CWE-22

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "chatbyvista"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-16177"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:24:03Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Affected versions of `chatbyvista` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\n**Example request:**\n```http\nGET /../../../../../../../../../../etc/passwd HTTP/1.1\nhost:foo\n```\n\n\n## Recommendation\n\nNo patch is available for this vulnerability.\n\nIt is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.",
  "id": "GHSA-8w74-g84v-c5w8",
  "modified": "2023-09-05T23:04:40Z",
  "published": "2020-09-01T18:52:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16177"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/chatbyvista"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/462"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Directory Traversal in chatbyvista"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.arcadedb:arcadedb-engine"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54077"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-776",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-16T20:05:56Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThe SQL `IMPORT DATABASE` statement did not require administrative privileges and passed its source URL to the importer without validation. Any authenticated user with SQL command access (not only `root`/administrators) could therefore:\n\n- **Server-Side Request Forgery (CWE-918):** cause the server to issue HTTP(S) requests to arbitrary destinations, including cloud metadata endpoints (e.g. `169.254.169.254`) and internal-only services, and ingest the responses as queryable records.\n- **Arbitrary local file read (CWE-22):** read local files reachable by the server process (e.g. `/etc/passwd`, credential files) by importing `file://` paths, exposing their contents as records.\n\nThe server administration endpoint (`/api/v1/server`) was already restricted to the `root` user and was **not** affected; the exposure was through the database SQL command/query endpoints (`/api/v1/command`, `/api/v1/query`).\n\nA related lower-severity hardening gap (CWE-776): the XML importer did not disable DTD processing, leaving entity-expansion (Billion Laughs) possible.\n\n### Affected component\n\n`integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java` (no host allow-list for http(s); no path validation for `file://`), reached from `engine/.../query/sql/parser/ImportDatabaseStatement.java`.\n\n### Patches\n\n- `IMPORT DATABASE` now requires the administrative `updateSecurity` permission (no-op in embedded mode).\n- Import sources are validated in `SourceDiscovery`: HTTP(S) hosts resolving to loopback / link-local / private (site-local) / wildcard / multicast addresses are blocked by default (`arcadedb.server.security.importBlockLocalNetworks`, default `true`), and an optional local-path allow-list (`arcadedb.server.security.importAllowedLocalPaths`) restricts `file://` reads.\n- The XML importer now disables DTD processing and external entities.\n\nFixed in commit referenced by pull request [#4422](https://github.com/ArcadeData/arcadedb/pull/4422).\n\n### Workarounds\n\nRestrict SQL command/query access to trusted administrative users; do not grant query access to untrusted users on servers that can reach sensitive networks or hold sensitive local files. Upgrading is strongly recommended.\n\n### Credit\n\nReported by Bin Luo (luob87709@gmail.com).",
  "id": "GHSA-8w86-m9h8-hvqg",
  "modified": "2026-07-16T20:05:56Z",
  "published": "2026-07-16T20:05:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ArcadeData/arcadedb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-24311"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-07T09:15:16Z",
    "severity": "HIGH"
  },
  "details": "Path Traversal vulnerability in Linea Grafica \"Multilingual and Multistore Sitemap Pro - SEO\" (lgsitemaps) module for PrestaShop before version 1.6.6, a guest can download personal information without restriction.",
  "id": "GHSA-8w8f-cg25-c89c",
  "modified": "2024-02-15T00:30:30Z",
  "published": "2024-02-07T09:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24311"
    },
    {
      "type": "WEB",
      "url": "https://security.friendsofpresta.org/modules/2024/02/06/lgsitemaps.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-2493"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-18T12:15:15Z",
    "severity": "HIGH"
  },
