CWE-23

{
  "affected": [],
  "aliases": [
    "CVE-2026-10073"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-29T14:16:25Z",
    "severity": "HIGH"
  },
  "details": "DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing unauthenticated local attackers to exploit Relative Path Traversal to download arbitrary system files.",
  "id": "GHSA-hp24-385h-9xv4",
  "modified": "2026-05-29T15:30:33Z",
  "published": "2026-05-29T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10073"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/en/cp-139-10946-1127f-2.html"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-10943-8fb00-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-3025"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-10T17:15:55Z",
    "severity": "CRITICAL"
  },
  "details": "mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside of the restricted directory. This can lead to unauthorized reading or deletion of files by utilizing the `/api/system/upload-logo` and `/api/system/logo` endpoints. The issue stems from the lack of filtering or validation on the logo filename, allowing attackers to target sensitive files such as the application\u0027s database.",
  "id": "GHSA-hp3w-grg4-233f",
  "modified": "2024-04-10T18:30:48Z",
  "published": "2024-04-10T18:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3025"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mintplex-labs/anything-llm/commit/7de23dbb2da932fbfb39f56d981784d3702cf5ce"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/fb09a352-1016-4481-ae88-7460e2b6062b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-64446"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-14T16:15:58Z",
    "severity": "CRITICAL"
  },
  "details": "A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.",
  "id": "GHSA-hp5v-vp9j-7vp9",
  "modified": "2025-11-19T15:31:33Z",
  "published": "2025-11-14T18:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64446"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-910"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nu11secur1ty/CVE-mitre/tree/main/2025/CVE-2025-64446/8.0.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446"
    },
    {
      "type": "WEB",
      "url": "https://www.patreon.com/posts/cve-2025-64446-8-143791801"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-43555"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-19T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vulnerable to a path traversal payload. This vulnerability may allow an attacker to plant files on the file system in arbitrary locations or overwrite existing files, resulting in remote code execution.",
  "id": "GHSA-hq87-gpw4-cg65",
  "modified": "2022-07-26T00:01:12Z",
  "published": "2022-05-24T19:21:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43555"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-313-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.opencastproject:opencast-user-interface-configuration"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "17.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.opencastproject:opencast-user-interface-configuration"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "18.0"
            },
            {
              "fixed": "18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "18.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-55202"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-29T15:34:37Z",
    "nvd_published_at": "2025-08-29T16:15:36Z",
    "severity": "LOW"
  },
  "details": "The protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases.\n\nThe path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. For example, the default UI config directory is placed at `/etc/opencast/ui-config`. Without this patch, an attacker can get access to files in a folder `/etc/opencast/ui-config-hidden` if those files are readable by Opencast.\n\nGeneral path traversal is not possible. For example, an attacker **cannot** exploit this to access files in `/etc/opencast/encoding` or even in `/etc/opencast/` directly.\n\n### How dangerous is this?\n\nTheoretically, this vulnerability may be exploited to get access to some non-public files. However, given the default structure of Opencast\u0027s configuration, this is extremely unlikely to hit any users. There can be but one `ui-config` folders. This makes it quite unlikely for any user to have created an additional folder starting with `ui-config`. Users could also rename this folder, but since there is no real reason for anyone to do this, this, again is extremely unlikely to trigger this issue.\n\n### How to fix the issue\n\n- To mitigate this, check if you have folders which start with the same path as your `ui-config` folder\n- A fix is available in https://github.com/opencast/opencast/pull/6979\n- Updating to Opencast 17.7 or 18.1 will fix the issue",
