CWE-73
CVEs classified under CWE-73, newest first.
317 CVEsRSS
CVE-2026-90464High· 7.2Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create…
CVE-2026-93864High· 7.1Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP s…
GHSA-j456-xh4h-cpf2High· 8.6NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment
NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment
GHSA-23mf-xhv8-69c2HighGitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
CVE-2026-116822Medium· 5.3YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append cr…
CVE-2026-115931Critical· 9.9Arbitrary file read and backend crash through unrestricted provider method calls
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be …
CVE-2026-46652Critical· 9.8Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supp…
CVE-2026-57113High· 8.1PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-control…
CVE-2026-92709High· 8.1Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE
Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs in…
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)
A flaw was found in GitPython. This vulnerability allows an attacker to achieve arbitrary code execution by supplying an untrusted submodule path. Because the library fails to properly validate destination paths before cloning repository d…
CVE-2026-114379Medium· 5.4EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This man…
CVE-2026-114491Medium· 5.3pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image hre…
CVE-2026-114253Medium· 6.3oretnom23 file-management-system-php index.php include file inclusion
A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can …
CVE-2026-86147NoneApache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite fi…
CVE-2026-92390None-J no-clobber guarantee bypassed with 103 early hints
When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `C…
GHSA-pcc4-rvhr-2pr8MediumGraphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
CVE-2026-112310Medium· 4.3docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef
docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can subm…
CVE-2026-111935Low· 2.6NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis
NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's syn…
CVE-2026-92262High· 8.8PoCmariadb: MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. (CVE-2026-92262)
A flaw was found in MariaDB. An authenticated remote attacker can supply a crafted table name with the #mysql50# prefix, which bypasses normal filesystem encoding for table names. By accessing files under unencoded legacy names, the attack…
CVE-2026-105037Critical· 9.9EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files an…
CVE-2026-111234Medium· 5.9PoCSimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link p…
CVE-2026-111230Medium· 4.9Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set…
CVE-2026-57155Critical· 9.9PoCOPNsense is a FreeBSD based firewall and routing platform
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV coun…
CVE-2026-54703Medium· 5.8PoCMarkdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes t…
CVE-2026-92153High· 7.1F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the …
CVE-2026-107594Critical· 10.0The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticat…
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticat…
CVE-2026-110385High· 8.7A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Do…
CVE-2026-69783High· 7.8External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.
External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.
CVE-2026-106042Critical· 9.9An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connect…
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connect…
CVE-2026-103928Critical· 9.3Metabase is an open source business intelligence and analytics platform
Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing buil…