Path Traversal
Monthly
Sandbox escape via path traversal in macOS allows a malicious app to read and write files outside its sandbox, potentially accessing sensitive data. Affects macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, with no privileges needed but requiring user interaction to launch the crafted app. No active exploitation or public exploit code known at time of analysis; EPSS indicates low exploitation probability.
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability, a path handling flaw in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, enables a low-privileged application to traverse directories and elevate its permissions. No user interaction is required, and no active exploitation or public proof-of-concept has been identified at the time of analysis.
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts location via a path traversal flaw in archive extraction. The vulnerability allows an attacker who has already obtained limited access to the application to overwrite critical files, potentially escalating to remote code execution. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS score reflects the severe impact if leveraged.
Path traversal in phpMyFAQ's category image deletion allows authenticated attackers to delete arbitrary files, leading to superadmin account creation. Versions before 4.1.6 fail to sanitize the existing_image parameter, permitting deletion of critical files like database.php, which disables the installation gate and exposes the setup wizard. Publicly available exploit code exists, and the issue has been verified by the vendor.
Arbitrary file write in NitroShare Desktop 0.3.4 allows unauthenticated attackers on the same network to plant malicious files on a target system by sending a crafted filename with directory traversal sequences in the JSON item header name field. The vulnerability can be exploited to write to the Windows Startup folder, achieving persistent code execution when the user next logs in. Publicly available exploit code exists but it is not listed in CISA KEV.
Authenticated arbitrary file deletion in SP Page Builder before 6.7.1 allows attackers with administrative access to Joomla to delete any file on the server via a path traversal flaw in the media manager. The vulnerability is not known to be actively exploited or have a public exploit, but the high CVSS score reflects the severe integrity impact once administrative privileges are obtained.
Path traversal vulnerability in Microsoft Edge (Chromium-based) permits a remote, unauthenticated attacker to disclose arbitrary file contents to an external party. The attack requires user interaction, such as visiting a malicious website, and can lead to exposure of sensitive files accessible to the browser process. The vendor has released a patch, but no public exploit or active exploitation is currently known.
Path traversal bypass in the Linux kernel's ksmbd SMB server allows authenticated users with write access to a share to create zero-length files or directories outside the exported share boundary. The flaw exists only when the share is configured with case-insensitive (caseless) filename handling. Patches are available; the vulnerability is not known to be actively exploited, has a low EPSS score (0.26%), and no public exploit has been identified.
Directory traversal in Exim before 4.99.5 enables low-privileged local users to escape the mail spool directory boundary and read or manipulate arbitrary files on the host filesystem, ultimately achieving privilege escalation. The flaw is rooted in improper validation of queue-name arguments (CWE-24), affecting Exim from version 4.88 through 4.99.4. No public exploit has been identified at time of analysis, and EPSS at 0.27% (19th percentile) reflects limited exploitation activity, though SSVC assesses the technical impact as total given successful exploitation yields full system compromise.
Unauthenticated arbitrary file read in Microweber CMS through version 2.0.20 lets remote attackers retrieve sensitive files via directory traversal in the static file controller (ServeStaticFileContoller). Because the controller trusts the attacker-controlled ?path= query input over the bound route segment and normalize_path() fails to strip traversal sequences, a single unauthenticated HTTP GET can disclose environment configuration files containing credentials and other system files. Publicly available exploit code exists; the flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 8.7.
Unauthenticated arbitrary file read in Meshery before 1.0.57 lets remote attackers retrieve any file on the host by abusing the /api/system/fileView and /api/system/fileDownload endpoints, which pass a user-controlled file parameter straight to os.Open with no path validation. Reported by VulnCheck and fixed in v1.0.57, it carries a CVSS 4.0 score of 8.7 and requires no authentication or user interaction; no public exploit identified at time of analysis, though the fix commit publicly reveals the exact vulnerable code path.
Arbitrary file write and unauthorized file read in Vanna (the open-source AI SQL agent) through version 2.0.2 allows unauthenticated remote attackers to escape the FileSystemConversationStore base directory by injecting path traversal sequences into the conversation_id parameter of the chat API. Because the affected endpoints require no authentication, an attacker can write attacker-controlled JSON to arbitrary filesystem locations and read conversation metadata from outside the intended store - publicly available exploit code exists and the flaw was reported by VulnCheck. No CISA KEV listing is present, so there is no public exploit identified as being actively used in the wild.
Arbitrary file read and write in SoftVC VITS Singing Voice Conversion (so-vits-svc, through commit 730930d) lets unauthenticated remote attackers exfiltrate any server-readable file and plant .wav files anywhere the process can write, by supplying attacker-controlled paths in the audio_path field of the /wav2wav Flask route. Because the full-song inference server passes the value verbatim to librosa/torchaudio/soundfile sinks, a single POST can both leak file contents in the HTTP response and drop files on disk. Publicly available exploit code exists (VulnCheck advisory and geo-chen writeup); no public evidence of active exploitation at time of analysis.
Remote code execution in h2oGPT through 0.2.1 lets unauthenticated remote attackers read, write, and delete arbitrary files by injecting path traversal sequences into the HTTP bearer token of the OpenAI-compatible files API. Because the shipped default API key is empty, authentication is effectively bypassed and the token string is used directly as a filesystem path component, so an attacker can escape the user directory and plant startup hooks or application-loaded files to execute code. Publicly available exploit code exists (reported by VulnCheck); there is no public exploit identified in CISA KEV, and the CVSS 4.0 base score is 9.3 (Critical).
Arbitrary .docx read and write in Office-Word-MCP-Server (gongrzhe) through version 1.1.11 lets an attacker who can influence the filename argument passed to the document tools escape the intended working directory using absolute paths or ../ sequences. Because the exposed open/save operations run in an MCP tool context, a malicious or prompt-injected instruction can read sensitive .docx files or create and overwrite documents anywhere the server process has filesystem access. Publicly available exploit code exists (VulnCheck), but there is no public exploit identified as actively used and it is not on CISA KEV.
Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile).
Remote code execution in Bold Reports Standalone Report Designer before 14.1.12 lets authenticated users abuse the file-upload feature to write files outside the intended directory via a crafted filename, ultimately running arbitrary commands with high privileges on the host. The flaw chains a CWE-22 path traversal into server-side command execution, and per the CVSS 4.0 vector requires only low privileges with no user interaction over the network. No public exploit identified at time of analysis, though a VulnCheck advisory documents the issue.
Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers retrieve any file on the host through a path traversal flaw in the database download feature. Because readable files can include stored authentication credentials, a single crafted request can escalate to full unauthorized access to the application. There is no public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and zero-precondition attack surface make this a high-priority patch.
Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers traverse the filesystem via the font-processing feature and retrieve any file the service account can access. Because readable files include stored authentication credentials, a successful read can be pivoted into full unauthorized access to the application. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV, but the CVSS 4.0 base score is 9.3 (Critical).
Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers retrieve any file on the server through a path traversal flaw in the SVG processing feature. Because readable files include stored authentication credentials, an attacker can pivot from file disclosure to full unauthorized access of the application. Disclosed by VulnCheck with a CVSS 4.0 base of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in the Grav API Plugin (getgrav/grav-plugin-api) before 1.0.10 lets an authenticated caller holding the api.pages.write permission relocate an entire page directory outside user/pages/ and even outside the Grav installation. The flaw sits in the POST /pages/{route}/move endpoint, where PagesController::move() only strips leading periods from the slug and never neutralizes '/' or '..' segments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix and a GHSA advisory are published.
Arbitrary file read in SiYuan (an open-source personal knowledge-management / note-taking application) before v3.7.2 allows an authenticated attacker to retrieve files anywhere on the host by abusing the /export/temp/ short-circuit branch of the serveExport handler. Because this branch joins the raw, percent-decoded request path to the temp directory without the IsSubPath or IsSensitivePath guards used elsewhere, percent-encoded '..' sequences escape TempDir and expose /etc/passwd, SSH private keys, and SiYuan's own workspace *.db and *.log files. No public exploit identified at time of analysis, though the advisory documents a concrete payload; EPSS and CISA KEV data are not provided in the input.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote, unauthenticated attackers delete any file the web server can access via a path traversal flaw. Deleting critical files such as wp-config.php can force WordPress into its setup routine and enable full site takeover, which is why this carries a CVSS 10.0 rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it a high-priority patch.
Arbitrary file deletion in the Kali Forms WordPress plugin (versions 2.4.18 and earlier) lets a low-privileged authenticated user - as low as a Subscriber - delete arbitrary files on the server via path traversal. On sites that allow open registration, an attacker can self-provision an account and remove critical files such as wp-config.php, knocking the site offline or forcing it into a fresh-install state. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary file deletion in the VideoWhisper Picture Gallery WordPress plugin (versions <= 1.6.5) allows an authenticated user holding the low-privilege Contributor role to delete arbitrary files on the server via path traversal (CWE-22). Rated CVSS 7.1, the flaw carries no confidentiality impact but high availability impact, since deleting critical files (e.g. wp-config.php) can break or hijack the site. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated remote file disclosure in ReReplacer Pro extension for Joomla allows attackers to read arbitrary files outside the site directory via path traversal in XML include paths. The vulnerability affects versions 1.0.0 through 15.0.3 and has a CVSS 3.1 score of 7.5 (high confidentiality impact). No public exploit code or active exploitation has been reported, and EPSS indicates a very low probability of widespread exploitation.
Unsafe file extraction in the Joomla GeoIP extension (versions 1.0.0-6.3.8) enables remote code execution by writing files outside intended directories during update processing. The vulnerability (CWE-22) does not require authentication and is triggered when the extension extracts untrusted archive files. EPSS probability of exploitation is low (0.20%), and no active exploitation or public exploit is confirmed at this time.
Path-traversal-based middleware bypass in @fastify/static versions up to and including 10.1.0 lets an unauthenticated remote attacker use dot-dot (../) path segments to reach files inside the static root that were meant to be protected by route-scoped middleware. This is a regression bypass of the earlier CVE-2026-6414 fix, which only blocked encoded forward slashes; the underlying send library normalizes dot segments before its own guard runs, defeating route-guard filtering. No public exploit has been identified at time of analysis, and the flaw is fixed in 10.1.1.
