CWE-36 Absolute Path Traversal

pip would incorrectly handle doubly-encoded package URLs from indexes

Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set

compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data

NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

MindsDB has improper sanitation of filepath that leads to information disclosure and DOS

Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+

AgentScope arbitrary file download vulnerability in rpc_agent_client

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability

AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

Jenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs

Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read

Deep Java Library path traversal issue

MLflow Path Traversal vulnerability

DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload

DB-GPT Absolute Path Traversal vulnerability

H2O Vulnerable to Arbitrary File Overwrite via File Export

PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled

PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file

Ansible symlink attack vulnerability

Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs