CWE-22

CVEs classified under CWE-22, newest first.

2091 CVEsRSS

CVE-2026-55390High· 7.5

3mo ago

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

▾ Twilightdatamodel-code-generator · datamodel-code-generatorEPSS 0.55%via GHSA

CVE-2026-50567High· 7.7

3mo ago

Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

▾ Twilightfission · github.com/fission/fissionEPSS 0.30%via GHSA

CVE-2026-54545High· 7.1

3mo ago

@wakaru/cli arbitrary file write during bundle unpack

▾ Twilightwakaru · @wakaru/cliEPSS 0.20%via GHSA

CVE-2026-45623High· 7.5

3mo ago

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can l…

▾ TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.61%via CSAF

CVE-2026-66004Medium· 5.3

3mo ago

BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes

▾ Sunlitblender-mcp · blender-mcpEPSS 0.30%via OSV

CVE-2026-66007Medium· 6.5PoC

3mo ago

datasets: Datasets: Information disclosure via path traversal vulnerability (CVE-2026-66007)

A flaw was found in datasets. This path traversal vulnerability allows a remote attacker to read arbitrary local files. By providing specially crafted file names in the metadata, an attacker can trick the system into including sensitive lo…

▾ TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.55%via CSAF

GHSA-95cv-r8x4-vh75High· 7.6

3mo ago

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

▾ TwilightOpenListTeam · github.com/OpenListTeam/OpenList/v4via GHSA

CVE-2026-59221High· 7.7

3mo ago

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

▾ Twilightopen-webui · open-webuiEPSS 0.48%via GHSA

CVE-2026-15074High· 7.5

3mo ago

@fastify/static vulnerable to route guard bypass via path traversal

▾ Twilightfastify · @fastify/staticEPSS 0.67%via GHSA

CVE-2026-59864Critical

3mo ago

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

▾ MidnightMicrosoft · Microsoft.OpenApi.KiotaEPSS 1.3%via GHSA

CVE-2026-59867High· 7.1

3mo ago

Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

▾ TwilightMicrosoft · Microsoft.OpenApi.KiotaEPSS 2.4%via GHSA

CVE-2026-59863High

3mo ago

Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF

▾ TwilightMicrosoft · Microsoft.OpenApi.KiotaEPSS 1.4%via GHSA

CVE-2026-59866High

3mo ago

Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

▾ TwilightMicrosoft · Microsoft.OpenApi.KiotaEPSS 1.4%via GHSA

GHSA-p5rm-jg5c-8c77Medium

3mo ago

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

▾ SunlitMicrosoft · Microsoft.OpenApi.Kiotavia GHSA

CVE-2026-61632Medium· 5.3

3mo ago

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

▾ Sunlitpymdown-extensions · pymdown-extensionsEPSS 0.40%via OSV

GHSA-r28c-9q8g-f849High· 7.5

3mo ago

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

▾ Twilightpostcss · postcssvia GHSA

CVE-2026-65689Critical· 9.8

3mo ago

Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supp…

▾ MidnightBold Reports (By SyncFusion) · Standalone Report DesignerEPSS 0.87%via CVEORG

CVE-2026-65919High· 7.5PoC

3mo ago

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. A…

▾ Midnightmeshery · mesheryEPSS 2.1%via NVD

CVE-2026-65607Medium· 6.5

3mo ago

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go)

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request…

▾ Sunlitsiyuan-note · siyuanEPSS 0.59%via NVD

CVE-2026-65600Medium· 5.3⚖ disputed

3mo ago

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-contr…

▾ Sunlittraefik · traefikEPSS 0.62%via NVD

GHSA-gf29-4f56-r2jfHigh

3mo ago

n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

▾ Twilightn8n · n8nvia GHSA

GHSA-pf2q-pxhf-hgmwMedium

3mo ago

n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory

▾ Sunlitn8n · n8nvia GHSA

CVE-2026-55554Low

3mo ago

Dompdf: Chroot Validation Bypass

▾ Sunlitdompdf · dompdf/dompdfEPSS 0.45%via GHSA

CVE-2026-56722Medium

3mo ago

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

▾ Sunlitdompdf · dompdf/dompdfEPSS 0.45%via GHSA

CVE-2026-64825Critical· 9.3

3mo ago

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial o…

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial o…

▾ Midnighthome-assistant · Home Assistant CoreEPSS 0.58%via NVD

GHSA-p63j-vcc4-9vmvCritical· 9.4

3mo ago

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

▾ Midnightvitest · @vitest/browservia GHSA

GHSA-frvp-7c67-39w9Medium· 5.9

3mo ago

Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

▾ Sunlithono · @hono/node-servervia GHSA

CVE-2026-12701Critical· 9.0

3mo ago

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An aut…

▾ MidnightRed Hat · python3.12-pulpcoreEPSS 1.2%via CVEORG

CVE-2026-59946Medium· 6.1

3mo ago

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

▾ Sunlitcomposer · composer/composerEPSS 0.14%via GHSA

CVE-2026-62843Medium· 6.8

3mo ago

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

▾ Sunlitfilebrowser · github.com/filebrowser/filebrowser/v2EPSS 0.39%via GHSA