Local privilege escalation in Analog Way Picturall Quad Compact Mark II firmware version 3.5.8 allows authenticated low-privileged users to gain root access via path traversal in a maintenance script. No active exploitation or public exploit code has been reported; vendor patch is available in version 3.5.9.
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistence storage provider derives its storage key from user-controlled input, letting a remote attacker steer a path traversal into attacker-controlled deserialization. Because the CVSS vector is PR:N/UI:N, an unauthenticated remote attacker can chain the traversal to load a crafted serialized payload and execute arbitrary code, though the AC:H rating signals the attack is non-trivial to reliably trigger. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unauthenticated remote attackers to reach protected backend routes by abusing the ReplacePathRegex middleware. When the middleware rewrites a path using a capture group lacking a mandatory separator, a crafted request such as GET /api../admin yields an un-normalized path (/../admin) that the middleware forwards without re-validation; a normalizing backend then resolves it to a protected route, skipping any auth middleware bound to that path. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied, but the flaw is trivially reproducible from the advisory's own example.
Local privilege escalation in the Veeam Updater component of the Veeam Software Appliance allows a high-privileged local user to reach root-level control of the underlying operating system via path traversal (CWE-22). The flaw affects Veeam Backup & Replication deployed as the hardened software appliance, carries a CVSS 4.0 base score of 8.4, and was reported through HackerOne. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so current risk is latent rather than actively exploited.
Privilege-to-RCE escalation in HPE Aruba Networking AOS-CX switch operating system allows an authenticated, high-privileged administrator to abuse a path traversal flaw in the CLI to copy arbitrary files from the underlying OS into a user-readable location, which can be leveraged to achieve remote code execution. The weakness affects the switch management CLI and requires existing administrative access; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high across confidentiality, integrity, and availability because it breaks the boundary between the constrained CLI and the underlying operating system.
Path traversal in Progress ShareFile Storage Zones Controller before 5.12.5 and 6.0.2 lets an authenticated administrative user break out of intended directory boundaries to read arbitrary files, write files to arbitrary locations, and probe for file existence on the underlying server. Rated CVSS 8.7 with a scope change (S:C), the flaw converts application-level admin privileges into host filesystem read/write, but exploitation requires high privileges (PR:H) and there is no public exploit identified at time of analysis. Affected organizations are those self-hosting the on-premises Storage Zones Controller component that fronts ShareFile storage zones.
Arbitrary file write in Home Assistant Core before 2026.6.0 lets unauthenticated attackers plant attacker-controlled files anywhere on the host by uploading a malicious backup archive during the initial onboarding window. Because the process frequently runs as root (e.g., in the supervised/OS install), this path traversal escalates to full host compromise. No public exploit is identified at time of analysis, and it is not listed in CISA KEV, but a vendor-released patch (2026.6.0) exists and the issue was reported by VulnCheck.
Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply a backup archive overwrite arbitrary files on the host. The backup-restore routine trusts a tar SYMTYPE (symlink) entry whose linkname is an absolute path outside the extraction directory, then writes a following regular-file entry through that unvalidated symlink; because the official Docker image runs the process as root, an attacker can drop code into auto-imported Python paths (e.g. site-packages/sitecustomize.py) and gain code execution. Reported by VulnCheck with a vendor patch available (2026.6.0); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Directory traversal in Knowns 0.11.4 (the 'knowns' npm CLI/MCP knowledge layer for AI-assisted development) lets an attacker supply a crafted folder name to the create_doc tool and cause documents to be created outside the intended workspace directory. Because create_doc is exposed to AI agents via MCP, a malicious or manipulated tool call can traverse the filesystem using sequences such as '../'. A researcher gist and an upstream fix commit are referenced, so publicly available exploit code exists; the flaw is not in CISA KEV and carries a low EPSS score (0.26%, 18th percentile), indicating no evidence of widespread active exploitation.
Arbitrary file read (and likely write) in the Knowns 0.11.4 AI knowledge-layer server allows remote attackers to escape the intended document directory by supplying crafted relative paths to its get_doc and update_doc MCP tools. Because Knowns exposes these tools to AI agents and self-hosted clients, an attacker who can reach the tool interface can retrieve or tamper with files outside the managed knowledge store. EPSS is low (0.26%, 18th percentile) and there is no public exploit identified at time of analysis, though an upstream fix commit and a researcher gist both exist.
Arbitrary code execution in DayuanJiang next-ai-draw-io 0.4.13 arises from a path traversal flaw in the bundled MCP (Model Context Protocol) server, allowing an attacker who can influence a request to the mcp-server component to write or access files outside the intended directory and ultimately run code on the host. The affected product is a niche open-source AI-assisted draw.io diagramming application. No public exploit has been confirmed, though a third-party technical writeup exists; EPSS is low (0.43%, 35th percentile) and the flaw is not in CISA KEV.
Path traversal in Apache MINA SSHD's sshd-git component lets an authenticated remote user on Windows-hosted git servers escape the configured server-side root directory and reach git repositories elsewhere on the filesystem. It is an incomplete-fix regression of CVE-2026-48827: the path validation added in 2.18.0 and 3.0.0-M4 was only partly effective on Windows path semantics. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Arbitrary file write in Apache MINA SSHD's sshd-scp component lets a malicious SCP sender place files outside the intended download directory because filenames in SCP 'C' (file) and 'D' (directory) commands are not validated for path separators. Any application acting as an SCP receiver - either an SSHD server accepting uploads or an SCP client fetching from a server - using unsupported versions <2.0.0 or the sshd-scp module in >=2.0.0 is affected, allowing an attacker to overwrite or plant files in attacker-chosen locations. Reported by Apache; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file disclosure in ThemeXpert's Quix Page Builder Pro extension for Joomla allows unauthenticated frontend users to read files outside the intended directory by supplying traversal sequences to a Form element on a published page. The flaw (CWE-22) carries a CVSS 4.0 base score of 8.7 driven by high confidentiality impact with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated nature makes it a strong candidate for opportunistic scanning.
Unauthenticated loopback API access and path traversal in WhatsApp MCP Server (whatsapp-mcp) prior to v0.2.1 allow any same-user local process - including sibling MCP servers and IDE extensions - to send WhatsApp messages from the paired account and exfiltrate arbitrary user-readable files (SSH private keys, browser session data, dotfiles) as WhatsApp document attachments. The whatsapp-bridge HTTP service on 127.0.0.1:8080 requires no authentication and validates no Host header, enabling a DNS rebinding attack whereby a malicious webpage visited by the user can trigger identical file exfiltration remotely without any credentials. No public exploit identified at time of analysis; vendor-released patch v0.2.1 is available.
Arbitrary recursive file deletion in Network-AI (npm package `network-ai`) before v5.12.2 allows a local attacker who can write into an environment's backup directory to delete any path the process user can access. `EnvironmentManager.pruneBackups()` trusts the `path` field of an attacker-controllable `_manifest.json` and feeds it straight into `rmSync(..., { recursive: true, force: true })`, so a poisoned manifest such as `"path": "/"` gets deleted when `network-ai env backup prune` runs. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); there is no public exploit identified as actively exploited and it is not in CISA KEV.
Arbitrary file disclosure in dataCycle-CORE (versions up to and including 25.07.3) allows an unauthenticated remote attacker to read arbitrary .md files outside the intended docs/static directories. The documentation and static markdown renderer passes attacker-controlled path segments only through the Rails HTML sanitizer, which does not strip directory-traversal sequences, enabling path traversal to the application or engine root. No public exploit identified at time of analysis; the flaw is remotely reachable with no authentication and low complexity (CVSS 7.5). Patched in version 26.06.08.
Arbitrary file read in FileBrowser Quantum (gtsteffaniak/filebrowser) before 1.4.3-beta lets any authenticated user, regardless of role or permissions, exfiltrate sensitive host files via the GET /api/media/subtitles endpoint. The endpoint's `path` and `name` query parameters are used in filesystem operations without sanitization, yielding two independent path-traversal vectors that escape the storage root to read files such as /etc/passwd, SSH keys, database credentials, and JWT signing keys. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in commit f3f4bbe and released in 1.4.3-beta.
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended export directory via directory-traversal sequences embedded in a user-controlled relative_path. Because the exported file content is also attacker-supplied (an uploaded artifact), the flaw lets a privileged user plant or overwrite arbitrary files anywhere the Pulp service user can write, enabling service compromise or broader host takeover. Rated CVSS 9.0 and reported by Red Hat, it affects pulpcore as embedded in Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure 4/5; there is no public exploit identified at time of analysis.
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role disclose files readable by the SurrealDB process by pointing the DEFINE ANALYZER mapper() filter at an arbitrary path and harvesting the content from query error messages. The flaw is exploitable in default deployments because the SURREAL_FILE_ALLOWLIST is empty by default and an empty allowlist enforced no restriction. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the GHSA advisory documents the technique in enough detail to reproduce.
Path traversal in Menyoo (MenyooSP), a popular GTA V single-player trainer/mod, before commit 729aa48 lets a local user supply crafted file names (containing traversal sequences) to the Spooner, VehicleSpawner, WeaponOptions, and PedComponentChanger save/create-folder/rename functions, writing or renaming files outside the intended data directories. Because the resulting XML/config files can be planted in attacker-chosen locations, this escalates to arbitrary code execution in the victim's context. There is no public exploit identified at time of analysis and it is not in CISA KEV; the fix (added IsSafePath() input validation) is publicly visible in PR #550.