  "details": "Path Traversal vulnerability in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to manipulate the \u2018id\u2019 parameter of the \u2018/softdial/scheduler/load.php\u2019 endpoint to navigate beyond the intended directory. This can allow unauthorised access to sensitive files outside the expected scope, posing a security risk.",
  "id": "GHSA-8wc3-h23m-8ggr",
  "modified": "2025-10-21T15:30:53Z",
  "published": "2025-03-18T12:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2493"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-softdial-contact-center"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-2217"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-12-25T21:59:00Z",
    "severity": "HIGH"
  },
  "details": "Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via a full pathname in the UploadID metadata value.",
  "id": "GHSA-8wc5-2r9c-cj2g",
  "modified": "2025-04-12T12:43:23Z",
  "published": "2022-05-17T04:19:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2217"
    },
    {
      "type": "WEB",
      "url": "http://itq.nl/arbitrary-file-write-in-telerik-ui-for-asp-net-ajax"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.63.15"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.63.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55668"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T21:17:43Z",
    "nvd_published_at": "2026-07-08T15:16:30Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`ScopedFs` confines every File Browser user to a scope directory. Its `within()` guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a dangling symlink (target does not exist), the nearest existing ancestor is the in-scope directory containing the link, so the guard returns \"in scope\" and the subsequent `os.OpenFile(O_CREATE)` follows the link and creates the file at its out-of-scope target.\n\nA post-auth user with `Create` and `Modify` permission can write attacker-controlled content to any non-existent path outside their scope that the File Browser process can write to. The precondition is a dangling symlink present inside the user\u0027s scope, which is the same out-of-band precondition the rest of `ScopedFs` is built to defend against.\n\nThis is a patch-gap variant of the GHSA-239w-m3h6-ch8v symlink confinement issue, not a resubmission of the already-published vulnerable-version behavior: GHSA-239w-m3h6-ch8v marks `\u003c= 2.63.13` vulnerable and `2.63.14` patched, while this proof reproduces on current `master` / `v2.63.15` (`be23ab3a15bf957928ecfed88de5ab67850c1b9c`). The escaping-symlink-to-an-existing-target case is defended and tested. The dangling case is neither, and the gap is acknowledged in a code comment as \"best-effort\".\n\n## Root cause\n\n`files/scoped.go` (commit `be23ab3`). The guard, including the maintainer comment that already flags this exact gap:\n\n```go\n// Note: a dangling symlink whose target does not yet exist resolves to its\n// containing directory and is therefore allowed; writing through such a link\n// could still create a file outside the scope. This is treated as best-effort\n// and relies on rejecting existing escaping symlinks, which covers the\n// disclosure and overwrite vectors.\nfunc (s *ScopedFs) within(p string) (bool, error) {\n    root, err := filepath.EvalSymlinks(afero.FullBaseFsPath(s.base, \"/\"))\n    if err != nil {\n        return false, err\n    }\n\n    target := afero.FullBaseFsPath(s.base, p)\n    resolved, err := filepath.EvalSymlinks(target)\n    for errors.Is(err, fs.ErrNotExist) {\n        parent := filepath.Dir(target)   // LEXICAL parent of the link path\n        if parent == target {\n            break\n        }\n        target = parent\n        resolved, err = filepath.EvalSymlinks(target)\n    }\n    if err != nil {\n        return false, err\n    }\n    // ...\n    return resolved == root || strings.HasPrefix(resolved, prefix), nil\n}\n```\n\nWhen `p` is a symlink whose target does not exist, `EvalSymlinks(target)` returns `fs.ErrNotExist`. The loop takes the lexical parent of the link path (`filepath.Dir`), a real directory inside the scope, and `EvalSymlinks` of that resolves under the scope root. `within()` returns `true` and `guard()` permits the operation. The write then dereferences the link at the OS layer:\n\n```go\nfunc (s *ScopedFs) OpenFile(name string, flag int, perm os.FileMode) (afero.File, error) {\n    if err := s.guard(name); err != nil {   // returns nil for a dangling escaping symlink\n        return nil, err\n    }\n    return s.base.OpenFile(name, flag, perm) // os.OpenFile(O_CREATE) follows the link\n}\n```\n\nThe assumption that breaks: `within()` treats \"target does not exist\" as \"brand-new in-scope file\" and validates the containing directory. But the path component being created is itself a symlink pointing outside the scope. `O_CREATE` follows it and creates the file at the link target, not inside the validated directory. The existing-target case is correctly blocked, because the walk-up resolves the link itself to an out-of-scope path. Only the dangling case slips through.