CWE-22
CVEs classified under CWE-22, newest first.
2062 CVEsRSS
CVE-2026-86360Critical· 9.6Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulner…
CVE-2026-71168High· 7.3Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerabi…
CVE-2026-106103High· 7.1Quasar Framework is a framework for building high-performance Vue.js user interfaces
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constra…
CVE-2026-106109Medium· 4.1Quasar Framework is a framework for building high-performance Vue.js user interfaces
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home d…
CVE-2026-95140High· 7.5PoCkkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java
kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without …
CVE-2026-105865High· 8.1Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to r…
CVE-2026-105795Low· 3.1Kiota is an OpenAPI based HTTP Client code generator
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin …
CVE-2026-105840High· 7.5lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames
lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in s…
CVE-2026-105834Medium· 6.5Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path
Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve f…
CVE-2026-39754Medium· 6.5Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.
Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.
CVE-2026-39752High· 7.7Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.
Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.
CVE-2026-39792High· 8.6Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.
Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.
CVE-2026-105751High· 7.5PoC⚖ disputedDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a d…
CVE-2026-105744High· 7.5PoCDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/ba…
CVE-2026-102262High· 7.3PoCNewell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file'…
CVE-2026-95264Medium· 6.5Feehi CMS 2.1.1 is vulnerable to Directory Traversal
Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is…
CVE-2026-105677High· 7.2Ghost is a Node.js content management system
Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This i…
CVE-2026-105676Medium· 4.9Ghost is a Node.js content management system
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potenti…
CVE-2026-12171High· 7.8PoCauto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source
auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source. …
CVE-2026-88396High· 7.2ApiAdmin v5.0 and before is vulnerable to Directory Traversal
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and move_up…
CVE-2026-89039Medium· 6.5A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud…
A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud…
CVE-2026-88394High· 7.5WookTeam v1.6.6 and before is vulnerable to a Directory Traversal
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The…
CVE-2026-88392High· 7.5PoCUnimall v4 is vulnerable to Directory Traversal in FileUploadController.local()
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.
CVE-2026-63266Medium· 6.8LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. …
CVE-2026-105286Medium· 6.3PoCA vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455
A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub_44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in pat…
CVE-2026-104805High· 8.5DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specifi…
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specifi…
CVE-2026-105293High· 8.1Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, su…
CVE-2026-105174Medium· 5.4PoCA vulnerability has been found in Gerapy up to 0.9.13
A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function project_create of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument project_name lead…
CVE-2026-105157Medium· 4.3PoCA security vulnerability has been detected in RainyGao DocSys up to 2.02.85
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argum…
CVE-2026-105144Medium· 5.3A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows
A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to pat…