We are tasked with synthesizing data from multiple sources about CVE-2026-15631 into a comprehensive JSON analysis. The input includes description, patches, CVSS, CWE, EPSS, references, etc. The output must be a JSON object with the specified fields, all as plain text strings, not arrays or objects. We need to follow the precision rules. First, understand the vulnerability: @fastify/http-proxy, a Node.js library, from version 9.4.0 to 11.5.0 inclusive, has a WebSocket path traversal issue. The description says that the WebSocket destination path is resolved via WHATWG URL constructor which collapses dot segments, so a crafted upgrade request with path traversal can escape the rewrite prefix and reach unintended upstream endpoints. This is a variant of CVE-2021-21322, but in a code path not fixed there. Exploitation requires a non-normalizing WebSocket client; browsers and ws package normalize, so raw HTTP clients or downstream proxies that forward request target unchanged make it reachable. Patch: upgrade to 11.6.0. CVSS: 10.0, vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). EPSS: 0.30% (low). No KEV mentioned, so not in KEV. POC availability not explicitly stated, but the description implies the vulnerability exists and exploitation conditions are known; however, no public POC is indicated. The tags: "Path Traversal, Fastify Http Proxy". CPE: cpe:2.3:a:@fastify/http-proxy:@fastify/http-proxy:*:*:*:*:*:*:*:*. EUVD affected versions: "@fastify/http-proxy 9.4.0 <11.6.0". References include a GitHub security advisory (GHSA-7hrw-592w-9wh2) and the OpenJS CNA page. We need to produce each field according to the instructions. product_name: "Fastify HTTP Proxy" (or @fastify/http-proxy? The instructions: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the
Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated network users bypass file path validation to reach files outside intended directories. Rated CVSS 8.8, the flaw is exploitable remotely by any authenticated user (PR:L) and the vendor scores full high confidentiality, integrity, and availability impact, implying potential arbitrary file read and/or write on the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user create a malicious flow that points to an attacker-controlled URL returning a crafted Content-Disposition header, causing the Langflow process to write attacker-supplied content to any filesystem path it can access. Because writes can land on startup scripts, keys, or configuration files, this path-traversal (CWE-22) flaw is a realistic route to full server compromise. IBM has released a fix; no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Arbitrary file read in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated attacker traverse the filesystem to exfiltrate sensitive files - most critically the JWT signing key - and then forge valid authentication tokens to impersonate any user, including administrators. The path-traversal-to-account-takeover chain turns a low-privilege foothold into full application compromise. No public exploit identified at time of analysis, and the EPSS score is low (0.38%, 31st percentile), but a vendor patch is available and the impact is severe.
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plant files at attacker-chosen paths on the Langflow host. The flaw lives in the APIRequest component's 'Save to File' feature, which trusts filenames from a response Content-Disposition header without sanitizing path traversal sequences, so a malicious server response can escape the temporary directory and write to any location the Langflow process can reach. No public exploit identified at time of analysis, and it is not in CISA KEV; a patch is available per IBM's advisory.
Arbitrary file write in GitHub Enterprise Server (all releases before 3.22) lets an attacker who already has code execution inside the Dependabot updater container escape the intended dependency-file directory via path traversal and symlink manipulation, planting attacker-controlled files anywhere in a repository - including GitHub Actions workflows under .github/workflows/. Because path validation checked the declared rather than the effective (symlink-resolved) path, an injected workflow can run with the repository's Actions secrets when the repo uses pull_request_target or auto-merge. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 4.0 base score is 8.6 (High).
Sensitive file disclosure in the Wazuh Manager (versions 4.0.0-4.10.3 and 4.11.0-4.14.4) allows a malicious enrolling agent to exfiltrate manager secrets by abusing the group parameter during enrollment. The authd enrollment daemon fails to filter path traversal ("..") sequences in the agent-selected group name, so remoted later builds shared-configuration paths that reach /var/ossec/etc and stream files such as client.keys, ossec.conf, and internal certificates to the attacker-controlled agent. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated CVSS 7.5 profile makes this a meaningful confidentiality risk for exposed manager enrollment services.
Authorization bypass in OpenClaw before 2026.5.18 lets a low-trust, authenticated caller escape the exec allowlist by abusing weak glob matching, executing or persisting actions beyond their intended authorization. Reported by VulnCheck and tracked as a path-traversal-class flaw (CWE-22), it carries a CVSS 4.0 score of 7.7 with high confidentiality, integrity, and availability impact but requires the affected exec feature to be enabled. No public exploit identified at time of analysis; there is a GitHub security advisory and a corresponding VulnCheck advisory.
Server-Side Request Forgery and arbitrary local file read in ArcadeDB before 26.6.1 let any authenticated user with SQL command/query access - not just root/administrators - abuse the SQL `IMPORT DATABASE` statement, whose source URL was passed to the importer unchecked. Because it required no administrative privileges, a low-privileged user could force the server to fetch arbitrary HTTP(S) endpoints (including cloud metadata at 169.254.169.254 and internal-only services) and ingest the responses as queryable records, or read local files such as `/etc/passwd` and credential files via `file://` paths. No public exploit identified at time of analysis; the flaw was privately reported and fixed in release 26.6.1.
Arbitrary file read in the Whistle debugging proxy (avwo/whistle) before 2.10.3 lets remote attackers retrieve any file on the host by abusing the GET /cgi-bin/temp/get endpoint. Because lib/service/service.js only sanitizes req.query.filename when it matches the temporary-file pattern and otherwise hands the raw filename to getFile, a value like ../../../../etc/passwd escapes TEMP_FILES_PATH and is served back. The CVSS 4.0 score is 8.7 (high) with a confidentiality-only impact; there is no public exploit identified at time of analysis, and the flaw is fixed in 2.10.3.
Path traversal in Manyfold's file-rename functionality (versions 0.96.0 through 0.139.x) lets an authenticated user move or write files outside the configured 3D-model library directory. The flaw stems from app/models/model_file.rb passing a user-controlled filename straight into File.join(model.path, filename) without stripping '..' sequences, giving low-privileged users write/overwrite primitives on the host filesystem. No public exploit identified at time of analysis, but the upstream fix commit and its test cases plainly demonstrate the traversal, and the issue is resolved in 0.140.0.
Local code execution in Lenovo App Store (Chinese-market distribution only) lets an authenticated local user abuse a path traversal weakness to write or load files outside intended directories and run arbitrary code. The flaw was self-reported by Lenovo and carries a CVSS 4.0 base score of 7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high to confidentiality, integrity, and availability of the local system, but exploitation requires existing low-privilege local access plus user interaction.
We need to produce a comprehensive analysis JSON for CVE-2026-53598, based on the provided data. The CVE involves Microsoft's Prompty (a markdown file format for LLM prompts), path traversal in file references, fixed in 2.0.0-beta.2. We have CVSS: 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, CWE-22. EPSS 1.06% (percentile 61%). Patch available. SSVC: Exploitation none, Automatable yes, Technical impact partial. CPE: cpe:2.3:a:microsoft:prompty:*:*:*:*:*:*:*:*. Versions fixed: 2.0.0b2 for PyPI, 2.0.0-beta.2 for npm, crates.io, NuGet. We have a GitHub Advisory detailing the vulnerability, affected packages, fix details. The commit diff shows the fix canonicalizing paths, restricting file references to within the prompt directory by default, and allowing host apps to provide additional allowed roots. The diff adds tests for traversal, absolute path, and symlink escape. Now we need to fill in the JSON fields. We'll synthesize from all sources. product_name: "Prompty" - the specific product name, as per instructions (1-3 words). "Microsoft Prompty" could work, but "Prompty" is sufficient. I'll use "Microsoft Prompty" to include vendor, but requirement: "NOT the vendor alone, NOT a description." So "Prompty" alone is fine and concise. Using "Prompty". summary: We must not copy or paraphrase description. Original synthesis using all data. Start with specific impact verb and product. So e.g., "Arbitrary file read in Microsoft Prompty before 2.0.0-beta.2 allows an attacker to read local files via crafted .prompty frontmatter file references." Mention that it allows path traversal, absolute paths, symlink escapes. Not actively exploited (KEV false, EPSS 1.06% low), POC exists? Not mentioned, but there are regression tests that demonstrate the attack, which could serve as proof-of-concept. But we'll state: "no public exploit identified at time of analysis" per rules, because no POC tag is provided. Wait, there's no explicit POC=YES in input, only the advisory and commi
Build-time SSRF, remote file inclusion, and local file inclusion in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description force the `kiota generate` command to fetch arbitrary remote http(s) URLs and read local absolute or out-of-tree file paths while resolving $ref values. Because Kiota inlined those external schemas into generated clients, an attacker could exfiltrate internal endpoints or leak local file contents (e.g. REMOTE_KIOTA_PROP-style properties) into produced code. No public exploit has been identified at time of analysis; the risk is developer/CI-toolchain oriented and requires a developer to run generation against a malicious or influenced description (CVSS 7.1).
Path traversal and code injection in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description write generated source files outside the intended output directory and inject arbitrary text into class/namespace declarations. When a developer runs `kiota generate` without the -c/--class-name flag, Kiota consumes the clientClassName and clientNamespaceName values from the OpenAPI `x-ms-kiota-info` extension without identifier or path sanitization, using them both as code identifiers and as filesystem path components. There is no public exploit identified at time of analysis and no CISA KEV listing, though the fix (SanitizeClientClassName/SanitizeClientNamespaceName) is visible in the merged patch.
Path traversal in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description inject unvalidated `static_template.file` values (via the x-ai-adaptive-card and x-ai-capabilities extensions) into generated Microsoft 365 Copilot and Teams plugin manifests, so a developer who runs `kiota plugin add` or `kiota plugin generate -t APIPlugin` against a malicious spec produces a manifest that resolves files outside its package when deployed. Rated CVSS 4.0 9.3 (Critical) with high confidentiality/integrity/availability impact and no privileges required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the upstream fix is confirmed in release v1.32.5.
Arbitrary file write via path traversal in Microsoft Kiota (OpenAPI HTTP client/plugin code generator) before 1.32.5 allows a malicious repository or pull request to place files outside the workspace root on a developer or CI host. The tool trusts the checked-in .kiota/workspace.json and honors attacker-controlled per-client and per-plugin outputPath values during 'kiota client generate' and 'kiota plugin generate' without validating them. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but exploitation is realistic in CI/pull-request workflows since it only requires a developer to run generation against poisoned config.
Arbitrary file read and server-side request forgery in TensorZero Gateway (pip package tensorzero, versions < 2026.6.0) let callers of the /internal/object_storage endpoint override the gateway's [object_storage] configuration via a caller-supplied storage_path JSON parameter. Using the filesystem storage type an attacker reads arbitrary files (including credential files) from the gateway host, while the s3_compatible type coerces the gateway into outbound requests to attacker-chosen internal or cloud-metadata endpoints. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; exploitability hinges on whether the deployment has authentication enabled.
