Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/07/2026

[CVE-2026-54684] jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to writ…

jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolve(fileName) after a CWD-based ZIP security check. When jadx is launched from a directory that is an ancestor of the config d…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-53486] The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction…

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix compariso…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-48318] ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Trav…

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.9 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-48319] ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Trav…

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48350] Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Travers…

Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to access sensitive files or directories outside the intended restrictions. Exploitation of this issue requires user interaction in that a victim must ope…

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48310] Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directo…

Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-47429] Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on…

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15392] DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrust…

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers c…

nvdaltovulnerabilidad CVSS 7.7 NVD

D Alto vulnerabilidad

14/07/2026

[CVE-2026-60114] Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability…

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-15265] A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged atta…

A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-57898] In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments usin…

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter and passed it through repository file handling as both a repository key and, during thumbnail retri…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57856] Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/…

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem's WhitespacePathN…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-49970] Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() fu…

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim(…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-26396] OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XA…

OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “filename” is user-controllable and is concatenated into the file path to be read without proper validation, leading to a directory traversal vulnerability that may result in sensitive information disclosure.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57815] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57709] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP S…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Path Traversal.This issue affects Membership For WooCommerce: from n/a through

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57401] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brai…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57389] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adri…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adrian Tobey Groundhogg groundhogg allows Path Traversal.This issue affects Groundhogg: from n/a through

nvdaltovulnerabilidad CVSS 8.6 NVD

K Crítico vulnerabilidad

12/07/2026

[CVE-2026-56260] Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /scr…

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to supply absolute or path-traversal values to write to any location writable by the application's user, overwriting server files and causing denial of service.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

11/07/2026

[CVE-2026-61445] PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the A…

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.

nvdcriticovulnerabilidad CVSS 9.9 NVD