CVE-2015-5174

tomcat: URL Normalization issue

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

CVSS 3.0 · 4.3 Medium EPSS 12.6% KEV · Not listed

Vendors

Apache Canonical Debian and 1 more

Products

Tomcat Ubuntu Linux Debian Linux and 3 more

CVE-2026-84247

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Guardium Data Protection

CVE-2026-75875

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Guardium Data Protection

CVE-2026-5049

Local Authenticated Path Traversal in Brocade SANnav Zone Alias Import

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Sannav

CVE-2026-18228

Hyperscale Path Traversal

HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94580

Arbitrary File Deletion via REST API in Brocade Fabric OS

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Brocade

Products

Fabric Operating System Fabric Os

CVE-2026-85490

ASCG Path Traversal Enables Remote Code Execution

When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Active Support Connectivity Gateway

CVE-2026-85487

Unauthenticated Local Path Traversal in Brocade ASCG HTTP API

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Brocade Active Support Connectivity Gateway

CVE-2026-108902

pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Ph7software

Products

Ph7builder

CVE-2026-110115

Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Risesoft-y9

Products

Digital-infrastructure

CVE-2026-108585

argocd-mcp through 0.9.0 Path Traversal via delete_application Tool

argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Argoproj-labs

Products

Argocd-mcp

CVE-2026-108158

plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then fetch them unauthenticated through /download/uploadedFile/.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mynaparrot

Products

Plugnmeet-server

CVE-2026-93347

Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wazuh

Products

Wazuh Wazuh-manager

CVE-2026-109519

YouTransfer Template Rendering template path traversal

A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Youtransfer

Products

Youtransfer

CVE-2026-108940

EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal

A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ericlbuehler

Products

Mistral.rs

CVE-2026-87690

Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying stdapi sink (lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb) writes to whatever path is supplied, so a listing entry such as ../../msfconsole.rc escapes the intended ~/.msf4/loot/<random> directory and overwrites ~/.msf4/msfconsole.rc, a resource file that every msfconsole invocation automatically executes at startup (lib/msf/ui/console/driver.rb:196). An attacker-controlled device that lures an operator into running this gather module achieves an arbitrary file write as the operator; because the written msfconsole.rc can load a second written file (a Ruby plugin whose top-level code runs on require), this converts into persistent code execution and an interactive shell as the operator (frequently root) on the pentester's workstation at the next console launch. The same traversal was previously fixed upstream in the recursive downloader (stdapi/fs/dir.rb scrubs separators); this module omitted the equivalent scrub. The fix applies the same separator scrub (or File.basename) to listing entries before building the local path.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Metasploit

Products

Metasploit Framework

CVE-2021-3426

python: Information disclosure via pydoc

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.

CVSS 3.1 · 5.7 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 3 more

Products

Debian Linux Fedora Cloud Backup and 8 more

CVE-2019-9948

python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVSS 3.1 · 9.1 Critical EPSS 11.8% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 15 more

CVE-2019-6111

openssh: Improper validation of object names allows malicious server to overwrite files via scp client

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

CVSS 3.1 · 5.9 Medium EPSS 58.2% KEV · Not listed

Vendors

Apache Canonical Debian and 7 more

Products

Mina Sshd Ubuntu Linux Debian Linux and 24 more

CVE-2026-108603

slide-maker through 5.8.0 Path Traversal via generate_images_openai.py

slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked filenames, creating directories and overwriting existing files at arbitrary paths.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Addsumtech

Products

Slide-maker