  "id": "GHSA-hq8m-v68g-8cf8",
  "modified": "2025-08-29T21:13:29Z",
  "published": "2025-08-29T15:34:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opencast/opencast/security/advisories/GHSA-hq8m-v68g-8cf8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55202"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencast/opencast/pull/6979"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencast/opencast/commit/e2cc65d6fbe052ebb71d9f6b583bb54b181af009"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opencast/opencast"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Opencast has a partial path traversal vulnerability in UI config"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.1.7"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "githacker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50024"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-09T18:00:32Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nGitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled `.git/HEAD` before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns any 40-character hex substring into an outbound HTTP `GET` \u2014 an existence oracle for arbitrary paths plus hex-fragment exfiltration of file contents.\n\n## Details\n\n### Vulnerability\n\nGitHacker rebuilds a remote `.git/` by fetching files into `temp_dst`. Two functions derived filesystem paths from server-controlled content:\n\n- `add_head_file_tasks` reads the downloaded `.git/HEAD`, parses `ref: \u003cref-path\u003e`, and joins the raw ref-path onto `temp_dst/.git/logs/` before reading the resulting file.\n- `add_hashes_parsed` scans any file it reads for 40-character hex substrings and emits `GET .git/objects/\u003csha[0:2]\u003e/\u003csha[2:]\u003e` for each one \u2014 onto the attacker\u0027s server and into the local output tree.\n\nPre-fix, `add_head_file_tasks` did not validate the ref segments. A malicious `.git/HEAD` of\n\n```\nref: ../../../../../../etc/passwd\n```\n\ncaused `add_head_file_tasks` to traverse out of `temp_dst` and read `/etc/passwd`. The bytes flowed into `add_hashes_parsed`, which emitted one outbound HTTP request per 40-char-hex match \u2014 observable on the attacker\u0027s logs.\n\n### Impact\n\nPR #65 originally classified this as arbitrary local file read. Joint analysis during coordinated disclosure narrowed the primitive: file contents do not stream back wholesale because the only egress channel is the 40-char-hex regex. In practice an attacker can:\n\n- **Existence oracle** for any path on the GitHacker host (`/etc/shadow`, `/root/.ssh/id_rsa`, `/home/\u003cuser\u003e/.git-credentials`, build artifacts under `/tmp/`).\n- **Hex-fragment exfiltration** when the targeted file contains 40-char hex sequences: other git repos\u0027 refs / pack filenames, password hashes, HMAC-SHA1 outputs, some session tokens.\n\nNot exploitable without victim action: the attacker must persuade the victim to run GitHacker against a URL they control. Project guidance has always been to run GitHacker inside a disposable container.\n\n### Scoping note: no write-side primitive in 1.1.7\n\nA working write-side primitive (attacker drops content outside `temp_dst` via `add_folder` / `add_task`) does **not** reproduce against the shipped 1.1.7 source. Empirical testing by the reporter against `GitHacker-1.1.7.tar.gz` (25 traversal-style payloads including `....//`, `%2e%2e%2f`, layered `foo/../../`, NUL bytes, backslash variants, absolute paths) yielded 0/25 escapes. Two structural reasons:\n\n1. `add_folder` anchors every derived path on `self.url + \u0027.git/\u0027`, so the first path component after the `url_length` strip is always `.git`. `os.path.join`\u0027s absolute-path short-circuit never fires.\n2. Python\u0027s `str.replace(\"..\", \"\")` is greedy non-overlapping; `....//` collapses to `//`, `......//` to `///`, etc. No literal `..` survives into `add_task`.\n\n`5f2a8ba` is still the correct fix for the read-side primitive and additionally hardens `add_task` as defense in depth against future regressions \u2014 for example, if a later caller removes the `.git/` anchor in `add_folder` or wires a new server-controlled segment source into `add_task`.\n\n### Fix\n\nCommit [`5f2a8ba`](https://github.com/WangYihang/GitHacker/commit/5f2a8ba) introduces `_is_safe_path_segment` as a single trust boundary: every segment about to be joined onto `temp_dst` or appended to an outgoing URL is validated against an allowlist before `add_task` accepts it. Empty / `.` / `..` / separators / NUL / control characters are rejected; the brittle `replace(\"..\", \"\")` filter is removed.