.
Path traversal in the n8n node of the n8n workflow automation platform lets an attacker supply a crafted resource identifier that redirects the node's authenticated API calls to unintended resources, exposing workflows, execution data, and stored credential secrets that fall inside the scope of the API key in use. Affected deployments are n8n before 1.123.80, 2.0.0 through 2.39.6, and 2.40.0 through 2.40.1; patched builds (1.123.80, 2.39.6, 2.40.1) remove the exposure. The CVSS 4.0 vector scores it 8.1 (AV:N/AC:L/AT:P/PR:N/UI:N with high confidentiality and integrity impact and low availability impact), and because exploitation presupposes an n8n node configured with an n8n API key credential (AT:P), impact is bounded by that key's authorization scope; no confirmed active exploitation (CISA KEV) was identified, though the vector's E:P metric indicates proof-of-concept-level exploit maturity and the EPSS-style risk picture is driven by the high confidentiality/integrity weighting.
Path traversal in the n8n Supabase node allows unauthenticated remote attackers to pivot to Supabase Auth and Storage APIs when a workflow binds the tableId parameter to untrusted input, bypassing Row Level Security and enabling unauthorized data access and modification. Affects n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; fixed in 1.123.80, 2.39.6, and 2.40.1. No public exploit identified at time of analysis. Exploitation requires the Supabase credential to use the administrative serviceRole key and a workflow with a dynamic tableId - a victim-side configuration dependency that is the primary limiting factor, consistent with the assessed attack requirement (AT:P) and high attack complexity (AC:H).
Cross-project approval forgery in n8n's Send-and-Wait approval feature allows an authenticated attacker with workflow-creation permissions to mint valid signed resume URLs for approval gates in projects they cannot access by supplying caller-controlled node IDs that contain unresolved path-traversal sequences. Affected releases are n8n before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1; the issue is meaningful primarily in multi-project or multi-tenant deployments where project isolation is relied upon as a security boundary. The independent assessment rates this as a genuine but moderate-severity issue with low likelihood of mass exploitation; no public exploit identified at time of analysis, and vendor patches are available.
Unauthenticated path traversal in Hitachi Coding Software Suite through 3.3.0 lets remote attackers read, create, modify, or delete arbitrary files on the affected host, a near worst-case profile with high confidentiality, integrity, and availability impact (CVSS 4.0 base 9.3; assessed CVSS 3.1 9.8-class vector AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The flaw requires only network reachability to the suite's file-handling interface - no authentication, user interaction, or special configuration is needed - so an attacker who can reach the service can fully control file content on the coding/marking system. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the real-world risk hinges on exposure: this industrial coding/marking software is typically deployed on isolated OT or plant networks, so hosts reachable from an attacker-controlled segment carry the greatest risk.
Absolute path traversal in langflow-ai Langflow through v1.8.4 lets a remote attacker write or overwrite files anywhere the Langflow process can reach by supplying an attacker-controlled absolute path or filename to the knowledge-base creation endpoint (HTTP POST /api/v1/knowledge_bases, handler at src/backend/base/langflow/api/v1/knowledge_bases.py:51), which forwards that input into host file creation without enforcing a workspace or storage boundary. The CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) rates it unauthenticated with high integrity impact, although the independent assessment notes that installations enforcing API login make a valid session the practical prerequisite and that the blast radius is capped by the OS privileges of the Langflow service account. Exploitation pressure is currently low per EPSS (0.23%, 13th percentile), and no public exploit has been identified at time of analysis.
Path traversal in Langchain-Chatchat 0.3.0 and 0.3.1 allows unauthenticated remote attackers to write knowledge base content to arbitrary filesystem locations outside the configured knowledge base root by injecting traversal sequences such as `..\` into the `knowledge_base_name` parameter of the knowledge base creation and document upload interfaces. The independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (9.1), i.e. no confidentiality loss but high integrity and availability impact, since arbitrary file writes can overwrite or clobber existing files and, depending on which paths the service process can reach, may be escalated toward code execution. Not listed in CISA KEV and no public exploit identified at time of analysis; EPSS is 0.14% (roughly the 3rd percentile), so automated mass exploitation is unlikely, but the advisory references an upstream GitHub issue and a public gist that may carry additional technical detail.
Unauthenticated path traversal in the OpenAI-compatible /v1/files upload endpoint of Langchain-Chatchat 0.3.0 allows remote attackers to write files to arbitrary locations outside the intended openai_files directory by supplying crafted filenames. The published CVSS is 9.1, but an independent assessment re-scores the issue at 8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - because the primitive is a file write rather than a read or direct code execution, so confidentiality is unaffected and availability impact is limited. There is no confirmed active exploitation (CVE-2026-51882 is not in CISA KEV) and no public exploit identified at time of analysis, and with an EPSS score of 0.14% (3rd percentile) real-world urgency is driven mainly by whether the API server is network-reachable and how much filesystem write access the service account has.
