Path Traversal

Path traversal in the Weights & Biases (wandb) Python client before 0.29.0 lets a malicious or compromised W&B backend push crafted file names through the File.download path, writing attacker-controlled files outside the intended download directory. Publicly available exploit code exists, and because arbitrary file writes can target shell startup files or Python import paths, successful abuse can escalate to code execution on the victim host. No CISA KEV listing has been reported, so exploitation appears to be proof-of-concept driven rather than confirmed widespread activity.

Path traversal in Flextype CMS through 1.0.0-alpha.3 allows API token holders to escape the designated entries directory and read, create, or overwrite arbitrary files accessible to the web server process. The Entries REST API accepts unsanitized id and new_id parameters and passes them directly into filesystem operations, permitting traversal sequences such as '../../' to resolve paths outside the intended content tree. No public exploit code has been identified and no CISA KEV listing exists, but the vulnerability is mechanically straightforward for any actor already possessing a valid API token.

Path traversal during in-pod file synchronization in DevSpace through 6.3.21 allows an attacker who controls a container to write arbitrary files on the developer's workstation, enabling code execution. The sync client extracts tar entries streamed from a running pod without sanitizing parent-directory (..) sequences in entry names, so a malicious container can escape the intended sync target directory and overwrite shell RC files, SSH authorized_keys, IDE configuration, or other user-writable paths. No CISA KEV listing exists and no confirmed public exploit code has been identified at time of analysis, though the VulnCheck disclosure and GitHub issue #3290 provide full technical detail.

Local privilege escalation in Apple macOS lets a low-privileged local process obtain root via improper path validation (CWE-22), affecting macOS versions prior to Sequoia 15.8, Tahoe 26.7 and Golden Gate 27. Apple addressed the flaw with improved path validation, and the CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N, total CIA impact) reflects a reliable but non-automatable local escalation requiring an existing code-execution foothold. There is no CISA KEV listing and no public exploit identified at time of analysis; exploitation status is 'none' per CISA SSVC and the issue is not considered automatable.

A path traversal flaw (CWE-22) in Apple macOS is addressed by improved path validation and allows an attacker who controls a network directory server to execute arbitrary code with root privileges on a connecting client. Affected are macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27. Apple has shipped fixes in all three release trains. There is no public exploit code and no CISA KEV listing at time of analysis, and the CVSS 3.1 vector (7.8, AV:L/PR:L) reflects a local vector requiring the attacker to already hold a foothold as a directory service rather than a remote unauthenticated path.

Arbitrary file write in IBM Db2 11.5.x and 12.1.x allows a remote unauthenticated attacker to write files to attacker-controlled paths on the database server due to improper validation of file path inputs. The vulnerability carries CWE-22 (Path Traversal) and was disclosed by IBM with a patch available at their support portal. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the PR:N/AC:L CVSS vector signals low-friction remote reachability.

A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipulate file paths to read, write, or delete arbitrary files on the host. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N), reflecting high confidentiality and integrity impact with no availability impact, so valid credentials are a prerequisite. Publicly available exploit code has been referenced, but CISA KEV does not list this CVE and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - meaning it is a serious post-authentication primitive rather than a broadly observed in-the-wild campaign at time of analysis.

MCP Atlassian, the Model Context Protocol server that bridges AI clients to Confluence and Jira, resolves client-supplied attachment paths on the server itself, so a remote client with write-tool access can read arbitrary files from the server host in versions before 0.22.0. The confluence_upload_attachment, confluence_upload_attachments and jira_update_issue tools all funnel an unconfined file_path into os.path.abspath() plus open(), and the resulting bytes are uploaded to Atlassian as an attachment — giving the attacker a convenient exfiltration channel for server files, environment-held Atlassian credentials, or other tenants' data. The vendor advisory includes a working proof-of-concept (publicly available exploit code exists), but no active exploitation is confirmed (no CISA KEV listing); the CVSS 3.1 score is 7.7 with EPSS not provided in the input. Only local single-user stdio deployments are outside the trust boundary.

Path traversal in PyMuPDF's object-extraction CLI lets a crafted PDF, EPUB, XPS, or FB2 file write arbitrary files outside the user-selected output directory. The extract_objects() font branch joins an attacker-controlled BaseFont name onto the output path without stripping '../' or absolute-path sequences (CWE-22), yielding a CVSS 4.0 base score of 7.1 with high integrity impact but no confidentiality loss. A fix is available upstream in commit b2c8f3a; no public exploit code or CISA KEV activity is known at time of analysis.

Gallery - Private Photo Vault 1.0.41 (Android, by Brain Trust) exposes an unauthenticated HTTP server on TCP port 8080 that is reachable by any device on the same local network, serving full directory listings and file contents from Android external storage - the very media the app is marketed to protect. Any network-adjacent attacker can trivially enumerate and exfiltrate photos, videos, and other files without credentials or user interaction. No public exploit code is required beyond a standard web browser or curl; Fluid Attacks' advisory confirms a proof-of-concept exists, but no CISA KEV listing has been identified at time of analysis.

