CWE-22

{
  "affected": [],
  "aliases": [
    "CVE-2023-39912"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-31T23:15:26Z",
    "severity": "MODERATE"
  },
  "details": "Zoho ManageEngine ADManager Plus through 7202 allows admin users to download any file from the server machine via directory traversal.",
  "id": "GHSA-8289-x38r-723c",
  "modified": "2024-01-01T06:30:40Z",
  "published": "2023-09-01T00:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39912"
    },
    {
      "type": "WEB",
      "url": "https://manageengine.com"
    },
    {
      "type": "WEB",
      "url": "https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-39912.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-90871"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-29T16:20:05Z",
    "severity": "MODERATE"
  },
  "details": "Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.",
  "id": "GHSA-8298-7w39-fvv4",
  "modified": "2026-10-29T18:31:07Z",
  "published": "2026-10-29T18:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90871"
    },
    {
      "type": "WEB",
      "url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.38.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.qameta.allure:allure-commandline"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.39.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55846"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T21:15:50Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe built-in HTTP server started by `allure serve` and `allure open` is vulnerable to path traversal. The server resolves request URI paths directly against the report directory without normalizing or validating that the resolved path stays within the report directory. An attacker who can reach the server can read any file accessible to the Allure process by sending a request containing `../` sequences.\n\n## Details\n\nWhen `allure serve` or `allure open` is executed, `Commands.setUpServer()` creates an HTTP server with a handler that serves files from the report directory:\n\n**`allure-commandline/src/main/java/io/qameta/allure/Commands.java:325-339`**\n```java\nprotected HttpServer setUpServer(final String host, final int port, final Path reportDirectory) throws IOException {\n    final HttpServer server = HttpServer\n            .create(new InetSocketAddress(Objects.isNull(host) ? \"localhost\" : host, port), 0);\n\n    server.createContext(\"/\", exchange -\u003e {\n        final Path resolve = reportDirectory.resolve(\".\" + exchange.getRequestURI().getPath());  // line 330\n        if (Files.isDirectory(resolve)) {\n            serveFile(exchange, resolve.resolve(\"index.html\"));\n        } else {\n            serveFile(exchange, resolve);\n        }\n    });\n\n    return server;\n}\n```\n\nOn line 330, the handler constructs a file path by concatenating `\".\"` with the raw request URI path and resolving it against `reportDirectory`. For a request to `/../../../etc/passwd`:\n\n1. `exchange.getRequestURI().getPath()` returns `\"/../../../etc/passwd\"`\n2. String concatenation produces `\"./../../../etc/passwd\"`\n3. `reportDirectory.resolve(\"./../../../etc/passwd\")` resolves to e.g. `/tmp/allure-report/./../../../etc/passwd`\n4. The OS resolves this to `/etc/passwd`\n\nThere is no call to `.normalize()` followed by a `.startsWith(reportDirectory)` containment check. The `serveFile()` method (line 341) reads and returns any regular file without further validation.\n\nAdditionally, `URI.getPath()` returns the percent-decoded path, so `%2e%2e` is decoded to `..`, enabling traversal via `/%2e%2e/%2e%2e/etc/passwd` which bypasses clients that normalize `..` in raw form.\n\nThe server defaults to binding on `localhost` (line 327), which limits remote exploitation. However, the `--host` option allows users to bind to any interface (e.g., `--host 0.0.0.0`), which is commonly used in CI/CD and containerized environments. Even when bound to localhost, the vulnerability is exploitable by:\n- Other local users on shared/multi-tenant systems\n- DNS rebinding attacks from malicious web pages visited by the user\n- Adjacent containers in CI/CD environments that share a network namespace\n\n## PoC\n\n**Step 1:** Start the Allure server (simulating a typical CI/CD scenario with network binding):\n```bash\nallure serve ./test-results --host 0.0.0.0 --port 9090\n```\n\n**Step 2:** Read `/etc/passwd` via path traversal:\n```bash\ncurl --path-as-is \u0027http://localhost:9090/../../../etc/passwd\u0027\n```\n\n**Step 3:** Alternative using percent-encoded traversal (works even with clients that normalize `..`):\n```bash\ncurl \u0027http://localhost:9090/%2e%2e/%2e%2e/%2e%2e/etc/passwd\u0027\n```\n\n**Step 4:** Read sensitive application files (e.g., environment variables, SSH keys):\n```bash\ncurl --path-as-is \u0027http://localhost:9090/../../../home/user/.ssh/id_rsa\u0027\ncurl --path-as-is \u0027http://localhost:9090/../../../proc/self/environ\u0027\n```\n\nEach command returns the full contents of the requested file if readable by the Allure process.