Arbitrary file read and denial of service in Wekan (open-source Meteor kanban board) before version 9.31 allows an authenticated board member to read any file the server process can access by supplying attacker-controlled versions.original.path and versions.original.storage values to the /attachments/insert DDP method. Because the server-side insert permission rule only validates board write access and the filesystem store never confirms the path stays within the storage root, a low-privileged user can exfiltrate sensitive host files or hang the process by pointing at special files like /dev/zero. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a fixing commit and release (v9.31) are public.
Arbitrary directory deletion in DataEase, an open-source data visualization and analysis platform, allows an authenticated user (PR:L) to abuse the export-center bulk delete API by injecting path traversal sequences (../) into task identifiers, which are passed unsanitized to ExportCenterManage.delete and used to recursively delete server directories. All releases prior to 2.10.23 are affected, and the fix in 2.10.23 constrains deletion to identifiers that exist as legitimate export tasks in the database. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but a full commit-level patch is publicly available which lowers the barrier to reverse-engineering an exploit.
Arbitrary file write in DataEase (open-source BI/data-visualization platform) before 2.10.23 lets an authenticated user (PR:L) abuse the /de2api/templateManage/save template-save endpoint to write attacker-controlled Base64 content to arbitrary filesystem paths. Because StaticResourceServer#saveFilesToServe extracted the filename using only a forward-slash split, crafted staticResource names containing traversal sequences or backslashes escaped the intended static-resource directory. No public exploit or CISA KEV listing is identified at time of analysis, though the fixing commit and advisory are public.
Arbitrary file disclosure in the Gravity Forms WordPress plugin (all versions through 2.10.4) lets unauthenticated attackers read sensitive files from the web server by abusing the 'gform_uploaded_files' parameter against the process_send_resume_link endpoint. Reported by Wordfence, the flaw carries CVSS 7.5 and is exfiltrated by directing the traversal-retrieved file to an attacker-controlled email as a form notification attachment. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file write in Splunk Enterprise (versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, 9.3.14) and Splunk Cloud Platform lets a privileged user with the edit_local_apps and install_apps capabilities abuse the app-installation workflow to write files outside the target app directory into $SPLUNK_HOME/etc/ and its subdirectories. The flaw is a path traversal (CWE-22) that can be leveraged to overwrite Splunk configuration and system files, yielding high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in Cornac's dataset-download utility (all versions before 2.6.0) lets an attacker who controls a downloaded TAR archive place files anywhere the Python process can write, because the _extract_archive() helper in cornac/utils/download.py calls archive.extractall() without validating member paths. Since Cornac's built-in dataset loaders automatically fetch and unpack archives, a poisoned or MITM'd dataset archive containing ../ traversal, absolute paths, or symlink/hardlink entries can overwrite sensitive files and potentially achieve code execution. VulnCheck reported the issue; no public exploit identified at time of analysis and it is not in CISA KEV.
Authenticated arbitrary file write in the Grav CMS Form plugin (versions before 9.1.8) allows attackers to plant PHP webshells in the web root by abusing the process.save.filename parameter. The filename is checked for path traversal before Twig rendering but never re-validated afterward, so traversal sequences reconstructed during template evaluation bypass the guard. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the flaw was disclosed by VulnCheck via a coordinated GitHub security advisory.
Arbitrary code execution in PraisonAI (praisonaiagents) before 1.6.78 lets an attacker who can drop a Python file into a plugin directory run their own code. The plugin manager auto-discovers and executes any .py file found in project-level or user-home .praisonai/plugins/ directories at initialization, with no code signing, integrity checks, or sandboxing. VulnCheck reported it under CWE-94; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path-traversal remote code execution in PraisonAI (mervinpraison/praisonai) before 1.6.78 lets an authenticated agent user abuse SkillTools.run_skill_script(), which executes skill scripts without validating that the supplied path stays inside the intended working directory. Because absolute file paths are accepted, a low-privileged attacker can point the skill runner at any executable script on the host and run it. No public exploit code has been identified and it is not in CISA KEV, but the flaw was reported by VulnCheck and a GitHub Security Advisory (GHSA-c44f-37qr-gw3f) confirms the fix.
Path traversal in the `rclone serve restic --private-repos` REST server (versions prior to 1.74.4) allows an authenticated low-privileged user to read, overwrite, or delete another tenant's private restic repository. Authorization is enforced against the routed user path segment, but the backend object key is built from the raw, uncleaned URL path, so a request such as `//..//config` passes the per-user check while resolving to a different user's data on storage backends that clean path components. No public exploit has been identified at time of analysis, but the fix and a regression test are public in the vendor commits, and EPSS risk is modest (0.52%).
Arbitrary file write leading to code execution in jadx 1.5.2 through 1.5.5 allows a malicious .xapk sample to escape the XAPK plugin unpack directory and plant a JAR under plugins/dropins, which the next jadx launch loads and executes via URLClassLoader/ServiceLoader. The flaw stems from XApkLoader calling tmpDir.resolve(fileName) after a flawed CWD-based ZIP name check, giving an analyst opening a crafted file a path traversal that escalates to attacker-controlled plugin code. Publicly available exploit code exists (SSVC exploitation: poc) but it is not in CISA KEV, and EPSS is very low at 0.13% (3rd percentile), consistent with a local, user-interaction-gated, high-complexity issue rather than mass exploitation.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) arises from a path traversal weakness that lets an authenticated attacker with high privileges escape a restricted directory and run code in the context of the current user. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, and CISA's SSVC rates the technical impact as total. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.93%), indicating no evidence of widespread automated exploitation yet.
Path traversal in Adobe ColdFusion allows an authenticated remote attacker (PR:L) to read arbitrary files outside the intended web/application scope by manipulating pathname input, per Adobe advisory APSB26-82. The flaw carries a critical 9.9 CVSS with a changed scope, meaning a successful read can reach files belonging to other security contexts on the host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local File Read in Anyquery's Server Mode lets unauthenticated network attackers exfiltrate arbitrary files (e.g. /etc/passwd, ~/.ssh/id_rsa) readable by the server process. When `anyquery server` is running and reachable, any client speaking the MySQL wire protocol can issue native SQLite CREATE VIRTUAL TABLE statements against built-in reader modules such as csv_reader or log_reader to point at restricted paths, with no authentication or credentials required (CVSS 3.1 base 7.5, C:H/I:N/A:N). A working proof-of-concept is published in the GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing or EPSS score in the provided data.
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from a path traversal weakness triggered when a victim opens a maliciously crafted file, letting an attacker run code in the context of the current user and reach files or directories outside intended restrictions. The flaw carries a CVSS 3.1 base score of 8.6 with a changed scope, reflecting impact beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation risk hinges on social-engineering a user into opening a rogue project file.
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenticated attackers traverse outside the intended directory scope to retrieve sensitive files, per Adobe advisory APSB26-74. The CVSS 3.1 score of 8.6 is elevated by a changed scope (S:C), meaning the read reaches resources beyond the vulnerable component's security authority. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Arbitrary file write in Anyquery Server Mode (versions < 0.4.5) allows unauthenticated remote attackers to write files to any path the process can access by abusing SQLite's native ATTACH DATABASE command exposed over the MySQL-compatible listener. Because the server blindly proxies SQL to the underlying SQLite engine, an attacker can create files such as cron jobs, PHP web shells, or SSH authorized_keys and escalate the file write into remote code execution or denial of service. A working step-by-step proof-of-concept is published in the vendor's GitHub Security Advisory (GHSA-xrcf-6jh3-ggvx); there is no CISA KEV entry and no confirmed in-the-wild exploitation at time of analysis.
Unauthenticated arbitrary file read in FacturaScripts (all versions through v2026.2) lets remote attackers retrieve protected documents by abusing the static file controllers Files.php and Myfiles.php, which authorize requests on the raw URL prefix rather than the resolved filesystem path. A request such as /Plugins/../MyFiles/Private/invoice.pdf passes the prefix allow-list yet resolves to a private file, leaking customer/supplier invoices, attachments, and .sql database backups. A detailed, reproducible exploit is publicly available in the GitHub Security Advisory; there is no vendor-released patch identified at time of analysis and no evidence of active exploitation.
Remote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the network by exploiting a relative path traversal (CWE-23) flaw. Any user holding valid low-privilege credentials to the WAC gateway can leverage the traversal to break out of the intended file path and achieve full compromise (confidentiality, integrity, and availability impact all High). Microsoft has published a patch via MSRC; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in Windows User Interface Core (UI Core) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a relative path traversal flaw lets an already-authenticated low-privileged user escalate to higher privileges on the local machine. The CVSS 3.1 score of 7.8 reflects full confidentiality, integrity, and availability impact once triggered, though attack requires local access and existing low-level privileges. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Windows PowerShell allows an authenticated attacker with low privileges to run arbitrary code across a network by exploiting a relative path traversal (CWE-23) flaw, provided a victim is induced to interact (UI:R). Affecting supported Windows 10/11 clients and Windows Server 2012 through 2025, the issue carries a CVSS 8.0 with full confidentiality, integrity, and availability impact, and a vendor patch is available via MSRC. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in Microsoft's Age of Empires II: Definitive Edition Game is possible via a relative path traversal flaw (CWE-23) that lets a network-based attacker execute arbitrary code once a victim loads attacker-supplied content. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and requires user interaction, meaning a player must open or load a malicious game asset such as a downloaded map, mod, recording, or scenario. Microsoft has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file read/write in Perl's DBD::File before 1.651 lets callers of file-based DBI drivers escape the configured data directory via a symbolic link placed inside it. Because the complete_table_name method resolved the absolute table-file path without validating whether the entry was a symlink, a link within f_dir could point to any path on the filesystem, breaking the directory sandbox for both reads and writes. No public exploit has been identified at time of analysis, and the flaw is not in CISA KEV; a vendor patch (DBI 1.651) is available.
Sandbox escape via path traversal in macOS allows a malicious app to read and write files outside its sandbox, potentially accessing sensitive data. Affects macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, with no privileges needed but requiring user interaction to launch the crafted app. No active exploitation or public exploit code known at time of analysis; EPSS indicates low exploitation probability.
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability, a path handling flaw in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, enables a low-privileged application to traverse directories and elevate its permissions. No user interaction is required, and no active exploitation or public proof-of-concept has been identified at the time of analysis.
