CVE-2026-114366

Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt Qt Framework Qtwebsockets

CVE-2026-42496

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Archive\ Bingos

Products

\ Archive::tar

CVE-2026-104739

JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires a two-step sequence: an administrator first saves a traversal-crafted value in the support_custom_img configuration field, then triggers deletion by uploading a new support custom image, at which point setSupportCustomImage() resolves and deletes the attacker-controlled path.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Rabilal Wordpress-extensions

Products

Js Help Desk – Ai-powered Support & Ticketing System Js Help Desk

CVE-2024-6228

WANotifier < 2.6 - Subscriber+ LFI

The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wanotifier

CVE-2026-10834

WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Travel Engine

CVE-2026-14372

Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config).

CVSS 3.1 · 7.1 High EPSS 1.1% KEV · Not listed

Vendors

Bitpressadmin Wordpress-extensions

Products

Bit Form Bit Form

CVE-2026-13693

Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Bit Form

CVE-2026-11974

Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Media Folder Addon

CVE-2026-123368

compose-lint: .env read through a symlink outside the project can expose the CI job's environment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an include project_directory link outside the project. A pull request can reference a variable from the linked file, causing substitution to place runner file or process-environment data into finding messages written to logs, JSON, SARIF artifacts, and Code Scanning alerts. Reading /proc/self/environ can expose the remainder of the linter process environment because NUL-separated entries are treated as one value, although disclosure requires a workflow that processes untrusted changes with useful environment data and GitHub normally withholds secrets from fork pull requests. The pass or fail result is not changed. This issue is fixed in version 0.31.0.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Tmatens

Products

Compose-lint

CVE-2026-60117

receive_sharing_intent 1.4.1-1.9.0 Path Traversal via FileDirectory

The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the intended cache directory by supplying a crafted _display_name value from an untrusted ContentProvider. Attackers can use a path-shaped display name ../databases/proof.txt combined with a controlled content stream to write to arbitrary locations within the receiving application's private sandbox under its UID, achieving file overwrite without user interaction.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Kasemjaffer

Products

Receive Sharing Intent

CVE-2026-111833

WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Boldgrid Wordpress-extensions

Products

Weforms Weforms

CVE-2026-107246

Arbitrary Code Execution via Path Traversal in Plesk Site Import Extension

The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120013

Path Traversal in Agent Memory Module of SAP Cloud SDK for Python

The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path traversal sequences (for example, attacker-corp/../victim-corp) could cause the resolved path to escape the intended directory and access another tenant's secrets under:Plain Text/etc/secrets/appfnd/hana-agent-memory/<tenant>/Successful exploitation could allow unauthorized access to another tenant's mounted credentials, including OAuth client IDs and client secrets. This vulnerability could enable cross-tenant access to sensitive credentials.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120513

Everest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function in all versions up to, and including, 3.6.2 This makes it possible for unauthenticated attackers to delete files within the wp-content/uploads directory on the server, which can lead to loss of uploaded content. On hardened Apache configurations, deletion of uploads/.htaccess can re-enable PHP execution inside the uploads directory. This attack is only possible when the Save-and-Continue addon is active (EVF_SAVE_AND_CONTINUE_VERSION is defined) and the 'Disable storing entry information' setting is enabled on the target form. Escaping the uploads directory and deleting files in the site root can be possible under rare circumstances.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-68509

FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

M66b

Products

Fairemail

CVE-2026-104620

PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)

A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Packagekit

Products

Packagekit

CVE-2026-125385

INDOTALENT WHMS before 10.20261109 Path Traversal via FileDocument/GetDocument and FileImage/GetImage

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without containment checks, to read files like appsettings.json.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Go2ismail

Products

Asp.net-core-inventory-order-management-system

CVE-2026-102643

AsyncSSH: SFTPServer Chroot Escape

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ronf

Products

Asyncssh

CVE-2026-125357

Munin munin-httpd through 2.999.18 Path Traversal via Static File Handler

Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../<file> to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Munin-monitoring

Products

Munin

CVE-2026-77604

Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_path input to project_root without resolving and verifying containment when offset or limit selects the paginated branch. An absolute path causes pathlib to discard the configured root, while relative traversal can also resolve outside it. The protected non-paginated branch uses validate_project_path, but the paginated branch bypasses that validation before opening the path. An unauthenticated caller of a network-exposed HTTP MCP server can therefore read arbitrary UTF-8-readable files available to the server process, including credentials, environment data, private keys, source, and configuration; local callers through the stdio transport can reach the same vulnerable code path. This issue is fixed in version 0.0.345.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Vitali87

Products

Code-graph-rag