We need answer only JSON object per user. Need synthesize. Let's parse input. CVE-2026-76440. Description: Cisco Secure Email Gateway and Cisco Secure Email and Web Manager internal security review, hardening releases address multiple internally discovered vulnerabilities. Vulnerabilities tracked by CVE related to path traversal issues grouped under CWE Pillar CWE-23. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-23. Reported cisco. CPE cisco secure email and cisco secure email and web manager. Tags path traversal Cisco etc. SSVC exploitation none, automatable yes, technical impact total. ENISA EUVD. Affected versions long list. References Cisco advisory and NVD. Need produce fields. product_name: "Cisco Secure Email Gateway" maybe specific product? Input references Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Need primary product. Could say "Cisco Secure Email Gateway" or "Cisco Secure Email". Product name 1-3 words. Use "Cisco Secure Email" maybe affected product includes Web Manager. But description says Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. Primary "Cisco Secure Email". Need 1-3 words only; "Cisco Secure Email" 3 words. Good. Summary: original synthesis, not copy. Must mention path traversal, remote unauthenticated? CVSS PR:N. Affected versions. CVSS 9.8. KEV? Input does not include KEV field. So no active exploitation. POC? Not provided. EPSS not provided. We can say no public exploit identified at time of analysis? Need use only phrase if neither KEV/POC: "no public exploit identified at time of analysis." KEV absent, POC absent. Need not invent. Summary start with specific impact verb and product. Start "Path traversal in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager allows unauthenticated remote attackers to..." Mention internal review, multiple vulnerabilities. CWE-23. Attackers can possibly read/write arbitrary files, impacting confidentiality integrity availability (per CVSS). D

Path traversal in the PraisonAI multi-agent framework (pip package `praisonaiagents`) prior to version 1.6.59 lets anyone who can inject text into an agent prompt read arbitrary files as the process user. The `MentionsParser._process_file_mention` handler resolves an `@file:` mention against the workspace, and when that lookup fails it silently falls back to `Path(file_path)` with no traversal, symlink, or workspace-boundary check, exposing credentials, SSH/AWS keys, `.env` files, source code and system configuration. A public proof-of-concept exists (SSVC exploitation status: poc) and the flaw is fully automatable, but there is no evidence of active exploitation (not in CISA KEV, no EPSS data supplied); a vendor patch ships in praisonaiagents 1.6.59.

We need answer JSON object only. Need analyze CVE and produce fields. Need carefully follow. Need use all data. Let's parse. CVE-2026-57145. Product PraisonAI. Description: multi-agent teams. Prior to 4.6.62 multiedit.py passes LLM-controlled filepath directly to open read/write without traversal rejection etc. Prompt-influenced agents read files via edit/diff or overwrite files, exposing secrets persistence tampering. Fixed 4.6.62. CVSS 9.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. CWE-22. Patch available. CPE mervinpraison praisonai. Tags Path Traversal, Praisonai, Mervinpraison. SSVC none, automatable yes, total. ENVD affected <4.6.62. References GHSA, commit, release. Source GHSA summary. But note discrepancy: Package vulnerable <4.6.61 fixed in 4.6.61 in text? It says Package: pip/praisonai — vulnerable: < 4.6.61 — fixed in: 4.6.61, yet CVE says fixed 4.6.62. Need reconcile, mention confidence. Commit diff docker bumps to >=4.6.62, pyproject 1.6.62. So fixed 4.6.62 likely. Maybe source text has typo "vulnerable <4.6.61 fixed in 4.6.61" conflicting. Need not panic; we can mention conflicting fixed version data in confidence notes/data quality? data quality flags shouldn't flag severity/version disagreements. Keep in confidence notes. Also no KEV/POC/EPSS provided? Input lacks EPSS POC KEV. We need infer no public exploit identified? Actually GHSA includes PoC. Wait source code evidence: Summary: PoC with positive trigger. But top-level input doesn't include POC field. It says Multi-source intelligence with Patch, Reported by, CPE, Tags, SSVC, ENVD, refs, source code evidence. No explicit POC field, but GHSA includes PoC, so we can say publicly available exploit code? The Precision rules: If POC=YES but no KEV: "publicly available exploit code exists". Does input POC yes? It contains "## PoC" code. We can say POC exists. Need be careful: "publicly available exploit code exists" perhaps. No KEV, so not active. EPSS absent. Need state EPSS not provided. Need re

Path traversal in PraisonAI before 4.6.59 allows prompt-influenced calls to code agent tools to read and modify arbitrary files outside any intended project boundary when an application exposes CODE_TOOLS, code_read_file, code_search_replace, or code_apply_diff before calling set_workspace(). The global _workspace_root defaults to None, and the lower-level file helpers silently skip path containment checks when workspace is falsy - a fail-open design identical to a previously patched write_file path (GHSA-hvhp-v2gc-268q). A proof-of-concept exists per SSVC data; no confirmed active exploitation in CISA KEV.

Unauthenticated path traversal in PraisonAI's Jobs API (versions prior to 4.6.59) allows any remote caller to read arbitrary files on the server. The `agent_file` field in `POST /api/v1/runs` accepts absolute or directory-traversing filesystem paths with no validation, allowlist, or authentication gate; the executor passes the value directly to `yaml.safe_load(open(agent_file))`. An attacker with network access to port 8005 can exfiltrate credentials, SSH private keys, environment variables, and any file readable by the service account. A working proof-of-concept is publicly available in the GitHub security advisory GHSA-p4pj-vh7h-6cqh.

Apache Storm 3.0.0 through 3.1.0 (excluding 3.1.0) lets a topology submitter control the local destination name of each localized blob via the topology.blobstore.map setting, and the Nimbus/supervisor code builds that destination path without normalization and force-deletes whatever already exists before creating a symlink. Using ../ segments, a submitter can therefore cause recursive deletion of arbitrary supervisor-owned files and plant a symlink that makes a later worker launch execute attacker-chosen code as another tenant's OS user, defeating the isolation that supervisor.run.worker.as.user is meant to enforce. No public exploit code or CISA KEV listing was found at time of analysis, and SSVC records exploitation status as none with automatable set to no; the patch is Apache Storm 3.1.0.