\n\nFor the layout below:\n\n```text\n/tmp/root/scope/escape -\u003e /tmp/root/outside/created-by-http.txt\n/tmp/root/outside/                      # exists\n/tmp/root/outside/created-by-http.txt   # does not exist yet\n```\n\n`EvalSymlinks(/tmp/root/scope/escape)` returns not-exist, and the fallback validates `/tmp/root/scope`. The final `OpenFile` still follows `/tmp/root/scope/escape` and creates `/tmp/root/outside/created-by-http.txt`.\n\n## Reachability over HTTP\n\nEndpoint: `POST /api/resources/\u003clinkname\u003e?override=true` (also `PUT`, and `POST/PATCH /api/tus/...`). Verified trace against the audited source:\n\n1. `http/resource.go` `resourcePostHandler` requires `d.user.Perm.Create` (else 403).\n2. `files.NewFileInfo` is called. For a dangling symlink, `stat()` in `files/file.go` does `LstatIfPossible` (sees the symlink, `err == nil`, `IsSymlink = true`), then `Fs.Stat` follows the link and fails with ENOENT, so the code returns the symlink `FileInfo` with `err == nil`. The handler therefore enters the \"file exists\" branch.\n3. The branch requires `override == \"true\"` and `d.user.Perm.Modify`, then proceeds.\n4. `writeFile(d.user.Fs, r.URL.Path, r.Body, ...)` calls `afs.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, fileMode)`.\n5. `ScopedFs.OpenFile` runs `guard()`, which passes for the dangling link, then `os.OpenFile` follows the link and creates the file outside the scope with the request body as content.\n\nThe TUS path (`http/tus_handlers.go` `tusPostHandler` -\u003e `OpenFile`, then `tusPatchHandler`) reaches the same sink.\n\n### Why existing defenses do not apply\n\n- `afero.BasePathFs` lexical confinement only neutralizes `..`. A plain link name passes it unchanged.\n- `ScopedFs.within()` is the dedicated symlink defense, and it is the component that fails: the not-exist walk-up validates the link\u0027s parent directory instead of the link.\n- The project\u0027s symlink tests (`http/tus_symlink_test.go` `TestTusHandlersRejectSymlinkScopeEscape`, `files/file_test.go`) only exercise escaping symlinks whose target exists. Those are blocked. The dangling variant is never tested, so the regression suite does not catch it.\n\n## Proof of concept\n\nThe PoC drives the real security boundary, `files.NewScopedFs`, with the same flags `http.writeFile` uses, and shows the write landing outside the scope. A control test shows the existing-target case is still blocked, proving the guard is real and the gap is specifically the dangling case.\n\n```go\nconst writeFlags = os.O_RDWR | os.O_CREATE | os.O_TRUNC // == http.writeFile\n\nscope := filepath.Join(root, \"user\")      // the low-priv user\u0027s jail\noutside := filepath.Join(root, \"outside\") // sibling dir = another tenant / host path\n\n// Precondition: a dangling escaping symlink inside the scope.\nos.Symlink(filepath.Join(outside, \"pwned.txt\"), filepath.Join(scope, \"evil\")) // target does not exist yet\n\nfs := files.NewScopedFs(afero.NewOsFs(), scope)\nf, _ := fs.OpenFile(\"/evil\", writeFlags, 0o644) // not rejected\nf.WriteString(\"OWNED-OUTSIDE-SCOPE\")\n// assert: outside/pwned.txt must NOT exist\n```\n\nObserved result:\n\n```text\n=== RUN   TestDanglingSymlinkWriteEscapesScope\n    poc_test.go:49: VULNERABLE: write escaped the scope and created\n        /tmp/.../001/outside/pwned.txt with content \"OWNED-OUTSIDE-SCOPE\"\n--- FAIL: TestDanglingSymlinkWriteEscapesScope (0.00s)\n=== RUN   TestExistingTargetSymlinkIsBlocked\n    poc_test.go:78: guard correctly blocked existing-target escape: permission denied\n--- PASS: TestExistingTargetSymlinkIsBlocked (0.00s)\n```\n\nThe dangling test \"fails\" by design: the assertion fires because the file escaped. The control test passes: an `escape_link -\u003e outside` (existing dir) write to `escape_link/injected.txt` is rejected by `OpenFile` with `permission denied` and nothing is created in `outside/`. That is exactly the scenario the project\u0027s own tests cover.\n\nEnd-to-end HTTP equivalent:\n\n```text\nPOST /api/resources/escape?override=true\nX-Auth: \u003ctoken for user scoped to /tmp/root/scope with Create+Modify\u003e\nbody: http-outside\n\n-\u003e ScopedFs.OpenFile(\"/escape\", O_CREATE|O_TRUNC) follows the dangling link\n-\u003e file created at the link\u0027s out-of-scope target with the request body\n```\n\nThe handler returns `200 OK`, and the outside file contains the uploaded body.