Authenticated low-privilege users of JFrog Artifactory can write arbitrary files outside the intended build artifacts location via a path traversal flaw in archive extraction. The vulnerability allows an attacker who has already obtained limited access to the application to overwrite critical files, potentially escalating to remote code execution. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS score reflects the severe impact if leveraged.
Path traversal in phpMyFAQ's category image deletion allows authenticated attackers to delete arbitrary files, leading to superadmin account creation. Versions before 4.1.6 fail to sanitize the existing_image parameter, permitting deletion of critical files like database.php, which disables the installation gate and exposes the setup wizard. Publicly available exploit code exists, and the issue has been verified by the vendor.
Arbitrary file write in NitroShare Desktop 0.3.4 allows unauthenticated attackers on the same network to plant malicious files on a target system by sending a crafted filename with directory traversal sequences in the JSON item header name field. The vulnerability can be exploited to write to the Windows Startup folder, achieving persistent code execution when the user next logs in. Publicly available exploit code exists but it is not listed in CISA KEV.
Authenticated arbitrary file deletion in SP Page Builder before 6.7.1 allows attackers with administrative access to Joomla to delete any file on the server via a path traversal flaw in the media manager. The vulnerability is not known to be actively exploited or have a public exploit, but the high CVSS score reflects the severe integrity impact once administrative privileges are obtained.
Path traversal vulnerability in Microsoft Edge (Chromium-based) permits a remote, unauthenticated attacker to disclose arbitrary file contents to an external party. The attack requires user interaction, such as visiting a malicious website, and can lead to exposure of sensitive files accessible to the browser process. The vendor has released a patch, but no public exploit or active exploitation is currently known.
Path traversal bypass in the Linux kernel's ksmbd SMB server allows authenticated users with write access to a share to create zero-length files or directories outside the exported share boundary. The flaw exists only when the share is configured with case-insensitive (caseless) filename handling. Patches are available; the vulnerability is not known to be actively exploited, has a low EPSS score (0.26%), and no public exploit has been identified.
Directory traversal in Exim before 4.99.5 enables low-privileged local users to escape the mail spool directory boundary and read or manipulate arbitrary files on the host filesystem, ultimately achieving privilege escalation. The flaw is rooted in improper validation of queue-name arguments (CWE-24), affecting Exim from version 4.88 through 4.99.4. No public exploit has been identified at time of analysis, and EPSS at 0.27% (19th percentile) reflects limited exploitation activity, though SSVC assesses the technical impact as total given successful exploitation yields full system compromise.
Unauthenticated arbitrary file read in Microweber CMS through version 2.0.20 lets remote attackers retrieve sensitive files via directory traversal in the static file controller (ServeStaticFileContoller). Because the controller trusts the attacker-controlled ?path= query input over the bound route segment and normalize_path() fails to strip traversal sequences, a single unauthenticated HTTP GET can disclose environment configuration files containing credentials and other system files. Publicly available exploit code exists; the flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 8.7.
Unauthenticated arbitrary file read in Meshery before 1.0.57 lets remote attackers retrieve any file on the host by abusing the /api/system/fileView and /api/system/fileDownload endpoints, which pass a user-controlled file parameter straight to os.Open with no path validation. Reported by VulnCheck and fixed in v1.0.57, it carries a CVSS 4.0 score of 8.7 and requires no authentication or user interaction; no public exploit identified at time of analysis, though the fix commit publicly reveals the exact vulnerable code path.
Arbitrary file write and unauthorized file read in Vanna (the open-source AI SQL agent) through version 2.0.2 allows unauthenticated remote attackers to escape the FileSystemConversationStore base directory by injecting path traversal sequences into the conversation_id parameter of the chat API. Because the affected endpoints require no authentication, an attacker can write attacker-controlled JSON to arbitrary filesystem locations and read conversation metadata from outside the intended store - publicly available exploit code exists and the flaw was reported by VulnCheck. No CISA KEV listing is present, so there is no public exploit identified as being actively used in the wild.
Arbitrary file read and write in SoftVC VITS Singing Voice Conversion (so-vits-svc, through commit 730930d) lets unauthenticated remote attackers exfiltrate any server-readable file and plant .wav files anywhere the process can write, by supplying attacker-controlled paths in the audio_path field of the /wav2wav Flask route. Because the full-song inference server passes the value verbatim to librosa/torchaudio/soundfile sinks, a single POST can both leak file contents in the HTTP response and drop files on disk. Publicly available exploit code exists (VulnCheck advisory and geo-chen writeup); no public evidence of active exploitation at time of analysis.
Remote code execution in h2oGPT through 0.2.1 lets unauthenticated remote attackers read, write, and delete arbitrary files by injecting path traversal sequences into the HTTP bearer token of the OpenAI-compatible files API. Because the shipped default API key is empty, authentication is effectively bypassed and the token string is used directly as a filesystem path component, so an attacker can escape the user directory and plant startup hooks or application-loaded files to execute code. Publicly available exploit code exists (reported by VulnCheck); there is no public exploit identified in CISA KEV, and the CVSS 4.0 base score is 9.3 (Critical).
Arbitrary .docx read and write in Office-Word-MCP-Server (gongrzhe) through version 1.1.11 lets an attacker who can influence the filename argument passed to the document tools escape the intended working directory using absolute paths or ../ sequences. Because the exposed open/save operations run in an MCP tool context, a malicious or prompt-injected instruction can read sensitive .docx files or create and overwrite documents anywhere the server process has filesystem access. Publicly available exploit code exists (VulnCheck), but there is no public exploit identified as actively used and it is not on CISA KEV.
Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile).
Remote code execution in Bold Reports Standalone Report Designer before 14.1.12 lets authenticated users abuse the file-upload feature to write files outside the intended directory via a crafted filename, ultimately running arbitrary commands with high privileges on the host. The flaw chains a CWE-22 path traversal into server-side command execution, and per the CVSS 4.0 vector requires only low privileges with no user interaction over the network. No public exploit identified at time of analysis, though a VulnCheck advisory documents the issue.
Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers retrieve any file on the host through a path traversal flaw in the database download feature. Because readable files can include stored authentication credentials, a single crafted request can escalate to full unauthorized access to the application. There is no public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and zero-precondition attack surface make this a high-priority patch.
Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers traverse the filesystem via the font-processing feature and retrieve any file the service account can access. Because readable files include stored authentication credentials, a successful read can be pivoted into full unauthorized access to the application. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV, but the CVSS 4.0 base score is 9.3 (Critical).
Arbitrary file read in Bold Reports Standalone Report Designer before 14.1.12 lets unauthenticated remote attackers retrieve any file on the server through a path traversal flaw in the SVG processing feature. Because readable files include stored authentication credentials, an attacker can pivot from file disclosure to full unauthorized access of the application. Disclosed by VulnCheck with a CVSS 4.0 base of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in the Grav API Plugin (getgrav/grav-plugin-api) before 1.0.10 lets an authenticated caller holding the api.pages.write permission relocate an entire page directory outside user/pages/ and even outside the Grav installation. The flaw sits in the POST /pages/{route}/move endpoint, where PagesController::move() only strips leading periods from the slug and never neutralizes '/' or '..' segments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but an upstream fix and a GHSA advisory are published.
Arbitrary file read in SiYuan (an open-source personal knowledge-management / note-taking application) before v3.7.2 allows an authenticated attacker to retrieve files anywhere on the host by abusing the /export/temp/ short-circuit branch of the serveExport handler. Because this branch joins the raw, percent-decoded request path to the temp directory without the IsSubPath or IsSensitivePath guards used elsewhere, percent-encoded '..' sequences escape TempDir and expose /etc/passwd, SSH private keys, and SiYuan's own workspace *.db and *.log files. No public exploit identified at time of analysis, though the advisory documents a concrete payload; EPSS and CISA KEV data are not provided in the input.
Arbitrary file deletion in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote, unauthenticated attackers delete any file the web server can access via a path traversal flaw. Deleting critical files such as wp-config.php can force WordPress into its setup routine and enable full site takeover, which is why this carries a CVSS 10.0 rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable nature makes it a high-priority patch.
Arbitrary file deletion in the Kali Forms WordPress plugin (versions 2.4.18 and earlier) lets a low-privileged authenticated user - as low as a Subscriber - delete arbitrary files on the server via path traversal. On sites that allow open registration, an attacker can self-provision an account and remove critical files such as wp-config.php, knocking the site offline or forcing it into a fresh-install state. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary file deletion in the VideoWhisper Picture Gallery WordPress plugin (versions <= 1.6.5) allows an authenticated user holding the low-privilege Contributor role to delete arbitrary files on the server via path traversal (CWE-22). Rated CVSS 7.1, the flaw carries no confidentiality impact but high availability impact, since deleting critical files (e.g. wp-config.php) can break or hijack the site. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated remote file disclosure in ReReplacer Pro extension for Joomla allows attackers to read arbitrary files outside the site directory via path traversal in XML include paths. The vulnerability affects versions 1.0.0 through 15.0.3 and has a CVSS 3.1 score of 7.5 (high confidentiality impact). No public exploit code or active exploitation has been reported, and EPSS indicates a very low probability of widespread exploitation.
Unsafe file extraction in the Joomla GeoIP extension (versions 1.0.0-6.3.8) enables remote code execution by writing files outside intended directories during update processing. The vulnerability (CWE-22) does not require authentication and is triggered when the extension extracts untrusted archive files. EPSS probability of exploitation is low (0.20%), and no active exploitation or public exploit is confirmed at this time.
Path-traversal-based middleware bypass in @fastify/static versions up to and including 10.1.0 lets an unauthenticated remote attacker use dot-dot (../) path segments to reach files inside the static root that were meant to be protected by route-scoped middleware. This is a regression bypass of the earlier CVE-2026-6414 fix, which only blocked encoded forward slashes; the underlying send library normalizes dot segments before its own guard runs, defeating route-guard filtering. No public exploit has been identified at time of analysis, and the flaw is fixed in 10.1.1.
Local privilege escalation in Analog Way Picturall Quad Compact Mark II firmware version 3.5.8 allows authenticated low-privileged users to gain root access via path traversal in a maintenance script. No active exploitation or public exploit code has been reported; vendor patch is available in version 3.5.9.
Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistence storage provider derives its storage key from user-controlled input, letting a remote attacker steer a path traversal into attacker-controlled deserialization. Because the CVSS vector is PR:N/UI:N, an unauthenticated remote attacker can chain the traversal to load a crafted serialized payload and execute arbitrary code, though the AC:H rating signals the attack is non-trivial to reliably trigger. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Authentication bypass in the Traefik reverse proxy (v2.11.51 and earlier, v3.6.0-v3.6.22, and v3.7.0-v3.7.6) allows unauthenticated remote attackers to reach protected backend routes by abusing the ReplacePathRegex middleware. When the middleware rewrites a path using a capture group lacking a mandatory separator, a crafted request such as GET /api../admin yields an un-normalized path (/../admin) that the middleware forwards without re-validation; a normalizing backend then resolves it to a protected route, skipping any auth middleware bound to that path. No public exploit identified at time of analysis, and no EPSS/KEV data was supplied, but the flaw is trivially reproducible from the advisory's own example.
Local privilege escalation in the Veeam Updater component of the Veeam Software Appliance allows a high-privileged local user to reach root-level control of the underlying operating system via path traversal (CWE-22). The flaw affects Veeam Backup & Replication deployed as the hardened software appliance, carries a CVSS 4.0 base score of 8.4, and was reported through HackerOne. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so current risk is latent rather than actively exploited.
Privilege-to-RCE escalation in HPE Aruba Networking AOS-CX switch operating system allows an authenticated, high-privileged administrator to abuse a path traversal flaw in the CLI to copy arbitrary files from the underlying OS into a user-readable location, which can be leveraged to achieve remote code execution. The weakness affects the switch management CLI and requires existing administrative access; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high across confidentiality, integrity, and availability because it breaks the boundary between the constrained CLI and the underlying operating system.
Path traversal in Progress ShareFile Storage Zones Controller before 5.12.5 and 6.0.2 lets an authenticated administrative user break out of intended directory boundaries to read arbitrary files, write files to arbitrary locations, and probe for file existence on the underlying server. Rated CVSS 8.7 with a scope change (S:C), the flaw converts application-level admin privileges into host filesystem read/write, but exploitation requires high privileges (PR:H) and there is no public exploit identified at time of analysis. Affected organizations are those self-hosting the on-premises Storage Zones Controller component that fronts ShareFile storage zones.
Arbitrary file write in Home Assistant Core before 2026.6.0 lets unauthenticated attackers plant attacker-controlled files anywhere on the host by uploading a malicious backup archive during the initial onboarding window. Because the process frequently runs as root (e.g., in the supervised/OS install), this path traversal escalates to full host compromise. No public exploit is identified at time of analysis, and it is not listed in CISA KEV, but a vendor-released patch (2026.6.0) exists and the issue was reported by VulnCheck.
Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply a backup archive overwrite arbitrary files on the host. The backup-restore routine trusts a tar SYMTYPE (symlink) entry whose linkname is an absolute path outside the extraction directory, then writes a following regular-file entry through that unvalidated symlink; because the official Docker image runs the process as root, an attacker can drop code into auto-imported Python paths (e.g. site-packages/sitecustomize.py) and gain code execution. Reported by VulnCheck with a vendor patch available (2026.6.0); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Directory traversal in Knowns 0.11.4 (the 'knowns' npm CLI/MCP knowledge layer for AI-assisted development) lets an attacker supply a crafted folder name to the create_doc tool and cause documents to be created outside the intended workspace directory. Because create_doc is exposed to AI agents via MCP, a malicious or manipulated tool call can traverse the filesystem using sequences such as '../'. A researcher gist and an upstream fix commit are referenced, so publicly available exploit code exists; the flaw is not in CISA KEV and carries a low EPSS score (0.26%, 18th percentile), indicating no evidence of widespread active exploitation.
Arbitrary file read (and likely write) in the Knowns 0.11.4 AI knowledge-layer server allows remote attackers to escape the intended document directory by supplying crafted relative paths to its get_doc and update_doc MCP tools. Because Knowns exposes these tools to AI agents and self-hosted clients, an attacker who can reach the tool interface can retrieve or tamper with files outside the managed knowledge store. EPSS is low (0.26%, 18th percentile) and there is no public exploit identified at time of analysis, though an upstream fix commit and a researcher gist both exist.
Arbitrary code execution in DayuanJiang next-ai-draw-io 0.4.13 arises from a path traversal flaw in the bundled MCP (Model Context Protocol) server, allowing an attacker who can influence a request to the mcp-server component to write or access files outside the intended directory and ultimately run code on the host. The affected product is a niche open-source AI-assisted draw.io diagramming application. No public exploit has been confirmed, though a third-party technical writeup exists; EPSS is low (0.43%, 35th percentile) and the flaw is not in CISA KEV.
Path traversal in Apache MINA SSHD's sshd-git component lets an authenticated remote user on Windows-hosted git servers escape the configured server-side root directory and reach git repositories elsewhere on the filesystem. It is an incomplete-fix regression of CVE-2026-48827: the path validation added in 2.18.0 and 3.0.0-M4 was only partly effective on Windows path semantics. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Arbitrary file write in Apache MINA SSHD's sshd-scp component lets a malicious SCP sender place files outside the intended download directory because filenames in SCP 'C' (file) and 'D' (directory) commands are not validated for path separators. Any application acting as an SCP receiver - either an SSHD server accepting uploads or an SCP client fetching from a server - using unsupported versions <2.0.0 or the sshd-scp module in >=2.0.0 is affected, allowing an attacker to overwrite or plant files in attacker-chosen locations. Reported by Apache; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file disclosure in ThemeXpert's Quix Page Builder Pro extension for Joomla allows unauthenticated frontend users to read files outside the intended directory by supplying traversal sequences to a Form element on a published page. The flaw (CWE-22) carries a CVSS 4.0 base score of 8.7 driven by high confidentiality impact with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated nature makes it a strong candidate for opportunistic scanning.
Unauthenticated loopback API access and path traversal in WhatsApp MCP Server (whatsapp-mcp) prior to v0.2.1 allow any same-user local process - including sibling MCP servers and IDE extensions - to send WhatsApp messages from the paired account and exfiltrate arbitrary user-readable files (SSH private keys, browser session data, dotfiles) as WhatsApp document attachments. The whatsapp-bridge HTTP service on 127.0.0.1:8080 requires no authentication and validates no Host header, enabling a DNS rebinding attack whereby a malicious webpage visited by the user can trigger identical file exfiltration remotely without any credentials. No public exploit identified at time of analysis; vendor-released patch v0.2.1 is available.
Arbitrary recursive file deletion in Network-AI (npm package `network-ai`) before v5.12.2 allows a local attacker who can write into an environment's backup directory to delete any path the process user can access. `EnvironmentManager.pruneBackups()` trusts the `path` field of an attacker-controllable `_manifest.json` and feeds it straight into `rmSync(..., { recursive: true, force: true })`, so a poisoned manifest such as `"path": "/"` gets deleted when `network-ai env backup prune` runs. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); there is no public exploit identified as actively exploited and it is not in CISA KEV.
Arbitrary file disclosure in dataCycle-CORE (versions up to and including 25.07.3) allows an unauthenticated remote attacker to read arbitrary .md files outside the intended docs/static directories. The documentation and static markdown renderer passes attacker-controlled path segments only through the Rails HTML sanitizer, which does not strip directory-traversal sequences, enabling path traversal to the application or engine root. No public exploit identified at time of analysis; the flaw is remotely reachable with no authentication and low complexity (CVSS 7.5). Patched in version 26.06.08.
Arbitrary file read in FileBrowser Quantum (gtsteffaniak/filebrowser) before 1.4.3-beta lets any authenticated user, regardless of role or permissions, exfiltrate sensitive host files via the GET /api/media/subtitles endpoint. The endpoint's `path` and `name` query parameters are used in filesystem operations without sanitization, yielding two independent path-traversal vectors that escape the storage root to read files such as /etc/passwd, SSH keys, database credentials, and JWT signing keys. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in commit f3f4bbe and released in 1.4.3-beta.
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended export directory via directory-traversal sequences embedded in a user-controlled relative_path. Because the exported file content is also attacker-supplied (an uploaded artifact), the flaw lets a privileged user plant or overwrite arbitrary files anywhere the Pulp service user can write, enabling service compromise or broader host takeover. Rated CVSS 9.0 and reported by Red Hat, it affects pulpcore as embedded in Ansible Automation Platform 2, Satellite 6, and Red Hat Update Infrastructure 4/5; there is no public exploit identified at time of analysis.
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role disclose files readable by the SurrealDB process by pointing the DEFINE ANALYZER mapper() filter at an arbitrary path and harvesting the content from query error messages. The flaw is exploitable in default deployments because the SURREAL_FILE_ALLOWLIST is empty by default and an empty allowlist enforced no restriction. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the GHSA advisory documents the technique in enough detail to reproduce.
Path traversal in Menyoo (MenyooSP), a popular GTA V single-player trainer/mod, before commit 729aa48 lets a local user supply crafted file names (containing traversal sequences) to the Spooner, VehicleSpawner, WeaponOptions, and PedComponentChanger save/create-folder/rename functions, writing or renaming files outside the intended data directories. Because the resulting XML/config files can be planted in attacker-chosen locations, this escalates to arbitrary code execution in the victim's context. There is no public exploit identified at time of analysis and it is not in CISA KEV; the fix (added IsSafePath() input validation) is publicly visible in PR #550.