\n\n## Impact\n\nAn attacker who can reach the Allure HTTP server can read any file on the system that the Allure process has permissions to access. This includes:\n\n- **System credentials:** `/etc/shadow` (if running as root), SSH private keys, cloud provider credentials\n- **Application secrets:** Environment variables via `/proc/self/environ`, configuration files, API keys\n- **Source code and data:** Any file on the filesystem accessible to the running user\n\nIn CI/CD environments where Allure is commonly used, this could expose build secrets, deployment credentials, and other sensitive CI/CD artifacts. The lack of authentication means any client that can reach the server\u0027s port can exploit this vulnerability.\n\n## Recommended Fix\n\nNormalize the resolved path and verify it remains within the report directory before serving:\n\n```java\nserver.createContext(\"/\", exchange -\u003e {\n    final Path resolve = reportDirectory.resolve(\".\" + exchange.getRequestURI().getPath()).normalize();\n    if (!resolve.startsWith(reportDirectory.normalize())) {\n        exchange.sendResponseHeaders(403, 0);\n        exchange.getResponseBody().close();\n        return;\n    }\n    if (Files.isDirectory(resolve)) {\n        serveFile(exchange, resolve.resolve(\"index.html\"));\n    } else {\n        serveFile(exchange, resolve);\n    }\n});\n```\n\nThe `.normalize()` call collapses `..` sequences, and the `.startsWith()` check ensures the resolved path is still within the report directory. Requests attempting traversal receive a 403 Forbidden response.",
  "id": "GHSA-82cg-3hv7-74gc",
  "modified": "2026-06-19T21:15:50Z",
  "published": "2026-06-19T21:15:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/allure-framework/allure2/security/advisories/GHSA-82cg-3hv7-74gc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/allure-framework/allure2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@vitest/mocker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "4.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vitest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "4.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vitest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta.1"
            },
            {
              "fixed": "5.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@vitest/mocker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta.1"
            },
            {
              "fixed": "5.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-84373"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T20:46:45Z",
    "nvd_published_at": "2026-09-01T22:17:19Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n`@vitest/mocker` registers a redirect mock\u0027s target path without validating it\nagainst the dev server\u0027s file-serving allowlist. An attacker who can reach the\ndev server\u0027s WebSocket can register a redirect mock pointing outside the project\nroot; when the mocked module is requested, the plugin\u0027s `load` hook returns\n`readFile(\u003cattacker path\u003e)` as the module source, disclosing local files.\n\nThis is exploitable **without authentication** only through the public\n`mockerPlugin` / standalone `interceptorPlugin` exports (used by third-party dev\nservers), which register the handler on Vite\u0027s unauthenticated HMR socket.\nVitest\u0027s own browser mode registers mocks over a **token-authenticated** RPC and\nis not remotely reachable by default (see Scope).\n\n## Affected code\n`packages/mocker/src/node/interceptorPlugin.ts`.\n\nThe `load` hook is the file-read sink:\n\n```ts\nif (mock.type === \u0027redirect\u0027) {\n  return readFile(mock.redirect, \u0027utf-8\u0027)\n}\n```\n\n`mock.redirect` is derived from client input at registration time with no\nboundary check:\n\n```ts\nif (event.type === \u0027redirect\u0027) {\n  const redirectUrl = new URL(event.redirect)\n  event.redirect = join(server.config.root, redirectUrl.pathname)\n}\nregistry.register(event)\n```\n\nThere is no `server.fs.allow` / `server.fs.deny` check and no assertion that the\nresolved path stays within the project root.\n\n## Registration paths and trust boundaries\n- **Public `mockerPlugin` / `interceptorPlugin` (unauthenticated).** In\n  `configureServer`, the plugin registers `server.ws.on(\u0027vitest:interceptor:register\u0027, \u2026)`\n  on Vite\u0027s HMR WebSocket. That socket performs no token, Origin, or same-origin\n  check, so any client that can reach it can register a redirect mock. This is\n  the path the \"unauthenticated\" impact applies to.\n- **Vitest browser mode (authenticated).** Mocks register over the browser RPC\n  (`registerMock`), which sits behind a per-run token (`isValidApiRequest`, a\n  random `api.token`). The interceptor\u0027s `configureServer` socket is not used for\n  registration here (in v5 it does not run at all, as the plugin is injected per\n  environment). The same missing boundary check exists on the authenticated RPC\n  path, but reaching it requires the token, so it is not a remote-unauthenticated\n  read.\n\n## Path handling\n`new URL(redirect).pathname` combined with `join(root, pathname)` does **not**\nconfine reads to the root:\n\n- Special/hierarchical schemes (`file:`, `http:`) are normalized by WHATWG URL,\n  so `..