Path Traversal

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

WinRAR before 5.61 contains a path traversal vulnerability in the ACE archive format handler (UNACEV2.dll) that allows extraction of files to arbitrary locations, enabling persistent malware installation through Startup folder placement.

An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory". Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.4%.

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 70.3%.

ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 60.2%.

On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 90.6%.

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.1%.

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 70.9%.

Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 82.7%.

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.5%.

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.0%.

The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 79.2%.

Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.1%.

Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 80.9%.

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 53.1%.

Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files via a .. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.3%.

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.6%.

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.7%.

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.8%.

Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitrary files via a .. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.7%.

IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 21.0%.

Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoPass license server is enabled, allows remote attackers to create arbitrary. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 84.1%.

Directory traversal vulnerability in the Google Doc Embedder plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.4%.

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 45.4%.

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 65.8%.

Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 37.6%.

Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 92.4%.

Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.5%.

Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.7%.

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 72.1%.

The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 72.9%.

Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management (ZMM) 2.6.1 and 2.7.0 allows remote attackers to include and execute arbitrary local files via the language parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.6%.

Directory traversal vulnerability in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors involving a crafted pathname. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 70.4%.

Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 130 /FSF/CMD request with a .. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 73.9%.

Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 35.4%.

Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.4%.

Path traversal in Cacti's RRDtool theme handling (lib/rrd.php) lets an attacker manipulate the 'graph_theme' value to escape the themes directory and force inclusion of an attacker-influenced 'rrdtheme.php' from an arbitrary path, fixed in Cacti 1.2.31 (Alpine package 1.2.31-0). Because the traversed path is appended to base_path and ultimately included by PHP, successful exploitation can lead to local file inclusion and potential code execution. No public exploit identified at time of analysis and the issue is not on CISA KEV; an upstream source-code fix (basename() sanitization) is publicly available.

Grafana, as packaged in Alpine Linux, contains a vulnerability fixed in package version 12.4.4-r0. The upstream Grafana version addressed is 12.4.4. The nature of the vulnerability - its impact class, affected functionality, and attacker capability - cannot be characterized from the available data, which consists solely of an Alpine Linux vendor advisory reference with no description, CVSS vector, CWE classification, or upstream advisory. No exploitation status has been established.

Path traversal in MariaDB Server (CVE-2026-44171) allows a local attacker to escape intended directory boundaries via user-interaction-driven file handling, with full confidentiality, integrity, and availability impact (CVSS 7.8). Multiple stable branches are affected, with fixes shipped in 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2; Alpine Linux has packaged the fix as mariadb 11.8.7-r0. There is no public exploit identified at time of analysis and EPSS is 0.01% (2nd percentile), indicating minimal observed exploitation interest so far.

Authenticated administrators of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) can delete arbitrary files and directories on the underlying operating system by sending a crafted request to the file management function of the web-based management interface. The flaw is a directory traversal (CWE-22) issue in which traversal sequences in a user-supplied file path are not properly validated before the request is processed; exploitation is network-reachable and low-complexity but strictly requires valid administrative credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), which is the primary limiting factor and rules out unauthenticated abuse. Cisco rates this CVSS 4.9 and our independent assessment tracks that as a genuinely lower-priority issue for most environments; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).

Authenticated attackers holding administrative-level privileges on the Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) web-based management interface can write files to arbitrary locations on the underlying system by uploading a crafted file whose supplied path contains directory-traversal sequences, tracked as CVE-2026-76432. The flaw is rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N per the vendor and our independent assessment), so the impact is limited to integrity and the practical barrier is the requirement for a valid admin session - attackers must already hold or hijack an administrative account. Affected releases span ISE and ISE-PIC 3.1 through 3.5; no public exploit code or confirmed active exploitation was identified at time of analysis.

Authenticated path traversal in the certificate import function of the Cisco ISE and Cisco ISE-PIC web-based management interface lets a remote attacker who already holds valid administrative credentials read arbitrary files from the appliance, exposing configuration data and other sensitive content. Exploitation requires high-privileged access (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base score 4.9), which meaningfully constrains the threat: the attacker must first compromise or be granted an administrative account, so this is best treated as a post-compromise information-disclosure and privilege-escalation enabler rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). This is a moderate, not urgent, priority, with the practical exposure concentrated on installations where the management interface is reachable from broader networks and admin credentials are loosely governed.