We are tasked with synthesizing data from multiple sources about CVE-2026-15631 into a comprehensive JSON analysis. The input includes description, patches, CVSS, CWE, EPSS, references, etc. The output must be a JSON object with the specified fields, all as plain text strings, not arrays or objects. We need to follow the precision rules. First, understand the vulnerability: @fastify/http-proxy, a Node.js library, from version 9.4.0 to 11.5.0 inclusive, has a WebSocket path traversal issue. The description says that the WebSocket destination path is resolved via WHATWG URL constructor which collapses dot segments, so a crafted upgrade request with path traversal can escape the rewrite prefix and reach unintended upstream endpoints. This is a variant of CVE-2021-21322, but in a code path not fixed there. Exploitation requires a non-normalizing WebSocket client; browsers and ws package normalize, so raw HTTP clients or downstream proxies that forward request target unchanged make it reachable. Patch: upgrade to 11.6.0. CVSS: 10.0, vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). EPSS: 0.30% (low). No KEV mentioned, so not in KEV. POC availability not explicitly stated, but the description implies the vulnerability exists and exploitation conditions are known; however, no public POC is indicated. The tags: "Path Traversal, Fastify Http Proxy". CPE: cpe:2.3:a:@fastify/http-proxy:@fastify/http-proxy:*:*:*:*:*:*:*:*. EUVD affected versions: "@fastify/http-proxy 9.4.0 <11.6.0". References include a GitHub security advisory (GHSA-7hrw-592w-9wh2) and the OpenJS CNA page. We need to produce each field according to the instructions. product_name: "Fastify HTTP Proxy" (or @fastify/http-proxy? The instructions: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the
Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated network users bypass file path validation to reach files outside intended directories. Rated CVSS 8.8, the flaw is exploitable remotely by any authenticated user (PR:L) and the vendor scores full high confidentiality, integrity, and availability impact, implying potential arbitrary file read and/or write on the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user create a malicious flow that points to an attacker-controlled URL returning a crafted Content-Disposition header, causing the Langflow process to write attacker-supplied content to any filesystem path it can access. Because writes can land on startup scripts, keys, or configuration files, this path-traversal (CWE-22) flaw is a realistic route to full server compromise. IBM has released a fix; no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Arbitrary file read in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated attacker traverse the filesystem to exfiltrate sensitive files - most critically the JWT signing key - and then forge valid authentication tokens to impersonate any user, including administrators. The path-traversal-to-account-takeover chain turns a low-privilege foothold into full application compromise. No public exploit identified at time of analysis, and the EPSS score is low (0.38%, 31st percentile), but a vendor patch is available and the impact is severe.
Arbitrary file write in IBM Langflow OSS 1.0.0 through 1.10.0 lets an attacker who controls an external HTTP server plant files at attacker-chosen paths on the Langflow host. The flaw lives in the APIRequest component's 'Save to File' feature, which trusts filenames from a response Content-Disposition header without sanitizing path traversal sequences, so a malicious server response can escape the temporary directory and write to any location the Langflow process can reach. No public exploit identified at time of analysis, and it is not in CISA KEV; a patch is available per IBM's advisory.
Arbitrary file write in GitHub Enterprise Server (all releases before 3.22) lets an attacker who already has code execution inside the Dependabot updater container escape the intended dependency-file directory via path traversal and symlink manipulation, planting attacker-controlled files anywhere in a repository - including GitHub Actions workflows under .github/workflows/. Because path validation checked the declared rather than the effective (symlink-resolved) path, an injected workflow can run with the repository's Actions secrets when the repo uses pull_request_target or auto-merge. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 4.0 base score is 8.6 (High).
Sensitive file disclosure in the Wazuh Manager (versions 4.0.0-4.10.3 and 4.11.0-4.14.4) allows a malicious enrolling agent to exfiltrate manager secrets by abusing the group parameter during enrollment. The authd enrollment daemon fails to filter path traversal ("..") sequences in the agent-selected group name, so remoted later builds shared-configuration paths that reach /var/ossec/etc and stream files such as client.keys, ossec.conf, and internal certificates to the attacker-controlled agent. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated CVSS 7.5 profile makes this a meaningful confidentiality risk for exposed manager enrollment services.
Authorization bypass in OpenClaw before 2026.5.18 lets a low-trust, authenticated caller escape the exec allowlist by abusing weak glob matching, executing or persisting actions beyond their intended authorization. Reported by VulnCheck and tracked as a path-traversal-class flaw (CWE-22), it carries a CVSS 4.0 score of 7.7 with high confidentiality, integrity, and availability impact but requires the affected exec feature to be enabled. No public exploit identified at time of analysis; there is a GitHub security advisory and a corresponding VulnCheck advisory.
Server-Side Request Forgery and arbitrary local file read in ArcadeDB before 26.6.1 let any authenticated user with SQL command/query access - not just root/administrators - abuse the SQL `IMPORT DATABASE` statement, whose source URL was passed to the importer unchecked. Because it required no administrative privileges, a low-privileged user could force the server to fetch arbitrary HTTP(S) endpoints (including cloud metadata at 169.254.169.254 and internal-only services) and ingest the responses as queryable records, or read local files such as `/etc/passwd` and credential files via `file://` paths. No public exploit identified at time of analysis; the flaw was privately reported and fixed in release 26.6.1.
Arbitrary file read in the Whistle debugging proxy (avwo/whistle) before 2.10.3 lets remote attackers retrieve any file on the host by abusing the GET /cgi-bin/temp/get endpoint. Because lib/service/service.js only sanitizes req.query.filename when it matches the temporary-file pattern and otherwise hands the raw filename to getFile, a value like ../../../../etc/passwd escapes TEMP_FILES_PATH and is served back. The CVSS 4.0 score is 8.7 (high) with a confidentiality-only impact; there is no public exploit identified at time of analysis, and the flaw is fixed in 2.10.3.
Path traversal in Manyfold's file-rename functionality (versions 0.96.0 through 0.139.x) lets an authenticated user move or write files outside the configured 3D-model library directory. The flaw stems from app/models/model_file.rb passing a user-controlled filename straight into File.join(model.path, filename) without stripping '..' sequences, giving low-privileged users write/overwrite primitives on the host filesystem. No public exploit identified at time of analysis, but the upstream fix commit and its test cases plainly demonstrate the traversal, and the issue is resolved in 0.140.0.
Local code execution in Lenovo App Store (Chinese-market distribution only) lets an authenticated local user abuse a path traversal weakness to write or load files outside intended directories and run arbitrary code. The flaw was self-reported by Lenovo and carries a CVSS 4.0 base score of 7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high to confidentiality, integrity, and availability of the local system, but exploitation requires existing low-privilege local access plus user interaction.
We need to produce a comprehensive analysis JSON for CVE-2026-53598, based on the provided data. The CVE involves Microsoft's Prompty (a markdown file format for LLM prompts), path traversal in file references, fixed in 2.0.0-beta.2. We have CVSS: 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, CWE-22. EPSS 1.06% (percentile 61%). Patch available. SSVC: Exploitation none, Automatable yes, Technical impact partial. CPE: cpe:2.3:a:microsoft:prompty:*:*:*:*:*:*:*:*. Versions fixed: 2.0.0b2 for PyPI, 2.0.0-beta.2 for npm, crates.io, NuGet. We have a GitHub Advisory detailing the vulnerability, affected packages, fix details. The commit diff shows the fix canonicalizing paths, restricting file references to within the prompt directory by default, and allowing host apps to provide additional allowed roots. The diff adds tests for traversal, absolute path, and symlink escape. Now we need to fill in the JSON fields. We'll synthesize from all sources. product_name: "Prompty" - the specific product name, as per instructions (1-3 words). "Microsoft Prompty" could work, but "Prompty" is sufficient. I'll use "Microsoft Prompty" to include vendor, but requirement: "NOT the vendor alone, NOT a description." So "Prompty" alone is fine and concise. Using "Prompty". summary: We must not copy or paraphrase description. Original synthesis using all data. Start with specific impact verb and product. So e.g., "Arbitrary file read in Microsoft Prompty before 2.0.0-beta.2 allows an attacker to read local files via crafted .prompty frontmatter file references." Mention that it allows path traversal, absolute paths, symlink escapes. Not actively exploited (KEV false, EPSS 1.06% low), POC exists? Not mentioned, but there are regression tests that demonstrate the attack, which could serve as proof-of-concept. But we'll state: "no public exploit identified at time of analysis" per rules, because no POC tag is provided. Wait, there's no explicit POC=YES in input, only the advisory and commi
Build-time SSRF, remote file inclusion, and local file inclusion in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description force the `kiota generate` command to fetch arbitrary remote http(s) URLs and read local absolute or out-of-tree file paths while resolving $ref values. Because Kiota inlined those external schemas into generated clients, an attacker could exfiltrate internal endpoints or leak local file contents (e.g. REMOTE_KIOTA_PROP-style properties) into produced code. No public exploit has been identified at time of analysis; the risk is developer/CI-toolchain oriented and requires a developer to run generation against a malicious or influenced description (CVSS 7.1).
Path traversal and code injection in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description write generated source files outside the intended output directory and inject arbitrary text into class/namespace declarations. When a developer runs `kiota generate` without the -c/--class-name flag, Kiota consumes the clientClassName and clientNamespaceName values from the OpenAPI `x-ms-kiota-info` extension without identifier or path sanitization, using them both as code identifiers and as filesystem path components. There is no public exploit identified at time of analysis and no CISA KEV listing, though the fix (SanitizeClientClassName/SanitizeClientNamespaceName) is visible in the merged patch.
Path traversal in Microsoft Kiota before 1.32.5 lets an attacker-controlled OpenAPI description inject unvalidated `static_template.file` values (via the x-ai-adaptive-card and x-ai-capabilities extensions) into generated Microsoft 365 Copilot and Teams plugin manifests, so a developer who runs `kiota plugin add` or `kiota plugin generate -t APIPlugin` against a malicious spec produces a manifest that resolves files outside its package when deployed. Rated CVSS 4.0 9.3 (Critical) with high confidentiality/integrity/availability impact and no privileges required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the upstream fix is confirmed in release v1.32.5.
Arbitrary file write via path traversal in Microsoft Kiota (OpenAPI HTTP client/plugin code generator) before 1.32.5 allows a malicious repository or pull request to place files outside the workspace root on a developer or CI host. The tool trusts the checked-in .kiota/workspace.json and honors attacker-controlled per-client and per-plugin outputPath values during 'kiota client generate' and 'kiota plugin generate' without validating them. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but exploitation is realistic in CI/pull-request workflows since it only requires a developer to run generation against poisoned config.
Arbitrary file read and server-side request forgery in TensorZero Gateway (pip package tensorzero, versions < 2026.6.0) let callers of the /internal/object_storage endpoint override the gateway's [object_storage] configuration via a caller-supplied storage_path JSON parameter. Using the filesystem storage type an attacker reads arbitrary files (including credential files) from the gateway host, while the s3_compatible type coerces the gateway into outbound requests to attacker-chosen internal or cloud-metadata endpoints. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; exploitability hinges on whether the deployment has authentication enabled.