Path traversal in Devika v1.0's Patcher Agent allows remote attackers to write files outside the intended project workspace by supplying paths containing ../ traversal sequences to the save_code_to_project routine. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5), indicating high integrity impact with no confidentiality or availability effect, and publicly available exploit code exists (SSVC Exploitation: poc) - but there is no CISA KEV entry confirming active exploitation. EPSS is very low at 0.15% (4th percentile), and real-world urgency is bounded by deployment reality: Devika is typically self-hosted by an individual developer, so the practical risk depends on whether the instance is network-reachable and whether its agent actually processes attacker-influenceable tasks or repository content.
Unauthenticated remote clients can escape the intended bot workspace and write or overwrite arbitrary absolute filesystem paths through DeepTutor 1.4.0's live 'tutorbot' WebSocket interface, because the EditFileTool.execute path-traversal flaw (CWE-22) fails to contain caller-supplied paths to the workspace root; with CVSS 3.1 AV:N/AC:L/PR:N/UI:N and total confidentiality/integrity/availability impact, this rates 9.8 and can corrupt configuration, application code, or authentication material. Publicly available exploit code exists (SSVC Exploitation: poc, Automatable: yes) and the issue is tracked upstream as HKUDS/DeepTutor issue 517 with a public proof-of-concept gist, but there is no KEV-confirmed active exploitation and EPSS is low at 0.14% (3rd percentile), so the practical risk is concentrated on instances whose tutorbot WebSocket is internet-reachable rather than restricted to localhost or a trusted network.
Unauthenticated path traversal in Langchain-Chatchat 0.3.1 lets a remote attacker write files to arbitrary filesystem locations by submitting crafted filenames to the /knowledge_base/upload_temp_docs temporary document upload endpoint, escaping the intended temporary directory. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the endpoint is reachable over the network with no authentication and no user interaction required, and that a successful write can corrupt or replace application or system files, with potential escalation to code execution if an overwritten file is later imported or executed by the service. Independent risk signals are mixed: EPSS is low at 0.15% (4th percentile) and there is no CISA KEV listing, so no public exploit identified at time of analysis, but the associated GitHub issue and gist references document the endpoint's traversal behavior and raise the likelihood of straightforward replication by anyone with network access to a default deployment.
Path traversal in the Devika v1.0 Feature Agent's save_code_to_project routine lets a remote caller who can submit a task or feature request to a Devika instance cause the agent to write files outside the intended project workspace, using the privileges of the local Devika process. The flaw is unauthenticated per the scored CVSS vector (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists; CISA's SSVC rates it automatable with total technical impact, although EPSS is low at 0.14% (3rd percentile) and there is no KEV confirmation of active exploitation. Our independent assessment rates confidentiality impact as limited while integrity and availability impacts are high, and the decisive real-world factor is exposure: Devika is normally a single-developer tool bound to localhost, so remote exploitation depends on an operator having published the web UI/API to a network.
Arbitrary file write through directory traversal in Devika v1.0's Coder.save_code_to_project function lets an attacker who can steer the agent's generated filename or project path - using sequences such as '../' - save files outside the intended project workspace. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) requires low-privilege access per PR:L, but Devika v1.0 ships without authentication by default, so any instance reachable over the network is effectively exposed; the real limiting factor is deployment posture, since Devika is commonly bound to localhost for a single developer, which eliminates remote reachability. Exploitation is not confirmed active: there is no CISA KEV entry, no public exploit code identified at time of analysis, and EPSS is only 0.26% (16th percentile), so the composite signal set sits noticeably below the 8.8 headline score.
An authenticated administrator of Kiteworks Email Protection Gateway can exploit a path-traversal weakness to write a file outside its intended location and have the application execute it, resulting in remote code execution as the gateway's underlying service account. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): it is network reachable and low complexity, but gated behind high-privilege administrator credentials, which substantially constrains real-world exposure and makes this a moderate, not urgent, priority. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Path traversal (CWE-22) in Kiteworks Email Protection Gateway allows an authenticated administrator to move files to locations outside the designated directory of an optional, non-default administrative file-move feature, which can potentially be leveraged to execute arbitrary code on the underlying host. The vulnerability is network-reachable with no user interaction (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but exploitation requires high-privileged administrator credentials and that the optional feature be enabled - environments running default configurations without this feature are not exposed. Only the CVE.org advisory and a CISA CSAF record are available at time of analysis, and no public exploit code has been identified; the admin-privilege prerequisite and non-default feature gate are the primary factors limiting real-world exploitation.