\n\nThe fix also tightens adjacent surfaces preemptively:\n\n- `add_folder` switches to `urlparse`-based scheme + netloc + path comparison.\n- `construct_url_from_path_components` percent-encodes every segment.\n\nPR #65\u0027s two-layer defense (allowlist regex + `os.path.realpath()` confinement) was consolidated onto the allowlist applied at queue-time, removing the TOCTOU window an after-the-fact `realpath()` check leaves open and the per-call-site drift risk. PR #65 was closed in favour of the broader fix.\n\nRegression tests in [`tests/test_ref_validation.py`](https://github.com/WangYihang/GitHacker/blob/main/tests/test_ref_validation.py) (commit [`16fcd81`](https://github.com/WangYihang/GitHacker/commit/16fcd81)) pin the PoC and six bypass variants (extra-depth, mid-path, NUL, absolute path, leading-dot, `.lock`-suffix).\n\n### Credit\n\nReported and patched-prototyped by **Zac Wang** ([@7a6163](https://github.com/7a6163)) in [#65](https://github.com/WangYihang/GitHacker/pull/65). Zac refined the impact framing from \"arbitrary file read\" to \"existence oracle + hex-fragment exfiltration\" and verified the absence of a write-side primitive against the shipped 1.1.7 sdist with a 25-payload harness.\n\n## Patches\n\nPatched in 1.1.8 (commit [`5f2a8ba`](https://github.com/WangYihang/GitHacker/commit/5f2a8ba); tests [`16fcd81`](https://github.com/WangYihang/GitHacker/commit/16fcd81)).\n\n## Workarounds\n\nRun GitHacker inside a disposable container. Do not point GitHacker at any URL whose contents are not under your control.\n\n## Resources\n\n- https://github.com/WangYihang/GitHacker/pull/65\n- https://github.com/WangYihang/GitHacker/commit/5f2a8ba\n- https://github.com/WangYihang/GitHacker/blob/main/tests/test_ref_validation.py\n- https://githacker.pages.dev/security\n- https://github.com/justinsteven/advisories\n- https://drivertom.blogspot.com/2021/08/git.html",
  "id": "GHSA-hr3m-4qwq-3mgc",
  "modified": "2026-09-09T18:00:32Z",
  "published": "2026-09-09T18:00:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WangYihang/GitHacker/security/advisories/GHSA-hr3m-4qwq-3mgc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WangYihang/GitHacker/commit/5f2a8ba"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WangYihang/GitHacker"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-9639"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-29T04:16:04Z",
    "severity": "HIGH"
  },
  "details": "The QbiCRMGateway developed by Ai3 has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.",
  "id": "GHSA-hr5w-2jcm-x89v",
  "modified": "2025-08-29T06:30:27Z",
  "published": "2025-08-29T06:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9639"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/en/cp-139-10365-bf667-2.html"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-10364-6ac24-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-24819"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-07T16:16:22Z",
    "severity": "MODERATE"
  },
  "details": "Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system in Software Manager application.",
  "id": "GHSA-hr6r-6h98-gh58",
  "modified": "2026-04-07T18:31:36Z",
  "published": "2026-04-07T18:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24819"
    },
    {
      "type": "WEB",
      "url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-24819"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-4415"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-30T08:16:18Z",
    "severity": "CRITICAL"
  },
  "details": "Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is enabled, unauthenticated remote attackers can write arbitrary files to any location on the underlying operating system, leading to arbitrary code execution or privilege escalation.",
  "id": "GHSA-hvj3-h37v-8xmq",
  "modified": "2026-03-30T09:31:29Z",
  "published": "2026-03-30T09:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4415"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/en/cp-139-10804-689cd-2.html"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-10803-ae014-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-29377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-14T05:16:56Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects.",
  "id": "GHSA-hwrv-x7wv-x58q",
  "modified": "2026-09-14T06:31:18Z",
  "published": "2026-09-14T06:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29377"
    },
    {
      "type": "WEB",
      "url": "https://industrial.softing.com/fileadmin/psirt/downloads/syt-2023-02.html"
    },
    {
      "type": "WEB",
      "url": "https://industrial.softing.com/fileadmin/psirt/downloads/syt-2023-02.json"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1055"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}