Arbitrary file read and denial of service in Wekan (open-source Meteor kanban board) before version 9.31 allows an authenticated board member to read any file the server process can access by supplying attacker-controlled versions.original.path and versions.original.storage values to the /attachments/insert DDP method. Because the server-side insert permission rule only validates board write access and the filesystem store never confirms the path stays within the storage root, a low-privileged user can exfiltrate sensitive host files or hang the process by pointing at special files like /dev/zero. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a fixing commit and release (v9.31) are public.
Arbitrary directory deletion in DataEase, an open-source data visualization and analysis platform, allows an authenticated user (PR:L) to abuse the export-center bulk delete API by injecting path traversal sequences (../) into task identifiers, which are passed unsanitized to ExportCenterManage.delete and used to recursively delete server directories. All releases prior to 2.10.23 are affected, and the fix in 2.10.23 constrains deletion to identifiers that exist as legitimate export tasks in the database. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but a full commit-level patch is publicly available which lowers the barrier to reverse-engineering an exploit.
Arbitrary file write in DataEase (open-source BI/data-visualization platform) before 2.10.23 lets an authenticated user (PR:L) abuse the /de2api/templateManage/save template-save endpoint to write attacker-controlled Base64 content to arbitrary filesystem paths. Because StaticResourceServer#saveFilesToServe extracted the filename using only a forward-slash split, crafted staticResource names containing traversal sequences or backslashes escaped the intended static-resource directory. No public exploit or CISA KEV listing is identified at time of analysis, though the fixing commit and advisory are public.
Arbitrary file disclosure in the Gravity Forms WordPress plugin (all versions through 2.10.4) lets unauthenticated attackers read sensitive files from the web server by abusing the 'gform_uploaded_files' parameter against the process_send_resume_link endpoint. Reported by Wordfence, the flaw carries CVSS 7.5 and is exfiltrated by directing the traversal-retrieved file to an attacker-controlled email as a form notification attachment. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file write in Splunk Enterprise (versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, 9.3.14) and Splunk Cloud Platform lets a privileged user with the edit_local_apps and install_apps capabilities abuse the app-installation workflow to write files outside the target app directory into $SPLUNK_HOME/etc/ and its subdirectories. The flaw is a path traversal (CWE-22) that can be leveraged to overwrite Splunk configuration and system files, yielding high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file write in Cornac's dataset-download utility (all versions before 2.6.0) lets an attacker who controls a downloaded TAR archive place files anywhere the Python process can write, because the _extract_archive() helper in cornac/utils/download.py calls archive.extractall() without validating member paths. Since Cornac's built-in dataset loaders automatically fetch and unpack archives, a poisoned or MITM'd dataset archive containing ../ traversal, absolute paths, or symlink/hardlink entries can overwrite sensitive files and potentially achieve code execution. VulnCheck reported the issue; no public exploit identified at time of analysis and it is not in CISA KEV.
Authenticated arbitrary file write in the Grav CMS Form plugin (versions before 9.1.8) allows attackers to plant PHP webshells in the web root by abusing the process.save.filename parameter. The filename is checked for path traversal before Twig rendering but never re-validated afterward, so traversal sequences reconstructed during template evaluation bypass the guard. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the flaw was disclosed by VulnCheck via a coordinated GitHub security advisory.
Arbitrary code execution in PraisonAI (praisonaiagents) before 1.6.78 lets an attacker who can drop a Python file into a plugin directory run their own code. The plugin manager auto-discovers and executes any .py file found in project-level or user-home .praisonai/plugins/ directories at initialization, with no code signing, integrity checks, or sandboxing. VulnCheck reported it under CWE-94; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path-traversal remote code execution in PraisonAI (mervinpraison/praisonai) before 1.6.78 lets an authenticated agent user abuse SkillTools.run_skill_script(), which executes skill scripts without validating that the supplied path stays inside the intended working directory. Because absolute file paths are accepted, a low-privileged attacker can point the skill runner at any executable script on the host and run it. No public exploit code has been identified and it is not in CISA KEV, but the flaw was reported by VulnCheck and a GitHub Security Advisory (GHSA-c44f-37qr-gw3f) confirms the fix.
Path traversal in the `rclone serve restic --private-repos` REST server (versions prior to 1.74.4) allows an authenticated low-privileged user to read, overwrite, or delete another tenant's private restic repository. Authorization is enforced against the routed user path segment, but the backend object key is built from the raw, uncleaned URL path, so a request such as `//..//config` passes the per-user check while resolving to a different user's data on storage backends that clean path components. No public exploit has been identified at time of analysis, but the fix and a regression test are public in the vendor commits, and EPSS risk is modest (0.52%).
Arbitrary file write leading to code execution in jadx 1.5.2 through 1.5.5 allows a malicious .xapk sample to escape the XAPK plugin unpack directory and plant a JAR under plugins/dropins, which the next jadx launch loads and executes via URLClassLoader/ServiceLoader. The flaw stems from XApkLoader calling tmpDir.resolve(fileName) after a flawed CWD-based ZIP name check, giving an analyst opening a crafted file a path traversal that escalates to attacker-controlled plugin code. Publicly available exploit code exists (SSVC exploitation: poc) but it is not in CISA KEV, and EPSS is very low at 0.13% (3rd percentile), consistent with a local, user-interaction-gated, high-complexity issue rather than mass exploitation.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) arises from a path traversal weakness that lets an authenticated attacker with high privileges escape a restricted directory and run code in the context of the current user. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, and CISA's SSVC rates the technical impact as total. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.93%), indicating no evidence of widespread automated exploitation yet.
Path traversal in Adobe ColdFusion allows an authenticated remote attacker (PR:L) to read arbitrary files outside the intended web/application scope by manipulating pathname input, per Adobe advisory APSB26-82. The flaw carries a critical 9.9 CVSS with a changed scope, meaning a successful read can reach files belonging to other security contexts on the host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local File Read in Anyquery's Server Mode lets unauthenticated network attackers exfiltrate arbitrary files (e.g. /etc/passwd, ~/.ssh/id_rsa) readable by the server process. When `anyquery server` is running and reachable, any client speaking the MySQL wire protocol can issue native SQLite CREATE VIRTUAL TABLE statements against built-in reader modules such as csv_reader or log_reader to point at restricted paths, with no authentication or credentials required (CVSS 3.1 base 7.5, C:H/I:N/A:N). A working proof-of-concept is published in the GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing or EPSS score in the provided data.
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from a path traversal weakness triggered when a victim opens a maliciously crafted file, letting an attacker run code in the context of the current user and reach files or directories outside intended restrictions. The flaw carries a CVSS 3.1 base score of 8.6 with a changed scope, reflecting impact beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation risk hinges on social-engineering a user into opening a rogue project file.
Arbitrary file system read in Adobe Experience Manager (AEM as a Cloud Service, 6.5 LTS, and 6.5) lets remote unauthenticated attackers traverse outside the intended directory scope to retrieve sensitive files, per Adobe advisory APSB26-74. The CVSS 3.1 score of 8.6 is elevated by a changed scope (S:C), meaning the read reaches resources beyond the vulnerable component's security authority. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Arbitrary file write in Anyquery Server Mode (versions < 0.4.5) allows unauthenticated remote attackers to write files to any path the process can access by abusing SQLite's native ATTACH DATABASE command exposed over the MySQL-compatible listener. Because the server blindly proxies SQL to the underlying SQLite engine, an attacker can create files such as cron jobs, PHP web shells, or SSH authorized_keys and escalate the file write into remote code execution or denial of service. A working step-by-step proof-of-concept is published in the vendor's GitHub Security Advisory (GHSA-xrcf-6jh3-ggvx); there is no CISA KEV entry and no confirmed in-the-wild exploitation at time of analysis.
Unauthenticated arbitrary file read in FacturaScripts (all versions through v2026.2) lets remote attackers retrieve protected documents by abusing the static file controllers Files.php and Myfiles.php, which authorize requests on the raw URL prefix rather than the resolved filesystem path. A request such as /Plugins/../MyFiles/Private/invoice.pdf passes the prefix allow-list yet resolves to a private file, leaking customer/supplier invoices, attachments, and .sql database backups. A detailed, reproducible exploit is publicly available in the GitHub Security Advisory; there is no vendor-released patch identified at time of analysis and no evidence of active exploitation.
Remote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the network by exploiting a relative path traversal (CWE-23) flaw. Any user holding valid low-privilege credentials to the WAC gateway can leverage the traversal to break out of the intended file path and achieve full compromise (confidentiality, integrity, and availability impact all High). Microsoft has published a patch via MSRC; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in Windows User Interface Core (UI Core) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a relative path traversal flaw lets an already-authenticated low-privileged user escalate to higher privileges on the local machine. The CVSS 3.1 score of 7.8 reflects full confidentiality, integrity, and availability impact once triggered, though attack requires local access and existing low-level privileges. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Windows PowerShell allows an authenticated attacker with low privileges to run arbitrary code across a network by exploiting a relative path traversal (CWE-23) flaw, provided a victim is induced to interact (UI:R). Affecting supported Windows 10/11 clients and Windows Server 2012 through 2025, the issue carries a CVSS 8.0 with full confidentiality, integrity, and availability impact, and a vendor patch is available via MSRC. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in Microsoft's Age of Empires II: Definitive Edition Game is possible via a relative path traversal flaw (CWE-23) that lets a network-based attacker execute arbitrary code once a victim loads attacker-supplied content. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and requires user interaction, meaning a player must open or load a malicious game asset such as a downloaded map, mod, recording, or scenario. Microsoft has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file read/write in Perl's DBD::File before 1.651 lets callers of file-based DBI drivers escape the configured data directory via a symbolic link placed inside it. Because the complete_table_name method resolved the absolute table-file path without validating whether the entry was a symlink, a link within f_dir could point to any path on the filesystem, breaking the directory sandbox for both reads and writes. No public exploit has been identified at time of analysis, and the flaw is not in CISA KEV; a vendor patch (DBI 1.651) is available.