Path traversal leading to remote code execution in LaraDashboard 0.9.2-1.2.2 allows an authenticated user holding only the delegated settings.edit permission to delete arbitrary host-filesystem files or restore a ZIP archive from any on-disk location, writing arbitrary content into application directories and achieving code execution. CoreUpgradeController and BackupService::deleteBackup() concatenate user-supplied filename parameters directly onto the storage/app/core-backups base path without normalization, basename() sanitization, or boundary verification - and the associated form requests validate only string length, not path content. No patched version was available at time of publication; no public exploit has been identified at time of analysis.

Arbitrary file write in Eclipse Embedded CDT 6.0 through 6.7 lets a maliciously crafted CMSIS-Pack archive escape its intended extraction directory and drop files anywhere on the developer's disk. When a user installs or extracts a compromised pack, the plugin's archive handler fails to sanitize entry paths (a classic Zip-Slip-style path traversal), allowing an attacker who controls the pack contents to overwrite or plant arbitrary files. No public exploit is identified at time of analysis, but the SSVC technical impact is rated total and the flaw is automatable.

Arbitrary file rename across the Joomla filesystem is possible in SP Page Builder (Free and Pro) versions 4.0.0 through 6.9.0 due to missing directory confinement in the media rename controller task. Authenticated administrators or users with media management permissions can pair any valid media identifier with an unrelated filesystem path, bypassing the boundary checks that protect other folder operations in the same controller. An attacker exploiting this flaw can rename files outside the intended media directory - including renaming configuration.php - effectively taking the entire Joomla site offline or disrupting its integrity. No public exploit or active exploitation has been identified at time of analysis.

Path traversal via FTP in Contec FX5000, FX4000, and FX3000 series industrial programmable controllers allows an authenticated FTP user to read or modify arbitrary files on the device filesystem. The affected products span a broad range of industrial OT endpoints including Ethernet, serial, and wireless variants. With no public exploit identified and a CVSS 4.0 score of 8.6, the primary risk is to environments where FTP access is exposed to untrusted users or network segments without adequate segmentation.

Path traversal in Contec SGA1000 allows a network attacker with FTP credentials to read and overwrite arbitrary files on the device filesystem. Reported by JPCERT and documented in JVN advisory JVNVU99009004, the flaw affects all known SGA1000 versions and exposes sensitive server-side files - including configuration, credentials, and system data - to unauthorized disclosure and modification via crafted FTP path arguments. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Cross-tenant code execution in Apache Storm Client 3.0.x allows any authenticated cluster user to pre-position a malicious JAR under a predictable blob key and have it loaded into a victim tenant's worker topology. The blob key for `--artifacts` dependency uploads is derived solely from the Maven coordinate, making it identical and guessable for all cluster principals; when the key already exists the client silently reuses the blob without verifying ownership or content integrity. Exploitation results in arbitrary code execution inside the victim's Storm topology, enabling full access to the data and credentials that topology processes. No public exploit has been identified at time of analysis.

Path traversal in rustypaste before 0.18.1 permits unauthenticated remote attackers to write uploaded content to arbitrary filesystem locations by supplying path traversal sequences (e.g., '../../') in the optional custom `filename` HTTP header. The flaw is a validation-ordering error in `src/paste.rs`: the upload destination is validated against the configured upload directory before the attacker-controlled filename header is applied, so the directory-escape check never evaluates the final resolved path. No public exploit has been identified at time of analysis, but the fix commit and GitHub issue make the exact vulnerable code pattern publicly visible, substantially lowering the barrier for reproduction.

Unauthenticated arbitrary file read in the Yogeta WP Cloud WordPress plugin (through version 1.0) allows any remote attacker to download arbitrary files from the server, including sensitive credential files such as wp-config.php, database configuration, and OS-level files like /etc/passwd. The plugin exposes a public endpoint that passes a user-supplied file path directly to a file-read function with no path validation and no authorization check, enabling full server-side file disclosure. Reported by WPScan with no patch available at time of analysis; no public exploit is identified at time of analysis, and EPSS stands at a low 0.16%, though the unauthenticated network-accessible nature makes this easily exploitable when the plugin is active.

Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the repository commits API, which fails to confine paths and does not enforce authentication. All 18.7 releases through 19.3.2 are affected across the fix lines (before 19.1.8, 19.2.6, and 19.3.2). This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, making it an emergency-patch priority for any internet-reachable GitLab instance.

Zip-slip path traversal in an industrial control system application allows authenticated low-privileged users to write arbitrary files to any location accessible by the server process. By crafting a malicious archive with directory-traversal sequences (e.g., '../../') in entry paths and uploading it through the platform's file-upload interface, an attacker can overwrite configuration files or inject fabricated records into stored data. Reported by ICS-CERT under advisory ICSA-26-254-01, this affects operational technology environments where data integrity is safety-critical; no public exploit or KEV listing identified at time of analysis.

Path traversal in SignalWire's libks HTTP request parser exposes consumers to arbitrary file read. The `clean_uri()` function fails to reject oversized URI paths - when the path contains more segments than the internal canonicalization buffer accommodates, embedded `..` sequences survive unfiltered into any downstream code that joins the URI with a filesystem path. Unauthenticated remote attackers can exploit this against any application built on libks prior to 2.0.11. No public exploit code has been identified at time of analysis, but the CVSS 3.1 score of 7.5 (C:H) reflects the potential for full confidentiality loss through arbitrary file traversal.

Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or overwrite files anywhere the Vibe process can reach - without triggering the tool's user-approval gate. The root cause is that shell redirection targets (e.g. '>' and '>>') are stripped from permission evaluation, so an otherwise allowlisted command can silently redirect its output to paths outside the active workspace. Reported by HiddenLayer; publicly detailed in their security advisory, with no public exploit code identified at time of analysis and no CISA KEV listing.