\n\n## Impact\n\n- **Direct primitive (live-verified):** arbitrary file creation with attacker-controlled content at any non-existent path outside the user\u0027s scope that the File Browser process user can write to.\n- **Cross-tenant integrity (source-reasoned):** in multi-user deployments the scopes are sibling directories under one server root. A low-priv user can plant files into another user\u0027s home (a script, an HTML page later served, a config the victim trusts).\n- **Persistence / RCE on permissive deployments (source-reasoned):** creating a not-yet-existent `~/.ssh/authorized_keys` for the service account, a file under a web-served or later-executed directory, a cron or profile fragment. The official Docker image runs as non-root UID 1000, which bounds this to whatever that user owns. Bare-metal/systemd deployments that run File Browser as root raise this to host-level file write and RCE.\n- **Scope limit (honest):** this is file creation, not overwrite. Overwriting an existing out-of-scope file is genuinely blocked, because an existing target makes the link \"escaping\" and `within()` rejects it. The negative control confirms this.\n\n## Suggested remediation\n\nFor write/create/truncate operations, do not treat a dangling final symlink as safe merely because the nearest existing ancestor is inside the scope. The walk-up in `within()` should treat \"the leaf is a symlink\" as an escape candidate rather than validating its parent:\n\n- In `guard()` / `within()`, `Lstat` the target. If it is a symlink, `Readlink` it, resolve the link target lexically (join with the link\u0027s directory, `Clean`), and require that target to be within the scope root, regardless of whether it currently exists.\n- More robust: resolve path components one by one for the operation being attempted, or open the final component with `O_NOFOLLOW` (`unix.Openat(... O_NOFOLLOW)`) so creating through a symlink fails with `ELOOP`; or `fstat` the descriptor after opening and verify it resolves within the scope before writing.\n\nAdd a regression test mirroring `TestTusHandlersRejectSymlinkScopeEscape` but with a dangling target (`os.Symlink(filepath.Join(outside, \"newfile\"), ...)`), asserting both a 4xx and that no file is created outside the scope.\n\n## References\n\n- Incomplete fix of CVE-2026-54094 / `GHSA-239w-m3h6-ch8v`.\n- Affected code: `files/scoped.go` (`ScopedFs.within`, `ScopedFs.OpenFile`, `ScopedFs.Create`), reached from `http/resource.go` (`resourcePostHandler`, `writeFile`) and `http/tus_handlers.go`.\n- Confirmed unpatched at `be23ab3a15bf957928ecfed88de5ab67850c1b9c` (`v2.63.15`).",
  "id": "GHSA-8wc8-hf36-mjh9",
  "modified": "2026-07-20T21:17:43Z",
  "published": "2026-07-20T21:17:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8wc8-hf36-mjh9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55668"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/commit/64511ce45e3be379e965f7f4fb0929a068d5bb81"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filebrowser/filebrowser"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.63.16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.5.28"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.5.0"
            },
            {
              "fixed": "5.5.29"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.0.20"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.0.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2009-2902"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-17T22:10:05Z",
    "nvd_published_at": "2010-01-28T20:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.",
  "id": "GHSA-8wch-9gcg-v2pr",
  "modified": "2024-02-21T17:35:45Z",
  "published": "2022-05-02T03:39:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2902"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/3e1010b1a2f648581fac3d68afbf18f2979f6bf6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat55/commit/0299cb724ea71f304d54adfcdb950f59b01fb421"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20150308000602/http://www.securityfocus.com/archive/1/509150/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20140515000000*/http://secunia.com/advisories/57126"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20121211195847/http://www.securityfocus.com/bid/37945"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20121211115829/http://securitytracker.com/id?1023504"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20111119150528/http://www.securityfocus.com/archive/1/516397/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20110601000000*/http://secunia.com/advisories/40330"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20110529135656/http://secunia.com/advisories/38541"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20110213053623/https://secunia.com/advisories/43310"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20100601000000*/http://secunia.com/advisories/40813"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20100412065745/http://secunia.com/advisories/39317"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20100329100145/http://secunia.com/advisories/38687"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20100127190258/http://secunia.com/advisories/38316"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20100127015355/http://secunia.com/advisories/38346"