Unauthenticated path traversal in the Cisco ISE and ISE-PIC client provisioning download service allows a remote attacker to read protected files on the appliance by sending a crafted provisioning resource request containing directory traversal sequences. The flaw affects Cisco Identity Services Engine software across the 3.1 through 3.5 release families (and the corresponding ISE Passive Identity Connector 3.1.0, 3.2.0, 3.3.0, 3.4.0 and 3.5.0 builds) and needs only network reachability to the provisioning/onboarding endpoint, with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, but the low attack complexity and unauthenticated reach make prompt patching advisable, especially where the ISE guest/BYOD portal is published beyond the internal onboarding network. Overall this is a genuine but modest-severity issue whose impact is limited to information disclosure.

Path traversal in junrar (the open source Java RAR archive library) prior to version 7.6.1 lets an attacker-supplied RAR archive cause LocalFolderExtractor to create directories outside the intended extraction root. The flaw exists because createFile() validates only the final canonical file path while makeFile() creates intermediate path segments with unchecked mkdir() calls, so a crafted entry whose final path resolves inside the destination can still spawn directories elsewhere - a specificity that is why the assessed vector carries AC:H. Impact is confined to directory creation and file-versus-directory squatting that can make later security-sensitive writes fail; there is no arbitrary file-content write and no confidentiality loss, unauthenticated remote attackers are the relevant threat model only when a host application extracts untrusted archives through this specific extractor, and no public exploit code has been identified at time of analysis. This is a genuinely low-priority issue, and the vendor's CVSS of 3.7 reflects that honestly rather than inflating it.

Path traversal in the Redocly CLI `split` command (@redocly/cli prior to 2.33.2, and the 1.x line prior to 1.34.17) lets a crafted OpenAPI or AsyncAPI document place or overwrite YAML/JSON files outside the directory supplied to `--outDir`. The command derives output filenames from untrusted component names, path keys, and `x-codeSamples` lang values without confirming the resolved target stays inside the chosen directory, so literal `../` segments in those fields escape the output tree. Impact is deliberately bounded - content is limited to YAML/JSON and code-sample filenames stay based on the HTTP method - yielding an integrity-only file write rated CVSS 4.4 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L), with unauthenticated (PR:N) exploitation that nonetheless requires a victim to run `split` on the malicious spec; no public exploit identified at time of analysis.

Path traversal in the Jenkins Pipeline: Groovy Libraries Plugin (805.va_fc79344957d and earlier) lets an authenticated user who can configure Pipelines point the `library` step at a path outside the SCM checkout and follow symbolic links, giving read access to files in a resources directory and the ability to delete files in a test directory on the Jenkins controller file system. Exploitation requires the Pipeline-configuration privilege, a symlink placed inside the checkout, and successful traversal during library retrieval, which is reflected in the high attack complexity of the assessed CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base score 4.2). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so the practical risk is low-to-moderate and confined to file read and limited file deletion rather than arbitrary write or code execution.

Path traversal in http4s static-content services (ResourceService and WebjarService) before 0.23.35 and 1.0.0-M47 lets remote unauthenticated attackers read classpath or WebJar resources outside the configured base directory by hiding parent-directory sequences behind percent-encoded separators (%2F or %5C). The flaw only bites when the service is mounted on a directory-backed classpath and the underlying backend preserves the encoded separator through to path resolution, which is why NVD scores the attack complexity as High; impact is limited to information disclosure (confidentiality only), with no write or availability effect. No EPSS score, CISA KEV listing, or public exploit code was provided with this report, so active exploitation is unconfirmed at time of analysis, although the public upstream patch commit and its regression tests effectively document a working trigger.

