CWE-73 · External Control of File Name or Path (page 2)
Page 2 of 6 — CVEs classified under CWE-73, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-45556 | Critical | 9.9 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf/<service>/<server_ip>/rule/<rul… |
CVE-2026-47643 | Critical | 9.8 | 2026-06-09 | External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network. |
CVE-2025-12656 | Low | 3.8 | 2026-06-06 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path va… |
CVE-2026-46397 | Medium | 6.5 | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the… |
CVE-2026-46399 | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vul… | |
CVE-2026-40605 | | 2026-06-04 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal vulnerability in the cache deletion en… | |
CVE-2026-20175 | Medium | 6.1 | 2026-06-03 | A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session on a… |
CVE-2026-35080 | High | 8.1 | 2026-06-03 | The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled inpu… |
CVE-2026-35079 | High | 8.1 | 2026-06-03 | The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input. |
CVE-2026-35078 | High | 8.1 | 2026-06-03 | The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input. |
CVE-2026-35077 | High | 8.1 | 2026-06-03 | The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled inp… |
CVE-2026-35076 | High | 8.1 | 2026-06-03 | The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input. |
CVE-2026-10694 | High | 7.3 | 2026-06-03 | A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The mani… |
CVE-2026-41412 | Medium | 4.9 | 2026-06-02 | alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the alf.io extension san… |
CVE-2026-10559 | Medium | 6.3 | 2026-06-02 | A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is an unknown function of the file /index.php. Executing a manipulat… |
CVE-2026-10558 | Medium | 6.3 | 2026-06-02 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipul… |
CVE-2026-9559 | Critical | 9.9 | 2026-05-29 | A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the val… |
CVE-2026-46402 | High | 8.1 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_… |
CVE-2026-45089 | High | 8.2 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the output, output… |
CVE-2026-45088 | High | 7.5 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload… |
CVE-2026-48920 | High | 8.8 | 2026-05-27 | Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inline` attribute, witho… |
CVE-2025-0898 | Medium | 6.5 | 2026-05-27 | The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widge… |
CVE-2026-8450 | Critical | 9.1 | 2026-05-27 | HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-a… |
CVE-2026-35593 | Medium | 6.8 | 2026-05-20 | Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior ar… |
CVE-2026-47358 | High | 7.5 | 2026-05-19 | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server m… |
CVE-2026-47357 | High | 7.5 | 2026-05-19 | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{… |
CVE-2026-29962 | High | 7.5 | 2026-05-18 | HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/php… |
CVE-2026-45008 | Medium | 6.5 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitr… |
CVE-2026-46383 | Medium | 5.5 | 2026-05-15 | Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extracti… |
CVE-2026-44641 | High | 7.1 | 2026-05-15 | Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying pl… |
CVE-2026-42597 | Medium | 5.9 | 2026-05-14 | Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the /forms/chromium/convert/url and /forms/chromium/screenshot/url routes accept ur… |
CVE-2026-42593 | Medium | 5.3 | 2026-05-14 | Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, pdfengines/merge, pdfengines/split, libreoffice/convert, chromium/convert/url, chro… |
CVE-2026-40893 | High | 8.2 | 2026-05-14 | Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips righ… |
CVE-2026-42881 | | 2026-05-14 | STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the priv… | |
CVE-2026-3892 | High | 8.1 | 2026-05-14 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1… |
CVE-2026-30905 | High | 7.8 | 2026-05-13 | External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to con… |
CVE-2026-0259 | High | 8.8 | 2026-05-13 | An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and… |
CVE-2026-43891 | High | 7.5 | 2026-05-12 | changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot… |
CVE-2026-41107 | High | 7.4 | 2026-05-12 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-41088 | High | 7.8 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile… |
CVE-2026-40421 | Medium | 4.3 | 2026-05-12 | Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-40370 | High | 8.8 | 2026-05-12 | External control of file name or path in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-32204 | High | 7.8 | 2026-05-12 | External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. |
CVE-2026-43989 | High | 8.5 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and upl… |
CVE-2026-8043 | Critical | 9.6 | 2026-05-12 | External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HT… |
CVE-2026-42866 | | 2026-05-11 | Tookie is a advanced OSINT information gathering tool. Prior to 4.1fix, modules/modules.py's write_txt, write_csv, write_json, and (commented-but-shipping) sca… | |
CVE-2026-42845 | | 2026-05-11 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-content overwrite via file upload (GHSA-w4… | |
CVE-2026-41693 | High | 8.2 | 2026-05-08 | i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Prior to version 2.6.4, i18next-fs-ba… |
CVE-2026-44127 | | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.4 contains an unauthenticated path traversal vulnerability in the identifier parameter of /api.app/attachment… | |
CVE-2026-7633 | Medium | 6.5 | 2026-05-02 | A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipu… |
CVE-2026-30893 | Critical | 9.0 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vul… |
CVE-2026-42424 | Medium | 5.7 | 2026-04-28 | OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers ca… |