Arbitrary file read in Mistral Vibe (Mistral AI's agentic coding assistant), introduced in version 2.6.0, lets attackers read files outside the active workspace sandbox without triggering user approval. The flaw stems from improper handling of quotation marks during path validation: a quoted absolute path embedded in an allowlisted shell command is treated as permitted, bypassing the workspace restriction that normally confines the agent. No public exploit identified at time of analysis and no EPSS/KEV signal is available, but the HiddenLayer advisory documents the bypass technique.

Arbitrary file deletion in UsersWP ≤ 1.2.70 for WordPress allows authenticated Subscriber-level users to delete any file on the server - including wp-config.php - via a path traversal bypass in the upload_file_remove() AJAX handler. The exploit exploits a two-phase validation failure: validate_file() only rejects literal '../' sequences, but the uwp_get_file_relative_url() helper later performs a global str_replace() that collapses crafted embedded tokens into directory traversal sequences after the final validation gate, with the result passed directly to wp_delete_file() without canonical containment. No public exploit code or CISA KEV listing is confirmed at time of analysis; however, the low privilege requirement and precise Wordfence source-level write-up substantially reduce the research barrier for threat actors.

Path traversal in AcyMailing WordPress plugin (all versions through 11.0.4) exposes arbitrary server files to unauthenticated remote attackers via the unsanitized `user[name]` parameter. Exploitation is gated on the 'Embed images' configuration option being enabled, but when active, an attacker can read sensitive server-side files including WordPress configuration, credentials, and other data without any authentication. Wordfence reported this flaw and a patch commit is available in the WordPress plugin repository. No public exploit or active exploitation has been identified at time of analysis.

Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write files to unintended locations by supplying a crafted archive whose entries escape the intended extraction directory. The path-traversal flaw (CWE-22) occurs during archive extraction and carries a CVSS 9.1 rating driven by a scope change and high integrity impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Cross-tenant path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a low-privileged authenticated attacker to overwrite ruleset files owned by other tenants on the same platform instance. The flaw (CWE-22) exploits insufficient path sanitization in a multi-tenant context, enabling one tenant's user to corrupt another tenant's data integration rule definitions. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory at ibm.com/support/pages/node/7286562.

Path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables any remote authenticated low-privilege user to arbitrarily write to or delete files on the platform's shared storage layer. The flaw (CWE-22) allows user-controlled input to escape intended directory boundaries via sequences such as '../', bypassing storage isolation within the shared Cloud Pak for Data environment. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.

Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read sensitive files outside the intended directory scope, potentially exposing credentials, configuration data, or other platform secrets. The CVSS vector assigns C:H/I:H/A:H, though IBM's own description limits the stated impact to information disclosure - an inconsistency worth verifying with the vendor advisory. No public exploit code or active exploitation has been identified at time of analysis.

Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-level privileges to traverse the file system beyond intended boundaries and read sensitive information from the underlying host or container. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation requiring only a valid low-privilege account with no user interaction. IBM has released a patch via their support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.

Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.

Path traversal in IBM Langflow OSS (versions 1.0.0 through 1.10.3) enables a remote authenticated attacker to escape restricted directory boundaries and execute arbitrary code on the server. The flaw (CWE-22) is present in IBM's enterprise packaging of the Langflow AI workflow platform and is network-exploitable with low-privilege credentials, yielding full C:H/I:H/A:H impact per CVSS 8.8. A vendor patch is available via IBM's security advisory; no public exploit code has been identified at time of analysis.

Arbitrary file write as root in Plesk's Backup Manager lets an authenticated customer escalate to full server compromise through a path traversal (CWE-36) in the handling of an unsigned backup header. Any low-privileged Plesk customer account can write files to attacker-chosen locations with root privileges, and because Plesk is a widely deployed hosting control panel, the flaw exposes shared and reseller hosting environments to tenant-to-root escalation. No public exploit identified at time of analysis, though the vendor support advisory documents the root cause (unsigned/unvalidated backup header enabling traversal).

Path traversal in knowns through version 0.33.0 allows authenticated AI agent sessions to read arbitrary files anywhere on the host filesystem by supplying absolute paths or relative traversal sequences to the `code.find` MCP tool's path argument. The vulnerability exists because the handler in `internal/mcp/handlers/code.go` performs no canonicalization or boundary enforcement before passing the caller-supplied path to the underlying OS, bypassing the intended project-root confinement entirely. No public exploit code or CISA KEV listing exists at time of analysis, though the exploit primitive is trivially simple given the CWE-22 root cause.

Path traversal in the knowns code generation template engine (versions through 0.33.0) allows unauthenticated remote attackers to read and write arbitrary files outside the project root when a victim developer processes a malicious template. The flaw in template_engine.go (lines 318-344 and 625-636) permits directory-traversal sequences in template destination paths, enabling attackers to overwrite shell initialization files (e.g., ~/.bashrc, ~/.profile) for persistent code execution or exfiltrate credential files from the developer's host. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the full read/write impact on a developer workstation represents significant supply-chain risk.

Unauthenticated arbitrary file deletion in the Advanced Product Fields Extended for WooCommerce WordPress plugin (versions <= 3.1.6) allows remote attackers to delete any file accessible to the web server process via a path traversal flaw. The scope-changed CVSS vector (S:C) reflects that an attacker can reach beyond the plugin's own file space - targeting WordPress core files such as wp-config.php, .htaccess, or even server-level configuration - resulting in complete site takedown or broader server disruption. Patchstack reported this vulnerability; no public exploit code or CISA KEV listing has been identified at time of analysis.