The MCPVault npm package (a lightweight Model Context Protocol server that gives AI agents access to an Obsidian vault) anchored its restricted-directory deny-list to the vault root in versions before 0.11.5, so nested .git, .obsidian and node_modules directories silently pass both isAllowed() and isAllowedForListing(). An attacker who influences which path an AI agent reads — typically through prompt injection in content the agent ingests — can cause nested .git/config files (remote URLs, embedded tokens) or nested Obsidian metadata to be read, and can pollute the listAllTags index with nested node_modules content. No public exploit code or CISA KEV entry was identified at the time of analysis; the vendor shipped the fix in 0.11.5.

Symlink-based path traversal in the buildah/copier Go package allows a crafted tar archive to create files outside the intended extraction directory when the library is used outside of Buildah by a non-root caller. Buildah's own extraction path applies chroot hardening and is explicitly not affected, so real exposure sits with downstream consumers of the package - including Red Hat Ansible Automation Platform 2 and Red Hat Enterprise Linux 10 in the published CPE data, plus other tagged Red Hat products - that unpack untrusted archives with it. Impact is integrity-only (no confidentiality or availability component in the assessed vector), the victim application must actually process the malicious archive (UI:R), EPSS is low at 0.25% (16th percentile), CISA's SSVC records exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis.

Archive extraction on Apple platforms fails to properly validate path components, letting a maliciously crafted archive write files outside the intended destination directory. Affected systems include iOS and iPadOS before 26.7 (and before 27), macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27, with the flaw rated CVSS 5.5 (integrity-only, local vector with required user interaction). Apple has released patched versions for every affected platform; there is no CISA KEV listing and no public exploit code identified, and EPSS is only 0.18% (7th percentile), indicating low predicted exploitation activity.

A path validation weakness in Apple's iOS, iPadOS, and macOS allows a malicious application to reach files outside its intended sandbox and read user-sensitive data. Apple addressed the flaw with improved path validation in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8, so all older releases remain exposed until updated. Exploitation requires a locally installed app and some user interaction (CVSS AV:L/UI:R), exploit probability is currently very low (EPSS 0.20%, 10th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis.

Local directory-path traversal in Apple macOS allows an app already running on the host to reach and read sensitive user data outside the directory it is permitted to access. The root cause is insufficient validation of directory paths (CWE-22), and Apple has remediated it in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires the attacker to already have code running as a low-privileged local application (AV:L, PR:L) with no user interaction, and no public exploit code has been identified at time of analysis; with an EPSS score of 0.19% (9th percentile) and no CISA KEV listing, this is a genuine but low-to-moderate priority issue rather than an urgent one.

Arbitrary file read in Apple macOS allows a locally running malicious or compromised application to bypass path-handling input sanitization and read files the operating system should have denied it, exposing potentially sensitive user or system data. Exploitation requires the attacker to already have code execution on the host - a local, low-privileged app context (PR:L) with no further user interaction - and the impact is confined to confidentiality, with no integrity or availability effect. The flaw is moderate severity (EPSS 0.19%, 9th percentile) with no public exploit identified at time of analysis, and it is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27.

A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files.

A path-validation weakness in Apple macOS lets a malicious application read files outside its permitted scope, exposing restricted data to an app that should not be able to reach it. Exploitation requires local conditions: the attacker must deliver a crafted application to the Mac and convince the user to launch it (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), after which the app can achieve high confidentiality impact but cannot modify data or cause a denial of service. The issue is fixed in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27; there is confirmed actively exploited escalation is not indicated - no public exploit code has been identified at time of analysis and EPSS is low (0.17%, 6th percentile), making this a moderate-severity local information-disclosure flaw rather than an urgent priority, though the upstream fix should still be applied on any unpatched Mac.

A malicious or compromised app running on iOS and iPadOS prior to 26.7 (and prior to 27), and on visionOS prior to 27, can abuse insufficient path validation to write to protected parts of the file system. Apple addressed the path handling flaw with improved validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27, so patched devices are not exposed. Scoring 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), the issue requires the user to install and launch a hostile app but then needs no additional privileges; EPSS is only 0.17% (6th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, so this is a moderate local-integrity flaw rather than a network-exploitable emergency.

