Alertas de Seguridad de la Información

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-9195] A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6…

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-15979] The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable t…

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'img_file' field within the cegg_data post metadata: the value passes only through wp_strip_all_tags() (which does not strip path traversal sequences), is stored directl…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71279] Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` paramet…

Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. Because path.join() resolves `../` sequences, a name such as `../../tmp/evil.js` escapes the intended extensions directory. The extens…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71268] OpenPLC Runtime v3's compile_program() function (webserver/openplc.py) parses `(*FILE:path content*)…

OpenPLC Runtime v3's compile_program() function (webserver/openplc.py) parses `(*FILE:path content*)` directives from uploaded Structured Text (.st) program files and writes the referenced content to `os.path.join('./core', file_path)` with no validation that file_path stays within the ./core directory. A crafted .st file containing a directive such as `(*FILE:../../../etc/cron.d/x * * * * root

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71269] Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in pack…

Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path norma…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta en Eclipse Theia 1.73.1 expone acceso no autorizado a archivos del servidor

Eclipse Theia versiones hasta 1.73.1 contienen una vulnerabilidad que permite a atacantes descargar archivos arbitrarios del servidor sin restricción de directorio workspace. El backend `@theia/filesystem` no valida correctamente las rutas URI en endpoints HTTP, afectando especialmente despliegues en navegador donde la validación de tokens es insuficiente. Empresas LATAM usando Theia como IDE en la nube corren riesgo de exposición de fuentes, configuraciones sensibles y datos de negocio.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-46581] In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not prope…

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-60009] In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /f…

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection toke…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-12609] In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend expo…

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71209] audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-all…

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express's router decodes the :id route parameter before handler code runs, so a %2F-encoded '../' sequence in :id (e.g. ..%2f..%2f..%2ftmp%…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71215] art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both…

art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include() and extend() template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root. Because path.resolve() discards root entirely when filename is an absolute path, and does not block '../' traversal sequences, …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-47612] NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker ma…

NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker may cause improper limitation of a pathname to a restricted directory. A successful exploit of this vulnerability might lead to information disclosure.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-69110] OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthentic…

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can retrieve intermediate audio, video artifacts, and subtitles belonging to other users' jobs, and additionall…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-67200] Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attacke…

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/08/2026

Vulnerabilidad de traversal de ruta en Zyxel ATP, USG FLEX y USG20(W)-VPN (CVE-2026-14818)

Una vulnerabilidad de traversal de ruta en comandos CLI de dispositivos Zyxel (ATP, USG FLEX, USG FLEX 50(W) y USG20(W)-VPN) en versiones V4.16 a V5.42 Patch 1 permite a usuarios autenticados acceder a archivos fuera del directorio permitido. Esto afecta principalmente a empresas en LATAM que utilizan estos firewalls de seguridad perimetral. La vulnerabilidad posibilita escalada de privilegios y exposición de configuraciones altas.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/08/2026

Vulnerabilidad de path traversal no autenticado en CustomSounds (CVE-2026-56845)

Existe una vulnerabilidad de lectura local de archivos (LFI) no autenticada en módulos CustomSounds configurados con almacenamiento FileSystem. Un atacante puede leer archivos arbitrarios del servidor utilizando secuencias ../ en la ruta de solicitud, comprometiendo datos sensibles como credenciales, configuraciones y archivos de aplicación. Esta vulnerabilidad afecta directamente a plataformas de comunicaciones unificadas y sistemas PBX en empresas mexicanas y latinoamericanas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-61372] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69095] OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path travers…

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69089] Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes it…

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arb…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69086] SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-…

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JSON files outside the attribute-view directory to disclose cross-scope databa…

nvdaltovulnerabilidad CVSS 7.7 NVD