Path traversal in ICEcoder through version 8.1 enables authenticated low-privilege users to move arbitrary files from outside the web document root into web-accessible directories by injecting traversal sequences into the `oldFileName` parameter of rename and move operations. The flaw, located in `lib/file-control.php` around line 198, allows an attacker to expose sensitive server-side file contents via direct HTTP retrieval while simultaneously deleting the original - combining information disclosure with destructive write impact. No public exploit code or active exploitation has been confirmed at time of analysis, though the referenced Caycon advisory includes precise source code pointers that make reproduction straightforward.

Path traversal in ICEcoder through version 8.1 allows authenticated low-privilege attackers to read, write, or delete arbitrary files on the host filesystem by submitting traversal sequences or absolute paths to the file-control endpoint. The root cause is a PHP logic error in File::check() where the document-root confinement check compares the return value of realpath() against boolean true - a comparison that can never evaluate to true in PHP, since realpath() returns a string or false - rendering the entire path-restriction mechanism permanently inoperative. A detailed public advisory identifying the exact vulnerable code line is available via VulnCheck and GitHub; no patch version has been confirmed at time of analysis.

Unauthenticated path traversal in GisLab Laboratory Management System (versions 1.4.03 through before 1.5) allows remote attackers to read arbitrary files from the server filesystem via crafted HTTP requests. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction, and no elevated privileges are required, with high confidentiality impact. The vulnerability was disclosed by TR-CERT under advisory TR-26-1063; no public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated arbitrary file read in the Direct Download for WooCommerce WordPress plugin (all versions ≤1.19) allows any remote attacker to retrieve the contents of any file accessible to the web server process — including wp-config.php, database credentials, and server-side secrets. The root flaw is a fatally incomplete authorization check in the plugin's top-level include handler (direct-download.php): it confirms only that some free, virtual, downloadable product exists anywhere on the site, without validating that the requested file path is one of that product's configured download assets. No public exploit has been identified at time of analysis, but the exploitation logic is straightforward and the prerequisite is met by the majority of WooCommerce stores offering free resources.

Unauthenticated path traversal in Docmost v0.21.0's avatar attachment endpoint allows remote attackers to read arbitrary local files from the server by embedding directory traversal sequences in a POST request to a publicly accessible URL. The flaw exists in the attachment controller (attachment.controller.ts:345) and requires no authentication, making every internet-exposed Docmost v0.21.0 instance vulnerable to local file disclosure. A public advisory with technical details is available from Artresilia; SSVC classifies exploitation as automatable, further elevating practical risk despite a low EPSS of 0.15%.

Path traversal in @openhop/server (npm, versions ≤0.3.5) allows unauthenticated remote attackers to read or permanently delete arbitrary `.yaml` files accessible to the OpenHop process outside its configured flow data directory. The root cause is that `FlowStore.filePath()` passes caller-supplied HTTP route parameters directly to Node.js `path.join()` without any sanitization or allowlist validation, and Fastify's underlying `find-my-way` router URL-decodes the parameter before it reaches application code, enabling `..%2F`-encoded directory traversal. A fully functional PoC is publicly available with Docker-based reproduction steps; no KEV listing at time of analysis. Docker deployments expose the server on all interfaces by default, enabling direct network exploitation without user interaction.

Path traversal in the Pandora malware-analysis platform (pandora-analysis, versions ≤1.12.7) lets an attacker who submits a crafted archive or disk image write extracted files outside the intended extraction directory. Because the extractor worker (ISO, BZ2, CAB, GZ, LZMA handlers) wrote decompressed content to attacker-influenced paths without confirming the destination stayed inside the target directory, a malicious sample can overwrite files accessible to the worker process, enabling file tampering, denial of service, and potential further compromise. No public exploit identified at time of analysis; the fix is present in the referenced upstream commit.

Arbitrary file upload with path traversal in LZ-litchi 1.0.0 lets remote unauthenticated attackers write attacker-controlled files to locations outside the intended storage directory by manipulating the 'directory' parameter of POST /app-api/infra/file/upload. Because uploaded content and destination path are both attacker-controlled, an attacker can plant a web-executable payload and achieve code execution on the host. No public exploit is confirmed beyond the referenced GitHub issue writeup, and EPSS remains low (0.18%) despite the maximal CVSS of 9.8.

Path traversal in Fortra GoAnywhere MFT versions prior to 7.10.2 allows authenticated Web Users to escape their sandboxed home directory and read arbitrary files from the server filesystem. Exploitation requires a Web User account provisioned with both Secure Folders and Secure Mail permissions - a role combination common in production deployments of this enterprise MFT platform. The CVSS scope-changed vector (S:C, C:H) correctly reflects that successful traversal breaks the intended sandbox boundary, exposing files outside the attacker's authorized directory tree. No public exploit code or CISA KEV listing is identified at time of analysis.

Local file inclusion in MaxSite CMS through 109.6 allows unauthenticated remote attackers to execute privileged PHP handler files by supplying base64-encoded path traversal sequences to the ajax and require-maxsite dispatcher endpoints. The encoding technique bypasses the dispatchers' path validation logic, enabling attackers to reach admin-gated handler actions entirely without credentials. A public proof-of-concept exploit was published on 2026-09-08; the vulnerability spans essentially the entire version history of the product (0.78 through 109.6), and no patched release has been confirmed at time of analysis.

Path traversal in the knowns npm documentation tool (versions ≤ 0.29.1) enables remote unauthenticated attackers to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem, and to create arbitrary directories via os.MkdirAll. The Document API's sanitization function cleanDocPath() strips slashes and .md suffixes but leaves ../ sequences intact, allowing filepath.Join() to resolve paths outside the intended documents directory. In the default deployment - where the Management API binds to all interfaces without authentication - this is directly exploitable with a single crafted HTTP request, and the arbitrary-write primitive may be chained toward code execution. No confirmed active exploitation or public exploit code identified at time of analysis.