Unauthenticated path traversal in the Kiteworks Core appliance setup interface allows an attacker who can reach that interface to write a file to any location writable by the appliance service account, enabling integrity compromise of the appliance or a denial-of-service condition that persists until an operator intervenes. The exposure is narrow: the setup interface is not reachable on a fully configured appliance in its default configuration, so exploitation is realistically limited to the transient provisioning window of a new appliance or a non-default configuration that leaves setup exposed, which is why AC:H applies despite PR:N and UI:N (CVSS 7.4). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw does not by itself provide code execution.
Arbitrary command execution on Kiteworks Email Protection Gateway is possible in all versions before 9.5.0: an authenticated administrator can import a crafted configuration file whose contents are insufficiently validated, allowing commands to run on the appliance with the privileges of the gateway service (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires PR:H, this is not a remote unauthenticated attack - it is realistically an insider, malicious-admin, or post-credential-compromise escalation from administrative access to full code execution on the gateway. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor fix is version 9.5.0.
Arbitrary file write in Kiteworks Core before 9.5.0 lets a holder of an existing administrative account steer the platform's administrative export feature to write files to any path on the underlying host, which can be chained into command execution on the appliance. The root cause is an improper restriction of a user-supplied file path (CWE-22), scored CVSS v3.1 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so the flaw is not reachable by unauthenticated or standard users and command execution is a downstream consequence of the write rather than a guaranteed outcome. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis; the primary constraint on real-world risk is the high-privilege prerequisite.
Path traversal in the administrative import function of Kiteworks Email Protection Gateway allows an authenticated administrator to write files to arbitrary filesystem locations, which can potentially be escalated to arbitrary code execution on the underlying server. All versions prior to 9.5.0 are affected; exploitation requires a high-privileged admin account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) and the impact on confidentiality, integrity, and availability is rated High. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the EPSS score was not provided in the available intelligence.
Arbitrary file write during plugin installation in ZeroClaw before 0.8.5 (when built with the plugins-wasm feature) lets attackers place files outside the plugins directory by supplying a crafted manifest.toml whose wasm_path field contains '..' or absolute/root/drive-prefix components; overwriting shell startup files or similar executed content yields code execution under the victim's account. The attack is local (AV:L) and unauthenticated per the assessed vector (PR:N), but it requires user interaction (UI:P/UI:R) - the victim must be persuaded to install the attacker-supplied plugin package - and only functions when plugin signature verification is left in its default Disabled mode, making the path check the sole gate. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in v0.8.5.
Arbitrary file write in oc-mirror allows an attacker who controls or tampers with an operator catalog image to write files outside the intended extraction directory when a user mirrors that catalog using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature). The issue is a path traversal (CWE-22) in tar entry extraction, assessed as local (AV:L), no privileges required (PR:N), but requiring user interaction (UI:R) because an administrator must run the mirror command; impact is high integrity and low availability, with no confidentiality impact per the independent assessment. No public exploit or active exploitation is identified at time of analysis, and the independent assessment characterizes this as a moderate, defender-actionable issue rather than an urgent internet-facing emergency.
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.2.19 and allows a user holding only Contributor-level privileges to manipulate file paths and reach files outside the intended directory, primarily exposing sensitive data with limited integrity and availability effects. Exploitation requires a valid low-privilege account - self-registration must be enabled or an account otherwise obtained - and is rated high complexity (AC:H), meaning success depends on specific, not-guaranteed conditions; the issue is remote, needs no user interaction, and no public exploit has been identified at time of analysis. It is not confirmed actively exploited (no CISA KEV listing), and while the vendor-supplied CVSS of 7.5 and the scorer's high confidentiality/integrity/availability ratings read alarming, the practical risk is moderate because the attack is gated behind an authenticated Contributor role and elevated complexity.
Unauthenticated arbitrary file download in the NextGEN Gallery WordPress plugin affects every site running version 4.5.0 or earlier, allowing a remote attacker with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, base score 7.5) to retrieve files that are readable by the web server process. Rooted in a path-traversal weakness (CWE-22) in the plugin's file download handling, the impact is confined to confidentiality - typical targets are wp-config.php, database credentials, environment files, and backup archives - with no file write or code execution. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, though the reachable default-configuration attack path makes it a genuine priority rather than a paper-tiger high-CVSS issue.