CVE-2026-41177 | Medium | 5.5 | 2026-04-22 | Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blin… |
CVE-2026-4132 | High | 7.2 | 2026-04-22 | The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and includi… |
CVE-2026-39378 | Medium | 6.5 | 2026-04-21 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExpor… |
CVE-2026-39377 | Medium | 6.5 | 2026-04-21 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary fil… |
CVE-2026-41389 | Medium | 5.8 | 2026-04-20 | OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing arbitrary local and UNC file access. At… |
CVE-2026-35465 | High | 7.5 | 2026-04-18 | SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17… |
CVE-2026-40342 | Critical | 9.9 | 2026-04-17 | Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates… |
CVE-2026-35032 | High | 8.1 | 2026-04-14 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/Tun… |
CVE-2026-39907 | Critical | 10.0 | 2026-04-14 | Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized… |
CVE-2026-5809 | High | 7.1 | 2026-04-11 | The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-step logic flaw: the… |
CVE-2026-5054 | High | 7.8 | 2026-04-11 | NoMachine External Control of File Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2026-5053 | High | 7.1 | 2026-04-11 | NoMachine External Control of File Path Arbitrary File Deletion Vulnerability. This vulnerability allows local attackers to delete arbitrary files on affected… |
CVE-2026-31939 | High | 8.3 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. Us… |
CVE-2026-40086 | Medium | 5.3 | 2026-04-10 | Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers t… |
CVE-2025-65115 | High | 8.8 | 2026-04-07 | Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Mana… |
CVE-2026-35174 | Critical | 9.1 | 2026-04-06 | Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an admini… |
CVE-2026-34783 | High | 8.1 | 2026-04-06 | Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library fun… |
CVE-2026-34522 | High | 8.1 | 2026-04-02 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-33949 | High | 8.1 | 2026-04-01 | Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write… |
CVE-2026-30292 | High | 8.4 | 2026-04-01 | An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal files via the file im… |
CVE-2026-30291 | High | 8.4 | 2026-04-01 | An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical internal files via the fil… |
CVE-2026-30289 | High | 8.4 | 2026-04-01 | An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal files via the file… |
CVE-2026-30287 | High | 8.4 | 2026-04-01 | An arbitrary file overwrite vulnerability in Deep Thought Industries ACE Scanner PDF Scanner v1.4.5 allows attackers to overwrite critical internal files via t… |
CVE-2026-23898 | High | 7.2 | 2026-04-01 | Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism. |
CVE-2026-5210 | High | 7.3 | 2026-03-31 | A vulnerability was detected in SourceCodester Leave Application System 1.0. This affects an unknown part. Performing a manipulation of the argument page resul… |
CVE-2026-30282 | Critical | 9.0 | 2026-03-31 | An arbitrary file overwrite vulnerability in UXGROUP LLC Cast to TV Screen Mirroring v2.2.77 allows attackers to overwrite critical internal files via the file… |
CVE-2026-30284 | High | 8.6 | 2026-03-31 | An arbitrary file overwrite vulnerability in UXGROUP LLC Voice Recorder v10.0 allows attackers to overwrite critical internal files via the file import process… |
CVE-2026-30281 | Critical | 9.8 | 2026-03-31 | An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to… |
CVE-2026-30276 | Critical | 9.8 | 2026-03-31 | An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import proces… |
CVE-2026-30940 | High | 7.2 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/b… |
CVE-2026-33027 | Medium | 6.5 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequence… |
CVE-2026-33989 | High | 8.1 | 2026-03-27 | Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vuln… |
CVE-2026-33645 | High | 7.1 | 2026-03-26 | Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerability in Fireshare’s chunked upload endpoin… |
CVE-2026-0965 | Low | 3.3 | 2026-03-26 | A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a maliciou… |
CVE-2026-33329 | High | 8.1 | 2026-03-24 | FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js… |
CVE-2026-33309 | Critical | 9.9 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (Exte… |
CVE-2026-33354 | High | 7.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.php` accepts a requester-controlled `chun… |
CVE-2019-25618 | Medium | 6.2 | 2026-03-22 | AdminExpress 1.2.5 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input through the Sy… |
CVE-2026-2351 | Medium | 6.5 | 2026-03-21 | The Task Manager plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.0.2 via the callback_get_text_from_url() fun… |
CVE-2026-33476 | High | 7.5 | 2026-03-20 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance… |
CVE-2026-32949 | High | 7.5 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) vulner… |
CVE-2026-32749 | High | 7.6 | 2026-03-19 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploaded archiv… |
CVE-2019-25472 | High | 7.5 | 2026-03-11 | IntelBras Telefone IP TIP200 and 200 LITE contain an unauthenticated arbitrary file read vulnerability in the dumpConfigFile function accessible via the cgiSer… |
CVE-2026-30903 | Critical | 9.6 | 2026-03-11 | External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation… |
CVE-2026-27825 | Critical | 9.0 | 2026-03-10 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the `confluence_download_attachme… |
CVE-2026-25605 | Medium | 6.7 | 2026-03-10 | A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file deletion without properly validating the… |
CVE-2026-25573 | High | 7.4 | 2026-03-10 | A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application builds shell commands with caller-provided strings and… |
CVE-2026-24287 | High | 7.8 | 2026-03-10 | External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally. |