` segments are collapsed and the result stays under the root. Payloads of\n  the form `file:///../../etc/passwd` do **not** escape.\n- A non-special (opaque) scheme preserves `..` in `pathname`, so\n  `join(root, \"../../\u2026/etc/passwd\")` resolves outside the root and reads an\n  arbitrary file.\n\nEven without escaping the root, the missing `server.fs` check allows reading any\nin-root file the dev server would otherwise refuse to serve (for example an\nin-root `.env` or source that is denied by `server.fs.deny`).\n\n## Scope / preconditions\n- This is a **development-server** issue. The dev server binds to `localhost` by\n  default and is not reachable from the network unless the developer exposes it\n  (`server.host` / `0.0.0.0`, a LAN bind, or a proxy).\n- A raw (non-browser) client against a reachable server bypasses browser origin\n  and CORS protections entirely and can both register the mock and read the\n  response.\n- A browser-based drive-by against a localhost server is substantially mitigated\n  by Vite defaults: the default CORS origin allowlist is limited to `localhost`\n  origins, and `server.allowedHosts` blocks DNS-rebinding, so a cross-origin page\n  cannot read the file contents back.\n\n## Impact\nDisclosure of local files readable by the dev-server process (source, in-root\n`.env`/secrets, and, via the opaque-scheme payload, files outside the project\nroot). No integrity or availability impact.\n\n## Affected versions\nPresent since `@vitest/mocker` was introduced.\n\n- **Affected: `@vitest/mocker` \u003e= 2.1.0** (shipped in `vitest` and\n  `@vitest/browser` \u003e= 2.1.0), through 4.1.x and the 5.0.0 pre-releases.\n- **Fixed:** Vitest 4.1.11 and 5.0.0. Older majors (2.1.x, 3.x) are not\n  maintained and are not planned to receive the fix.\n\n## Fix\nValidate the resolved redirect target against Vite\u0027s file-serving allowlist\n(`isFileLoadingAllowed`) before registering it, at every registration site, and\nstop registering the interceptor WebSocket events in Vitest\u0027s browser mode\n(mocks there flow through the authenticated RPC).",
  "id": "GHSA-82fw-gwwq-j7x9",
  "modified": "2026-09-08T20:46:45Z",
  "published": "2026-09-08T20:46:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84373"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/pull/10972"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/pull/10974"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitest-dev/vitest"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v4.1.11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-24320"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-120",
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-14T18:15:27Z",
    "severity": "HIGH"
  },
  "details": "Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information and execute arbitrary code via the service parameter of the load-logfiles function.",
  "id": "GHSA-82h5-9gw3-q456",
  "modified": "2024-08-07T18:30:40Z",
  "published": "2024-06-14T18:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24320"
    },
    {
      "type": "WEB",
      "url": "https://datack.my/cloudpanel-v2-0-0-v2-4-0-authenticated-user-session-hijacking-cve-2024-24320"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-12990"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-16T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.",
  "id": "GHSA-82hx-pvjj-2m99",
  "modified": "2024-04-04T01:17:08Z",
  "published": "2022-05-24T16:50:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12990"
    },
    {
      "type": "WEB",
      "url": "https://support.citrix.com/search?searchQuery=%2A\u0026lang=en\u0026sort=relevance\u0026prod=\u0026pver=\u0026ct=Security+Bulletin"
    },
    {
      "type": "WEB",
      "url": "https://support.citrix.com/search?searchQuery=*\u0026lang=en\u0026sort=relevance\u0026prod=\u0026pver=\u0026ct=Security+Bulletin"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/research/tra-2019-31"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/109133"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.reposilite:reposilite-backend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0"
            },
            {
              "fixed": "3.5.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-04T23:23:08Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nReposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files.\n\n### Details\nThe problem lies in the way how the expanded javadoc files are served. The `GET /javadoc/{repository}/\u003cgav\u003e/raw/\u003cresource\u003e` route uses the `\u003cresource\u003e` path parameter to find the file in the `javadocUnpackPath` directory and returns it\u0027s content to the user.