Improper path validation in Apple macOS allows a locally executing application to read files outside the scope it is authorized to access, resulting in disclosure of restricted data on affected systems. The issue affects macOS versions before 15.8 (Sequoia), before 26.7 (Tahoe), and before 27 (Golden Gate), and is rated CVSS 5.5 with confidentiality-only impact (C:H/I:N/A:N); exploitation requires a malicious or compromised app to be running locally and relies on user interaction (AV:L/UI:R, PR:N). No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.18% (7th percentile), and vendor-released fixes are available in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27.

Sandboxed applications on Apple iOS, iPadOS, macOS, and visionOS can bypass sandbox file-access restrictions and read restricted files because of insufficient path validation in the affected operating system components (CWE-22). Exploitation requires a local attacker to get a crafted sandboxed app installed and launched by the user on a vulnerable device (CVSS 3.1 AV:L/AC:L/PR:N/UI:R), making this a delivery-gated, confidentiality-only information-disclosure flaw rather than a remotely reachable one. Apple has shipped fixes in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27; no public exploit code has been identified at time of analysis, the EPSS score is only 0.17% (6th percentile), and the CVE is not listed in CISA KEV.

Navigator for i - the web-based administration interface bundled with IBM i 7.3 through 7.6 - permits authenticated remote attackers to upload files to filesystem paths that Navigator's own configuration should prohibit, via a path traversal flaw (CWE-22). The bypass is bounded by the attacker's underlying IBM i profile permissions: Navigator's upload restrictions are circumvented, but the OS-level object authority of the user's profile still constrains what can actually be written. No public exploit exists and SSVC assesses exploitation status as none, placing this squarely in the medium-priority tier.

Path traversal in MikroTik RouterOS's container package OCI/tar image extraction enables an authenticated administrator to be induced into importing a crafted container image that writes arbitrary files outside the container root onto the device's persistent data partition with root privileges. The vulnerability fires entirely at import time via the `/container/add` endpoint - the container never needs to start - enabling file creation, deletion via overlayfs whiteout, directory creation, and hardlink creation on the host filesystem. No public exploit has been identified and SSVC rates exploitation as none, but the 7.23.x long-term branch remains unpatched indefinitely, with container-7.23.3.npk and container-7.23.4.npk confirmed byte-identical.

Authenticated topology submission in Apache Storm Nimbus 3.0.0 through 3.0.x allows any authenticated Storm user to read arbitrary files accessible to the Nimbus daemon by supplying a server-side path as the uploadedJarLocation argument to submitTopology or submitTopologyWithOpts, bypassing the intended beginFileUpload flow entirely. Nimbus copies the targeted file into a topology blob and automatically grants the submitter read access via blob ACLs, enabling retrieval of Kerberos keytabs, TLS private keys, and ZooKeeper credentials through standard blob download APIs. A proof of concept was submitted alongside disclosure; upgrade to Apache Storm 3.1.0 is the required remediation.

Missing directory confinement in SP Page Builder's media upload endpoint allows high-privileged authenticated users to write files into arbitrary directories beneath the Joomla web root. The `folder` request parameter bypasses the extension's own boundary checks and is passed directly to `Folder::create()` and `File::upload()`, enabling file placement in sensitive paths such as `administrator/`, `templates/`, and `cli/`. Exploitation is bounded by Joomla's PATH input filter, which prevents traversal above the web root, and the component does not overwrite existing files. No public exploit or active exploitation has been identified at time of analysis.

Path traversal in HexStrike AI's `FileOperationsManager` API endpoint allows unauthenticated remote attackers to read, write, modify, and delete files outside the intended sandbox directory by supplying `..` sequences in the `filename` parameter. All four file-operation handlers (read, create, modify, delete) constructed paths via simple `self.base_dir / filename` concatenation with no canonicalization or boundary enforcement, making every file operation on the server accessible to callers who can reach the API. A public proof-of-concept exploit exists in GitHub issue #135; no CISA KEV listing is present, suggesting exploitation has not yet been observed at scale.