Arbitrary file read in Digiwin EasyFlow .NET allows an authenticated remote user to download files from the underlying host outside the intended document scope, exposing configuration files, credentials, or other sensitive data. Exploitation requires a valid low-privilege session (PR:L per the CVSS v4.0 vector and the corroborating CVSS v3.1 assessment) but no user interaction and only low attack complexity, so any party holding a legitimate account can reach the flaw over the network. Impact is confined to confidentiality - the vulnerability does not modify data or affect availability - and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Unauthenticated arbitrary file read in the Product Designer App plugin for WordPress (all versions up to and including 1.1.3) lets any remote visitor retrieve the contents of files on the web server through the plugin's 'svg' parameter. The only access control on the vulnerable AJAX endpoint is a nonce and token that the plugin prints as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, so an anonymous attacker who loads such a page can lift those values and pass them along with a crafted traversal path. Per the supplied assessment the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High) reflects a fully remote, unauthenticated, low-complexity, no-interaction confidentiality-only flaw; no CISA KEV entry and no public exploit code were identified in the provided data, and no EPSS score was supplied, so exploitation status is assessed as unproven but technically trivial once a shortcode-bearing page exists.
Directory traversal in Handlebars.java before 4.5.5 lets unauthenticated remote attackers read arbitrary files outside the configured template base directory in Spring MVC applications that use the handlebars-springmvc integration. The flaw specifically affects handlebars-springmvc 4.5.3 and 4.5.4, where the path-containment check added for CVE-2026-63490 validates template locations as raw percent-encoded strings while the template file is ultimately opened through a URL handler that percent-decodes the path, so a request-derived view name containing %2e%2e/ slips past both the view-resolver and loader-side checks. Exploitation is not confirmed in the wild and no public exploit code has been identified at time of analysis, but it requires two non-default conditions to hold simultaneously: a file: template location prefix and a Handlebars view name derived from untrusted request input, which keeps real-world priority moderate despite the 7.5 CVSS score. Impact is limited to confidentiality (arbitrary file read); integrity and availability are unaffected.
Directory traversal in Agent Zero 1.7 through 1.10 lets the AI agent's file-browser component read files anywhere on the host, because FileBrowser is initialized with the host root as its workspace rather than a confined sandbox. The CVSS 3.1 vector is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), which models unauthenticated network access, but the practical risk is gated by whether the Agent Zero UI is exposed to untrusted networks; Agent Zero is often a local single-operator tool, so the AV:N/PR:N rating only applies when that interface is deliberately reachable without an authentication layer. At time of analysis there is no confirmed active exploitation (no CISA KEV entry) and no public exploit identified at time of analysis, and EPSS is 0.33% (24th percentile), indicating low predicted exploitation activity; reference material consists of a GitHub issue and a gist.
Directory traversal in Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 allows unauthenticated remote attackers to read arbitrary files from the server filesystem through the Linsight task-execution endpoint implemented in src/backend/bisheng/linsight/domain/task_exec.py. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates no authentication or user interaction is required against default configurations, with impact bounded to confidentiality - disclosure only, no code execution or file modification. Publicly available exploit code exists (SSVC exploitation status 'poc'; a public gist accompanies the report), but the vulnerability is not confirmed actively exploited (no CISA KEV entry), and EPSS is low at 0.33% (24th percentile), so priority should be driven by whether an organization actually exposes a Bisheng instance to untrusted networks.
Directory traversal in Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 lets a remote attacker use crafted filename/path input to break out of the intended download/cache directory through the save_download_file routine (src/backend/bisheng/core/cache/utils.py:290), yielding arbitrary file read and write with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vector indicates an unauthenticated, network-reachable attack with no user interaction, though the practical limiting factor is whether the API route that reaches save_download_file is exposed without a login - defenders should verify that against their own deployment before assuming unauthenticated reachability. Exploitation status: no public exploit identified at time of analysis, and there is no CISA KEV entry; EPSS is 0.33% (24th percentile), so mass exploitation is not currently expected, but the impact per successful attack is severe given the high confidentiality and integrity ratings and the absence of any availability impact.
Path traversal in DB-GPT 0.7.5 and 0.8.0 lets remote attackers write arbitrary files outside the intended upload workspace through the OpenAPI python_file_upload endpoint at packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42. The affected service is the DB-GPT web API and the vector is rated critical (CVSS 9.1, AV:N/AC:L/PR:N/UI:N), so exploitation hinges on network reachability of the instance rather than on any attacker-held credentials - DB-GPT ships its API without enforced authentication by default, which is why the score is PR:N. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.47% (38th percentile), so this is a genuine but not yet mass-exploited issue. Note a scoring divergence: NVD rates confidentiality and integrity high with no availability impact, while our independent assessment rates integrity and availability high and confidentiality none.