\n\n[JavadocFacade.kt#L77](https://github.com/dzikoysk/reposilite/blob/68b73f19dc9811ccf10936430cf17f7b0e622bd6/reposilite-backend/src/main/kotlin/com/reposilite/javadocs/JavadocFacade.kt#L77):\n\n```kotlin\nfun findRawJavadocResource(request: JavadocRawRequest): Result\u003cJavadocRawResponse, ErrorResponse\u003e =\n   with (request) {\n       mavenFacade.canAccessResource(accessToken, repository, gav)\n           .flatMap { javadocContainerService.loadContainer(accessToken, repository, gav) }\n           .filter({ Files.exists(it.javadocUnpackPath.resolve(resource.toString())) }, { notFound(\"Resource $resource not found\") })\n           .map {\n               JavadocRawResponse(\n                   contentType = supportedExtensions[resource.getExtension()] ?: ContentType.APPLICATION_OCTET_STREAM,\n                   content = Files.newInputStream(it.javadocUnpackPath.resolve(resource.toString()))\n               )\n           }\n   }\n```\n\nIn this case, the `\u003cresource\u003e` path parameter can contain path traversal characters such as `/../../`. Since the path is concatenated with the main directory, it opens the possibility to read files outside the `javadocUnpackPath` directory.\n\n#### Impact\n\nThis issue may lead to Arbitrary File Read on the server. A potential attacker can read some sensitive file, such as `reposilite.db`, that contains the sqlite database used by Reposilite. This database contains the sensitive information used by Reposilite, including passwords and hashes of issued tokens. Also, the `configuration.cdn` file can be read, which contains other sensitive properties.\n\n### Steps to reproduce\n\n1. Start the Reposilite instance on http://localhost:8080/\n2. Find at least one javadoc file in the hosted repositories. For example, the default test workspace contains the `/releases/javadoc/1.0.0/javadoc-1.0.0-javadoc.jar` archive that is suitable for our attack.\n3. Send a GET request to http://127.0.0.1:8080/javadoc/releases/javadoc/1.0.0/raw/%2e%2e%5c%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2freposilite.db\nWhen this request is processed on the server, Reposilite tries to unpack the `/repositories/releases/javadoc/1.0.0/javadoc-1.0.0-javadoc.jar` file into the `/javadocs/releases/javadoc/1.0.0/.cache/unpack` folder. Then, it tries to read the `../../../../../../reposilite.db` file from this folder, which triggers the path traversal attack.\n\n![image](https://github.com/dzikoysk/reposilite/assets/44605151/2f2638e2-2b6a-498d-9ca3-bacc84041d8a)\n\n### Remediation\n\nNormalize (remove all occurrences of `/../`) the `\u003cresource\u003e` path parameter before using it when reading the file. For example:\n\n```kotlin\ncontent = Files.newInputStream(it.javadocUnpackPath.resolve(resource.toPath()))\n```\n\nChanging `resource.toString()` to `resource.toPath()` is enough here as the `com.reposilite.storage.api.Location#toPath` method normalizes the string internally.\n",
  "id": "GHSA-82j3-hf72-7x93",
  "modified": "2024-11-04T23:23:08Z",
  "published": "2024-11-04T23:23:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dzikoysk/reposilite/security/advisories/GHSA-82j3-hf72-7x93"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36117"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dzikoysk/reposilite/commit/e172ae4b539c822d0d6e04cf090713c7202a79d6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dzikoysk/reposilite"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dzikoysk/reposilite/releases/tag/3.5.12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Reposilite vulnerable to path traversal while serving javadoc expanded files (arbitrary file read) (`GHSL-2024-074`)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-69194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-09T08:15:57Z",
    "severity": "HIGH"
  },
  "details": "A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink \u003cfile name\u003e elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user\u2019s environment.",
  "id": "GHSA-82jv-f4jx-8r27",
  "modified": "2026-03-05T21:30:24Z",
  "published": "2026-01-09T09:31:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69194"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-69194"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425773"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-5187"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-08-06T19:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php.",
  "id": "GHSA-82mh-4377-p289",
  "modified": "2022-05-17T04:38:31Z",
  "published": "2022-05-17T04:38:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5187"
    },
    {
      "type": "WEB",
      "url": "http://codevigilant.com/disclosure/wp-plugin-tom-m8te-local-file-inclusion"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-20615"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-11T23:16:05Z",
    "severity": "HIGH"
  },
  "details": "A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, visionOS 26.3. An app may be able to gain root privileges.",
  "id": "GHSA-82p2-ccrf-wxw5",
  "modified": "2026-08-21T03:31:21Z",
  "published": "2026-02-12T00:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20615"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126346"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126348"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126349"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126350"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126353"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}