    },
    {
      "type": "WEB",
      "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=c02241113"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT4077"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7092"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:19431"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/tomcat"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55857"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2010:0582"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2010:0580"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2010:0119"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://svn.apache.org/viewvc?rev=892815\u0026view=rev"
    },
    {
      "type": "WEB",
      "url": "http://svn.apache.org/viewvc?rev=902650\u0026view=rev"
    },
    {
      "type": "WEB",
      "url": "http://tomcat.apache.org/security-5.html"
    },
    {
      "type": "WEB",
      "url": "http://tomcat.apache.org/security-6.html"
    },
    {
      "type": "WEB",
      "url": "http://ubuntu.com/usn/usn-899-1"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2011/dsa-2207"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:176"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:177"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) in Apache Tomcat"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "lsfusion.platform:server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "6.0-beta2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-13265"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-26T22:02:07Z",
    "nvd_published_at": "2025-11-17T06:15:43Z",
    "severity": "MODERATE"
  },
  "details": "A weakness has been identified in lsfusion platform up to 6.1. This vulnerability affects the function unpackFile of the file server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java. This manipulation causes path traversal. It is possible to initiate the attack remotely.",
  "id": "GHSA-8wf8-frjg-xv74",
  "modified": "2026-01-02T14:39:16Z",
  "published": "2025-11-17T06:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13265"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lsfusion/platform/issues/1545"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lsfusion/platform"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.332600"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.332600"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.689427"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "lsFusion Server is vulnerable to Path Traversal through its unpackFile function"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-22685"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-28T07:15:00Z",
    "severity": "HIGH"
  },
  "details": "Improper limitation of a pathname to a restricted directory (\u0027Path Traversal\u0027) vulnerability in webapi component in Synology WebDAV Server before 2.4.0-0062 allows remote authenticated users to delete arbitrary files via unspecified vectors.",
  "id": "GHSA-8wg2-h7mh-v5qc",
  "modified": "2022-08-04T00:00:15Z",
  "published": "2022-07-29T00:00:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22685"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/security/advisory/Synology_SA_21_09"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-5709"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-06T06:15:34Z",
    "severity": "HIGH"
  },
  "details": "The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the \u0027layout_name\u0027 parameter. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an Administrator, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included.",
  "id": "GHSA-8wgf-r9xp-xr3r",
  "modified": "2024-08-06T06:30:37Z",
  "published": "2024-08-06T06:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5709"
    },
    {
      "type": "WEB",
      "url": "https://wpbakery.com"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7fad30c8-fd8a-4cf2-a3aa-16a374231b87?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}