CVE-2016-20104

EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Eyelock

Products

Nano Nxt

CVE-2014-125133

NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-46345

compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Oscal-compass

Products

Compliance-trestle

CVE-2026-63120

PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). When a database administrator executes a restore operation (via pghoard_restore get-basebackup), a maliciously crafted delta backup manifest with path traversal sequences (e.g., ../../../../etc/cron.d/backdoor) will write arbitrary payloads to the host system. This issue has been patched in version 2.7.2.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Aiven-open

Products

Pghoard

CVE-2026-57113

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mervinpraison

Products

Praisonai

CVE-2026-114492

gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Flipped-aurora Gin-vue-admin Project

Products

Gin-vue-admin Gin-vue-admin

CVE-2026-106486

Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Backstage Linuxfoundation

Products

Backstage Plugin-scaffolder-backend-module-bitbucket-cloud Plugin-scaffolder-backend-module-bitbucket-server and 3 more

CVE-2026-107508

Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Ultimate Multisite

CVE-2026-57155

OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Opnsense

Products

Core

CVE-2026-105265

Kiloview E3 NDI Encoder Path Traversal

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory .

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Kiloview

Products

E3 Firmware

CVE-2026-115497

Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75887

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2016-20100

Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview

Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Memphis Documents Library Project

Products

Memphis Documents Library

CVE-2014-125134

ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php

ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-113664

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apostrophecms

Products

Apostrophecms Import-export

CVE-2026-100406

dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Dbt-labs

Products

Dbt-core

CVE-2026-113394

DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal

A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Draytek

Products

Vigor2960 Vigor2960 Firmware

CVE-2026-92153

F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nasa

Products

Fprime

CVE-2026-63328

Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths, while plugins from the official Trivy plugin index are not affected. This issue is fixed in version 0.72.0.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Aquasecurity

Products

Trivy

CVE-2026-75859

CodeWhale before 0.8.64 Arbitrary File Read via instructions

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hmbown

Products

Codewhale