Unauthenticated remote directory deletion in Chainlit through 2.12.0 allows any network-accessible attacker to recursively destroy arbitrary filesystem directories reachable by the service process. The flaw resides in the socket.io session handler, which accepts a client-supplied sessionId without path sanitization and uses it directly in file system operations - permitting absolute and relative path traversal sequences to escape the intended upload directory. With a CVSS 4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N), exploitation requires no authentication or user interaction; no public exploit or CISA KEV listing has been identified at time of analysis.

Path traversal in Dell Secure Connect Gateway (SCG) 5.0 exposes restricted filesystem paths to unauthenticated remote attackers across both Appliance and Application deployment variants. The vulnerability (CWE-22) allows directory escape via crafted request paths, resulting in unauthorized access to files outside the intended serving root. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the unauthenticated network-accessible attack surface and low complexity make this a credible priority for enterprise Dell infrastructure operators.

Path traversal in SiYuan's flashcard deck management API allows an authenticated administrator to delete arbitrary `.deck` and `.cards` files anywhere on the host filesystem. The `/api/riff/removeRiffDeck` endpoint accepts a `deckID` parameter without sanitizing traversal sequences, so a malicious or compromised admin account can reference files outside the designated workspace directory. The CVSS 4.0 score of 8.4 (PR:H) reflects that exploitation requires administrative credentials, but the subsequent-system integrity and availability impacts (SI:H/SA:H) confirm that damage extends beyond the SiYuan workspace itself. No public exploit code or active exploitation has been identified at time of analysis.

Path traversal in Samsung's ImsService (IP Multimedia Subsystem Service) on Android 14 through 17 permits remote unauthenticated attackers to create image files at arbitrary filesystem paths under system server privilege. Reported by Samsung Mobile and patched in SMR Sep-2026 Release 1, the flaw is reachable over LTE and Wi-Fi networks with no user interaction required, as reflected in the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scoring 8.8. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.

Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's intended directory scope, resulting in high confidentiality impact and scope change to the broader host system. The CVSS vector (S:C, C:H) indicates the traversal can reach resources beyond the Comply component itself, potentially exposing sensitive configuration, credentials, or endpoint compliance data accessible to the Tanium platform. No public exploit code or CISA KEV listing has been identified at time of analysis.

Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write against the underlying host. The CVSS vector (AV:N/AC:L/PR:L/S:C/I:H) confirms the vulnerability is network-reachable without administrative credentials and breaks containment boundaries beyond the Comply module itself. Tanium addressed the issue under advisory TAN-2026-043; no public exploit code or CISA KEV listing is currently identified.

Arbitrary file write as root in OPNsense's NTP configuration module (opnsense/core before 26.1.9 and BE/opnsense/core before 26.4_20) lets an administrator-level attacker escape the intended directory via a crafted GPS or PPS serial-port parameter and overwrite any file on the FreeBSD-based firewall. Because writes occur as root, this path traversal is a strong primitive for full device compromise. Fixes are released; there is no public exploit identified at time of analysis.

Path traversal (CWE-22) in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source enables an authenticated high-privilege attacker to escape intended directory restrictions, achieving high integrity impact on files outside the application boundary - with scope change indicating the affected filesystem resources extend beyond the application itself. Affected version lines span Adobe Commerce through 2.4.9-2026-aug, Commerce B2B through 1.5.3-2026-aug, and Magento Open Source through 2.4.9-2026-aug, all addressed in Adobe's August 2026 security release APSB26-138. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Path traversal in Visual Studio Code versions prior to 1.136.2 enables a remote unauthenticated attacker - contingent on user interaction - to escape the editor's restricted directory boundary and read sensitive files from the host system, effectively bypassing a security feature such as workspace trust or sandbox isolation. The vulnerability carries a CVSS 7.4 with Scope:Changed and C:H, reflecting that the impact crosses from VS Code's own context into broader host file system access. No public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in Microsoft Power Automate for Desktop and Power Automate agent for virtual desktops (all versions before 2.71.115.26224) is achievable via a relative path traversal flaw (CWE-23). An authenticated local user with low privileges can exploit improperly sanitized file path construction within Power Automate's RPA engine or agent service - which operates at elevated privilege - to write to or execute from an unintended directory, achieving full local privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; vendor patch is available at version 2.71.115.26224.

Path traversal in Windows PowerShell enables a low-privileged, network-authenticated attacker to escalate privileges to higher access levels across a broad range of Windows desktop and server versions. The flaw (CWE-22) allows improper resolution of file paths outside a restricted directory boundary within the PowerShell subsystem, reachable over the network with user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches addressing all affected builds.

Local privilege escalation in Windows Error Reporting (WER) across virtually every supported Windows platform exploits an absolute path traversal flaw (CWE-36) to elevate a standard authenticated user to full system control. An attacker with a low-privilege local session can supply a crafted absolute path to the WER subsystem, escaping its intended directory and accessing or overwriting privileged system resources, achieving complete confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L). No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the extremely wide affected product surface spanning Windows 10 through Windows 11 and Server 2012 through Server 2025 makes this a high-urgency patching item.

Path traversal in the Windows Compressed Folder built-in ZIP handler allows a locally authenticated standard user to escalate privileges to SYSTEM or Administrator level across a wide range of Windows client and server editions. The vulnerability (CWE-22) exists in the component that processes ZIP archive extraction, enabling crafted archive entries to write files outside the intended extraction directory into sensitive system paths. No public exploit or KEV listing exists at time of analysis, but the low attack complexity and broad version coverage across Windows 10, 11, and Server 2012 through 2025 make this a high-priority patching target in environments where local privilege escalation is a concern.

