Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45569] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 ("Expand validation to block .. in config_file_name and configver for improved security") added a line in app/modules/config/config.py:462. This is tuple-membership, not substring containment — '..' in (a, b, c) evaluates to True only if any of a, b, c is equal to th…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45565] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/class_models.py:16-30) is the centralised Pydantic validator used on dozens of fields including SSH credential name, username, description, etc. Its if/elif/elif/else flow returns the metacharacter-stripped value without also enforcing the .. block…

nvdaltovulnerabilidad CVSS 8.1 NVD

K Crítico vulnerabilidad

10/06/2026

[CVE-2026-53476] A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local…

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-45556] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a config_file_name form field that is passed straight through to config_mod.master_slave_upload_and_restart(...) as the destination path. The validation chain (_replace_config_path_to_correct → check_is_conf) only requires…

nvdcriticovulnerabilidad CVSS 9.9 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52752] Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails t…

Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious extensions with traversal sequences like ../ in filenames to write arbitrary files outside the intended directory, enabling code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52755] Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that …

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.

nvdaltovulnerabilidad CVSS 7.8 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-44716] Pipecat is an open-source Python framework for building real-time voice and multimodal conversationa…

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat's development runner (src/pipecat/runner/run.py). When the runner is started with the --folder flag, it exposes a GET /files/{filename:path} download endpoint. The filename path parameter is conca…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46491] SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp mod…

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled ticket / pgt query…

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47932] ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Limitation of a Pathname…

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a mali…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-36723] An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows …

An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage directory traversal sequences to move arbitrary files from temporary storage to arbitrary locations on the server filesystem. This enables unauthorized access to sensitive files, the overwriting of critical application files, and remote code execution (RCE).

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-49957] Hermes WebUI before version 0.51.296 contains a workspace boundary bypass vulnerability that allows …

Hermes WebUI before version 0.51.296 contains a workspace boundary bypass vulnerability that allows authenticated attackers to circumvent blocked-root path checks by exploiting an early return in the SSH/remote terminal profile workspace resolution logic within _remote_terminal_workspace_candidate(). Attackers can configure a remote terminal working directory to a system directory such as /etc, ca…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45482] Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and…

Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-32193] Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Ku…

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-22926] Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability.

Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2017-20248] Apptha Slider Gallery 1.0 contains a path traversal vulnerability that allows unauthenticated attack…

Apptha Slider Gallery 1.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the imgname parameter. Attackers can send requests to asgallDownload.php with directory traversal sequences ../ to access sensitive files outside the intended directory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2017-20250] Mac Photo Gallery 3.0 contains a path traversal vulnerability that allows unauthenticated attackers …

Mac Photo Gallery 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the albid parameter. Attackers can send requests to macdownload.php with directory traversal sequences to access sensitive files like wp-load.php outside the intended plugin directory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-46484] Headplane is a feature-complete Web UI for Headscale. Prior to versions 0.6.3 and 0.7.0-beta.3, Head…

Headplane is a feature-complete Web UI for Headscale. Prior to versions 0.6.3 and 0.7.0-beta.3, Headplane was vulnerable to a path traversal / authorization bypass in the Headscale API client used by node and user rename operations. This issue has been patched in versions 0.6.3 and 0.7.0-beta.3.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-41448] AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability t…

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-25559] OpenBullet2 through version 0.3.2 contains a path traversal vulnerability in the wordlist endpoint t…

OpenBullet2 through version 0.3.2 contains a path traversal vulnerability in the wordlist endpoint that allows authenticated attackers to perform arbitrary file read, write, and delete operations by supplying unsanitized absolute paths to the upload handler and wordlist functions. Attackers can chain the file write and delete primitives to achieve remote code execution by manipulating critical sys…

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

08/06/2026

[CVE-2026-49233] Routinator does not properly check the module component of rsync URIs, which are used to create the …

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

nvdaltovulnerabilidad CVSS 7.5 NVD