CWE-22
CVEs classified under CWE-22, newest first.
2087 CVEsRSS
CVE-2026-73659High· 8.1Trigger.dev is the open-source platform for building AI workflows in TypeScript
Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtoc…
CVE-2026-73658High· 8.2Trigger.dev is a platform for building and deploying fully managed AI agents and workflows
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign us…
CVE-2026-73657Medium· 4.2Trigger.dev is a platform for building and deploying fully managed AI agents and workflows
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses `prisma.taskRun.…
CVE-2026-70460High· 8.1rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with…
CVE-2026-67613Medium· 4.9CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint
CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attacker…
CVE-2026-73619Medium· 6.5PoCgitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()` (CVE-2026-73619)
A flaw was found in GitPython. This vulnerability allows an attacker to read arbitrary files from the filesystem. By exploiting an incomplete denylist in the `unsafe_git_archive_options` guard, an attacker can supply specific options, such…
CVE-2026-73620High· 8.8PoCgitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding (CVE-2026-73620)
A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the `IndexFile.checkout()` and `TagReference.create()` functions. An authenticated attacker can exploit this by passing uns…
CVE-2026-73509High· 7.6OpenList a file list program that supports multiple storage
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and valid…
GHSA-rm43-82j9-r4mjHighatomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read
atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read
CVE-2026-45774Mediumcompliance-trestle is a tooling platform for managing compliance as code
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them wi…
CVE-2026-48099High· 7.1WsgiDAV is a generic and extendable WebDAV server based on WSGI
WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path lay…
CVE-2026-73291High· 7.1Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache fi…
CVE-2026-16033High· 8.5A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from es…
CVE-2026-66898Critical· 9.9A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names c…
CVE-2026-64826Medium· 6.5rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() metho…
rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() metho…
CVE-2026-73407NoneBudibase is an open-source low-code platform
Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination t…
CVE-2026-19594High· 8.1Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal (CWE-22) via unencoded `..` identifier path s…
Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal (CWE-22) via unencoded `..` identifier path s…
CVE-2026-65939Medium· 6.8In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.
CVE-2026-66382Medium· 4.3An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
CVE-2026-66381Medium· 5.3A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
CVE-2026-13622High· 8.8A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symli…
CVE-2026-73327High· 7.6Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filen…
Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filen…
CVE-2026-73498High· 7.7MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment passes its client-supplied file_path directly to open(file_path, "rb") in src/mcp_atlassia…
CVE-2026-54917HighPoCSeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
CVE-2026-72773Medium· 4.9n8n before 2.32.1 Path Traversal via computer-use search_files
n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outsi…
CVE-2026-72770High· 7.1n8n before 1.123.67 Path Traversal via Git Node Operations
n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/exec…
CVE-2026-72783Medium· 6.2Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path b…
CVE-2026-32677High· 7.3Path traversal for some gaudi-container-runtime before version 1.24.0 within Ring 3: User Applications may allow an escalation of privilege
Path traversal for some gaudi-container-runtime before version 1.24.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack…
CVE-2026-72713High· 7.5XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the `file_name` form fiel…
XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the `file_name` form fiel…
CVE-2026-73034Critical· 9.8PoCDB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Pyt…
DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Pyt…