https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 14:29:40 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-116073 <p>Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running &#39;/download model&#39; with a crafted URL containing encoded &#39;../&#39; sequences to write attacker-controlled content to arbitrary paths writable by Leon.</p> <p>Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running &#39;/download model&#39; with a crafted URL containing encoded &#39;../&#39; sequences to write attacker-controlled content to arbitrary paths writable by Leon.</p> https://db.gcve.eu/vuln/fkie_cve-2026-116073 https://db.gcve.eu/vuln/ghsa-5jhh-46x7-49hp <p>Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running &#39;/download model&#39; with a crafted URL containing encoded &#39;../&#39; sequences to write attacker-controlled content to arbitrary paths writable by Leon.</p> <p>Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running &#39;/download model&#39; with a crafted URL containing encoded &#39;../&#39; sequences to write attacker-controlled content to arbitrary paths writable by Leon.</p> https://db.gcve.eu/vuln/ghsa-5jhh-46x7-49hp