Privilege escalation via absolute path traversal in the Windows Search Component affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2022/2025, allowing a locally authenticated standard user to achieve full system compromise. The flaw (CWE-36) lets an attacker supply a crafted absolute path that the Search Component processes without adequate sanitization, enabling reads or writes to privileged file system locations outside the intended scope. Microsoft has released cumulative update patches for all affected versions; no public exploit code or active exploitation has been identified at time of analysis.

Path traversal in Apache FreeMarker's template loading (versions 2.2.0 through 2.3.34) lets remote attackers who can influence the locale identifier passed to FreeMarker read templates outside the intended path when the default-enabled localized lookup feature is active. The actual reach is bounded by the configured TemplateLoader - FileTemplateLoader still blocks escape from its baseDir, while classloader- or servlet-context-backed loaders are limited to resources those mechanisms can reach. EPSS is low (0.21%, 11th percentile), no public exploit is identified at time of analysis, and it is not in CISA KEV.

Path traversal in XenForo's style archive importer on Windows deployments allows authenticated non-super administrators holding style-import permissions to write arbitrary files outside the intended extraction directory. By crafting a ZIP archive with backslash-delimited member names, an attacker bypasses the forward-slash-only traversal validation enforced on Linux/macOS, writing arbitrary bytes to any path writable by the web-server account - including the public web root - resulting in persistent server-side code execution. The flaw is fixed in XenForo 2.3.13; no public exploit or CISA KEV listing has been identified at time of analysis.

Path traversal in Commvault CommServe allows unauthenticated remote attackers with sufficient complexity to read sensitive files outside intended directory boundaries, resulting in high-impact information disclosure. Affected versions span four active release trains of Commvault Cloud (11.36, 11.40, 11.44, 11.46), making this relevant across a broad enterprise backup customer base. No public exploit or active exploitation has been identified at time of analysis; vendor has released patched maintenance releases.

Path traversal in Commvault Cloud's DataCube component allows a locally authenticated low-privileged attacker to bypass security feature enforcement, resulting in high-impact compromise of confidentiality, integrity, and availability on the affected system. The Content Extractor and Index Store sub-components are specifically identified as requiring remediation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was self-reported by Commvault with a fix available in a maintenance release.

Arbitrary file read in Siemens SIMOVE Fleetmanager (V3.1 before V3.1.13, V3.2 before V3.2.4, V3.3 before V3.3.2, V4.0 before V4.0.1) and SIPLANT (V1.7, V2.2, V3.0 all versions; V3.1 before V3.1.4) allows a remote unauthenticated attacker to traverse directories through the embedded HTTP server's file-serving endpoint and retrieve any file from the host operating system. Because no credentials are required and the payload targets the file path directly, an attacker can harvest credential stores, private keys, and configuration secrets that enable follow-on compromise. This maps to CWE-23 (relative path traversal); there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Path traversal in knowns before v0.30.0 permits unauthenticated remote attackers to write files outside the designated imports directory by embedding directory traversal sequences in the import name parameter of the import routes API. Any file writable by the server process can be overwritten, making this a potential remote code execution primitive if configuration files, scripts, or other executable content reside within the process's write reach. No public exploit has been identified at time of analysis, but the patch commit and security advisory are publicly accessible on GitHub, lowering the barrier to reproduction.

Path traversal in the knowns MCP server's handleCodeReplace() function allows unauthenticated network attackers to overwrite arbitrary files outside the project root, including shell startup scripts (~/.bashrc, ~/.zshrc) and SSH configuration files (~/.ssh/authorized_keys). All knowns releases before v0.30.0 are affected; the root cause is the absence of path sanitization - the original code unconditionally joined caller-supplied paths onto the project root without verifying the resolved path remained within that boundary. No active exploitation confirmed in CISA KEV; no public exploit identified at time of analysis, though the GitHub security advisory and VulnCheck report provide sufficient technical detail for exploit construction.

Path traversal in the knowns template-preview API (versions before 0.30.0) allows unauthenticated remote attackers to read arbitrary server-side files by injecting directory traversal sequences into the `templateFile` parameter of `POST /api/templates/preview`, with file contents returned directly in the JSON response. Sensitive targets include credential files, database configuration, and API keys accessible to the knowns process user. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept exploit is identified in available data, though the attack class is trivially executable with any HTTP client against an exposed instance.

Path traversal in knowns (a Go-based MCP-integrated knowledge management server) before version 0.30.0 allows authenticated remote attackers to read, create, overwrite, and delete arbitrary Markdown files accessible to the server process by supplying directory traversal sequences in MCP tool arguments. The flaw is rooted in the absence of any path containment validation in the storage layer (doc_store.go and memory_store.go), meaning MCP-issued file paths were passed directly to filesystem operations without sanitization. No public exploit is identified at time of analysis, though the fix commit, patch diff, and security advisory are all publicly available.

Unauthenticated path traversal in Next4Biz CSM (Customer Service Management) versions 6.8.9 through 07092026 allows remote attackers to read arbitrary files from the server filesystem with no credentials required. The flaw is classified under CWE-22 and carries a CVSS 3.1 score of 7.5 with a network-accessible, zero-interaction vector, meaning any internet-reachable deployment is potentially exposed to full confidentiality compromise. Disclosed by TR-CERT (Turkish national CERT), the vendor did not respond to the disclosure, and no patch has been confirmed as available at time of analysis.

Relative path traversal in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to traverse directory boundaries and achieve remote code execution on affected systems. Both the Appliance variant (versions prior to 5.36.00.16) and the Application variant (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis, and Dell has issued a patch under advisory DSA-2026-382.

Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to escape the intended directory and execute arbitrary code by supplying crafted path input. Both the Appliance (versions before 5.36.00.16) and the Application (versions before 5.36.00.00) deployments of SCG 5.0 Virtual Edition are affected. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; EPSS is a modest 0.43% (36th percentile), but the network-reachable, unauthenticated path-traversal-to-RCE profile warrants prompt patching.

Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to exploit a path-traversal flaw and execute code on the appliance. Both the Appliance edition (before 5.36.00.16) and the Application edition (before 5.36.00.00) of the SCG 5.0 virtual-edition telemetry/remote-support gateway are affected. There is no public exploit identified at time of analysis; EPSS estimates a modest 0.35% (28th percentile) exploitation probability and CISA's SSVC framework lists exploitation status as none.

Relative path traversal in Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) exposes unauthenticated remote attackers to a full-compromise pathway culminating in remote code execution. Both hardware appliance deployments (prior to 5.36.00.16) and software/virtual application deployments (prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis; EPSS exploitation probability stands at 0.53%, and SSVC classifies exploitation status as none.

Path traversal in Jupyter nbviewer through version 1.0.1 allows unauthenticated remote attackers to read files from sibling directories outside the configured local file root by exploiting a string-prefix comparison flaw in LocalFileHandler.can_show(). The access control check uses Python's startswith() without anchoring on a path separator, so a configured root such as /data/notebooks inadvertently permits access to adjacent directories like /data/notebooks_backup or /data/notebooks-private. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a patch commit is available upstream and the flaw is trivial to exploit manually.

Path traversal in h3's serveStatic() function on Node.js allows unauthenticated remote attackers to read arbitrary files outside the configured static root directory. The root cause is that h3 uses srvx's FastURL class, which skips WHATWG URL normalization for performance - percent-encoded dot segments (%2e%2e) survive raw into decodeURI(), are decoded to ../, and are passed unsanitized to filesystem callbacks. A detailed proof-of-concept exploit chain is publicly documented in GHSA-wr4h-v87w-p3r7; no active exploitation confirmed in CISA KEV at time of analysis. Fixed in versions 1.15.6 and 2.0.1-rc.15.

Path traversal in h3's serveStatic utility (versions before 1.15.9) enables unauthenticated remote attackers to read arbitrary files from URL-based storage backends (S3, CDN, object storage) by exploiting a double-decoding flaw that bypasses dot-segment normalization. A request crafted with double-encoded dot sequences (%252e%252e) survives the resolveDotSegments() guard - which only matches literal '.' characters - and is then interpreted as '..' by RFC 3986-compliant URL backends. No public exploit code or active exploitation has been confirmed, though the GHSA advisory provides source-level analysis sufficient to guide exploit development.

Unauthenticated arbitrary file write in WWBN AVideo's notify.ffmpeg.json.php endpoint lets remote attackers plant files anywhere under the application root by supplying an attacker-chosen path in the avideoRelativePath parameter. Authentication is trivially defeated because the notifyCode token is any previously issued ciphertext replayed back - the server decrypts it but never validates it - enabling a straight path from unauthenticated request to writing a PHP webshell and remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory describes the technique in enough detail to reproduce.

Arbitrary file write via Zip Slip in SonicWall Network Security Manager (NSM) On-Prem (versions 4.3.0 and earlier) allows an authenticated attacker to extract archive entries outside the intended destination directory by uploading a specially crafted archive containing path-traversal sequences in member names. Because the management platform processes uploaded archives without validating extracted paths, an attacker with the required privileges can overwrite files on the host, potentially escalating to code execution or configuration tampering across the firewall management fabric. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Authenticated remote file deletion in IBM Langflow OSS 1.0.0 through 1.11.2 allows any logged-in user to delete arbitrary files or directories on the underlying server via path traversal sequences in a pathname parameter. With PR:L and no UI required, the bar for exploitation is simply a valid account, making this a significant risk in multi-tenant or shared AI workflow deployments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the CVSS 8.1 rating and high integrity/availability impact reflect the destructive potential.

Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.11.2 allows any logged-in user to read arbitrary files from the server filesystem - including JWT signing keys, the application secret_key, the runtime database, /proc/self/environ, and other tenants' uploaded files - by supplying absolute paths or traversal sequences in the files parameter of a build request. What elevates the risk beyond a standard directory traversal is the exfiltration mechanism: file contents are embedded directly into the LLM prompt and transmitted to the configured model endpoint, meaning secrets leave the controlled environment and reach third-party AI provider infrastructure. This attack path bypasses the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment flag, which enforces restrictions on other file-reading components but was never applied to the Chat Input to Message attachment pipeline. No public exploit code has been identified at time of analysis.

Path traversal in Plandex 2.2.1's ApplyFiles function allows an attacker who can influence the AI model's output - through poisoned repository files or attacker-controlled context - to write files to arbitrary locations outside the intended project directory. Targets such as shell initialization files (~/.bashrc, ~/.zshrc) and cron entries can be silently overwritten, resulting in persistent code execution under the developer's local account. No CISA KEV entry or confirmed public exploit exists at time of analysis, but the attack surface (indirect prompt injection combined with insecure file-write) is increasingly well-understood in the AI tooling threat landscape.

Unauthenticated path traversal in AgentScope through 2.0.7.post1 allows remote attackers to copy arbitrary server-side directories into the agent workspace via the unvalidated skill_path parameter in LocalWorkspace.add_skill, exposing sensitive server files through the workspace skill listing API. The affected function performs no confinement of the source path, enabling directory traversal to any filesystem location readable by the server process. No patch has been confirmed at time of analysis; CVSS 4.0 rates this 8.7 with no privileges or user interaction required.