CWE-41
CVEs classified under CWE-41, newest first.
27 CVEsRSS
CVE-2026-112343High· 8.1Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing
Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Att…
CVE-2026-116137Low· 3.7adm-zip: adm-zip: File integrity check bypass via duplicate archive entries (CVE-2026-116137)
A flaw was found in adm-zip. A remote attacker can exploit this issue by providing a specially crafted ZIP archive containing duplicate entries with equivalent path names to bypass validation checks. Consequently, an application may inspec…
CVE-2026-110725Low· 3.7fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
CVE-2026-110095Low· 3.7fast-uri vulnerable to improper path equivalence in relative reference normalization
fast-uri vulnerable to improper path equivalence in relative reference normalization
CVE-2026-88136High· 8.8Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.
Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.
CVE-2026-70184High· 7.8Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
CVE-2026-108463High· 8.8Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-102231High· 7.7Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-102217High· 8.8Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.
Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.
CVE-2026-79768Medium· 5.3Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#…
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#…
CVE-2026-93709Medium· 5.3Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the…
Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the…
CVE-2026-57441High· 8.4MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without ca…
CVE-2026-53713Critical· 9.1Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not col…
CVE-2026-89768Medium· 5.5fs: fix user path of nested backing files
In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backing_file_open() derives the path to be stored in the new backing file from user_file->f_path. This is incorrect when use…
CVE-2026-85978Critical· 9.8An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to …
CVE-2026-73019Medium· 4.3Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network.
Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-66835High· 8.2Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash. httpd_request:validate_uri/1 normal…
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash. httpd_request:validate_uri/1 normal…
CVE-2026-62384High· 7.5NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root
NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators i…
CVE-2026-72835Medium· 6.8filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can reques…
CVE-2026-18427High· 7.5@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass
@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dot…
CVE-2026-66064Medium· 5.3goshs has ACL Bypass & Path Traversal
goshs has ACL Bypass & Path Traversal
CVE-2026-50568Low· 3.6Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
GHSA-j99q-93c9-h869MediumMCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
CVE-2026-49401Medium· 5.2Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
CVE-2026-34510Medium· 5.3OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders
OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file t…
CVE-2026-34451Medium· 5.4Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications
Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.81.0, the local filesystem memory tool in the Anthropic TypeScript SDK validated …
CVE-2025-58290Low· 3.3Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.