Path traversal in node-restify's serveStatic plugin exposes arbitrary server-side files to unauthenticated remote attackers on all versions up to and including 12.0.0. The serveStatic function in /lib/plugins/static.js fails to adequately sanitize user-controlled path segments, allowing traversal sequences to escape the intended static file root and return files from elsewhere on the filesystem. No vendor patch is available - the maintainer did not respond to responsible disclosure - leaving affected deployments without an official fix.

Absolute path traversal in the Zettlab D6 Ultra NAS firmware before version 1.7.0 permits authenticated network-adjacent users to navigate outside their designated personal folder and read files from arbitrary directories on the device. The vulnerability stems from insufficient sanitization of user-supplied file paths, allowing the personal-folder boundary to be bypassed using absolute path references. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is confirmed in version 1.7.0.

Path traversal in Zettlab D6 Ultra NAS (versions before 1.7.0) permits a low-privileged local user to mount arbitrary host paths - including /etc/passwd and /etc/shadow - into a container with read-write access by embedding '../' sequences in Docker Compose volume declarations. An attacker with compose-file write privileges can exfiltrate password hashes or overwrite authentication files, enabling full host privilege escalation. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; version 1.7.0 resolves the issue.

Path traversal in CPython's tarfile module allows an attacker to write files outside the intended extraction directory by exploiting a filter bypass in the link-fallback code path. On systems that do not support symbolic or hard links, tarfile falls back to extracting the link target as a regular archive member; in this fallback path the filter function is called a second time but its return value is discarded, so a filter that returns None to reject a dangerous member silently fails to block extraction. An attacker who can supply a crafted tar archive containing a hardlink-to-symlink chain can abuse this to achieve path traversal when a victim extracts the archive using a filter that selectively returns None. No public exploit code exists and CISA KEV listing has not been confirmed.

Relative path traversal in projen's generated file manifest cleanup component allows recursive deletion of files and directories outside the project directory during project synthesis. Projen versions before 0.101.37 consume a version-controlled manifest of generated files; crafted entries with traversal sequences (e.g., '../..') cause the cleanup routine to delete writable paths beyond the project root when a developer runs projen. No public exploit code has been identified at time of analysis, though the AWS security bulletin (2026-108-aws) confirms the issue and references the fixed release.

Path traversal in a-blog cms Ver. 3.2.33 and earlier enables unauthenticated remote attackers to read or delete arbitrary files on the server filesystem. Reported by JPCERT/CC and confirmed via JVN advisory JVN#20829034, the flaw carries a CVSS PR:N/AC:L vector indicating no authentication or special configuration is needed to trigger it. The dual read-and-delete capability substantially amplifies real impact beyond the assigned CVSS 6.5 score, as arbitrary file access can expose credentials and configuration secrets, while arbitrary deletion can destabilize or destroy the application and underlying OS. No public exploit code or CISA KEV listing is identified at time of analysis.

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.

Arbitrary file overwrite in Suricata IDS/IPS/NSM engine prior to versions 7.0.16 and 8.0.5 allows an attacker who controls rule content to write to any path on the host filesystem during rule load or reload. The flaw (CWE-22 path traversal) is triggered by a crafted rule using an absolute path in the save directive, bypassing expected sandbox boundaries of the rule engine. No public exploit code exists and this is not listed in CISA KEV at time of analysis.

Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read sensitive files outside the intended directory scope, potentially exposing credentials, configuration data, or other platform secrets. The CVSS vector assigns C:H/I:H/A:H, though IBM's own description limits the stated impact to information disclosure - an inconsistency worth verifying with the vendor advisory. No public exploit code or active exploitation has been identified at time of analysis.

Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-level privileges to traverse the file system beyond intended boundaries and read sensitive information from the underlying host or container. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation requiring only a valid low-privilege account with no user interaction. IBM has released a patch via their support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.

Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.

Authenticated path traversal in IBM Db2 11.5.x and 12.1.x allows a low-privileged database user to write arbitrary files to the underlying host filesystem via a specially crafted network request. The flaw (CWE-22) exploits insufficient pathname restriction in a Db2 request handler, enabling an attacker to place files outside intended directories - potentially overwriting configuration files, scripts, or other OS-level assets writable by the Db2 service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286985.