Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/07/2026

[CVE-2026-49970] Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() fu…

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim(…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-26396] OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XA…

OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “filename” is user-controllable and is concatenated into the file path to be read without proper validation, leading to a directory traversal vulnerability that may result in sensitive information disclosure.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57815] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57709] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP S…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Path Traversal.This issue affects Membership For WooCommerce: from n/a through

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57389] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adri…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adrian Tobey Groundhogg groundhogg allows Path Traversal.This issue affects Groundhogg: from n/a through

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-9282] The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, …

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-58499] EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the…

EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint because the per-message sender_id field was not validated as a path-safe identifier, unlike app_id and project_id. During user-memory extraction, sender_id is used as owner_id and joined into the filesystem path where the extracted episode is persisted as …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2025-70796] An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wirel…

An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.) version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web root directory. This may allow disclosure of sensitive system files and configuration data

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-13347] The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and …

The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via the he_wrapper_js and he_wrapper_css query parameters processed by the elementor_assets_filter() function. This is due to the function concatenating user-supplied input directly onto ABSPATH and passing the result to file_get_contents() without any path traversal validation, allow-…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-50181] Langroid is a framework for building large-language-model-powered applications. Prior to version 0.6…

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `WriteFileTool` appear to treat `curr_dir` as the intended working-directory boundary for file operations. However, the tools only change the process working directory to `curr_dir` and then operate on the user-supplied `file_path` without resolving and enforcing t…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59832] SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepa…

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticated request such as /snippets/%2e%2e/%2e%2e/conf/conf.json to read workspace secrets and the document d…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-13492] The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and inc…

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of file-field values in the UsersWP_Validation::validate_fields() function (which falls through to sanitize_text_field() for fields of type 'file', leaving directory-traversal sequences intact) combined with the UsersWP_Forms::upload_file_remove…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

09/07/2026

[CVE-2026-59221] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 bef…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/routers/terminals.py decoded proxy paths only eight times, allowing a nine-times percent-encoded ../ traversal value to pass normalization checks and be decoded by the upstream terminal server. This issue is fixed in version 0.10.0.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-14372] The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugi…

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the serve…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-55878] Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.…

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative() accepts paths like ../../../etc, a crafted or compromised kit can write attacker-controlled content to arbitrary locations or read local files outside the …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-58192] Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDr…

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54591] AsyncSSH is a Python package which provides an asynchronous client and server implementation of the …

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences because _parse_cd_args in scp.py returns server-provided names verbatim and _recv_f…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-59948] Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously cra…

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependen…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-55760] Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, appli…

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTemplateLoader or ClassPathTemplateLoader are vulnerable to path traversal, allowing arbitrary file read through template names derived from URL path parameters, request parameters, or other user-controlled sources. This issue…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-55874] SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot…

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.

nvdaltovulnerabilidad CVSS 7.7 NVD