CWE-23

{
  "affected": [],
  "aliases": [
    "CVE-2024-12897"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-23T00:15:04Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222. It has been classified as critical. This affects an unknown part of the file ../mtd/Config/Sha1Account1 of the component Web Interface. The manipulation leads to path traversal: \u0027../filedir\u0027. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
  "id": "GHSA-cpq8-gjrv-h7mr",
  "modified": "2024-12-24T18:30:49Z",
  "published": "2024-12-23T00:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12897"
    },
    {
      "type": "WEB",
      "url": "https://netsecfish.notion.site/Path-Traversal-Vulnerability-in-IntelBras-IP-Cameras-mtd-Config-Sha1Account1-and-mtd-Confi-15e6b683e67c80809442ee3425f753b7"
    },
    {
      "type": "WEB",
      "url": "https://netsecfish.notion.site/Path-Traversal-Vulnerability-in-IntelBras-IP-Cameras-mtd-Config-Sha1Account1-and-mtd-Confi-15e6b683e67c80809442ee3425f753b7?pvs=4"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.289167"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.289167"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.464260"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.5.12"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "astrbot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.4.4"
            },
            {
              "fixed": "3.5.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-48957"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-04T23:54:35Z",
    "nvd_published_at": "2025-06-02T12:15:25Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThis vulnerability may lead to:\n\n* Information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data.\n\n### Reproduce\n\nFollow these steps to set up a test environment for reproducing the vulnerability:\n\n1. Install dependencies and clone the repository:\n\n   ```bash\n   pip install uv\n   git clone https://github.com/AstrBotDevs/AstrBot \u0026\u0026 cd AstrBot\n   uv run main.py\n   ```\n\n2. Alternatively, deploy the program via pip:\n\n   ```bash\n   mkdir astrbot \u0026\u0026 cd astrbot\n   uvx astrbot init\n   uvx astrbot run\n   ```\n\n3. In another terminal, run the following command to exploit the vulnerability:\n\n   ```bash\n   curl -L http://0.0.0.0:6185/api/chat/get_file?filename=../../../data/cmd_config.json\n   ```\n\nThis request will read the `cmd_config.json` config file, leading to the leakage of sensitive data such as LLM API keys, usernames, and password hashes (MD5).\n\n### Patches\n\nThe vulnerability has been addressed in [Pull Request #1676](https://github.com/AstrBotDevs/AstrBot/pull/1676) and is included in versions \u003e= v3.5.13. All users are strongly encouraged to upgrade to v3.5.13 or later.\n\n### Workarounds\nUsers can edit the cmd_config.json file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later as soon as possible to fully resolve this issue.\n\n### References\n\n* [Pull Request #1676](https://github.com/AstrBotDevs/AstrBot/pull/1676)\n* [Issue #1675](https://github.com/AstrBotDevs/AstrBot/issues/1675)",
  "id": "GHSA-cq37-g2qp-3c2p",
  "modified": "2025-06-27T22:09:44Z",
  "published": "2025-06-04T23:54:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48957"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AstrBotDevs/AstrBot/issues/1675"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AstrBotDevs/AstrBot/pull/1676"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AstrBotDevs/AstrBot"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability?prevUrl=wizard"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/cve-2025-48957-mitigate-astrbot-dashboard-vulnerability?prevUrl=wizard"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AstrBot Has Path Traversal Vulnerability in /api/chat/get_file"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-62187"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-07T21:15:39Z",
    "severity": "LOW"
  },
  "details": "In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).",
  "id": "GHSA-cvrh-qggv-7gf8",
  "modified": "2025-10-07T21:31:08Z",
  "published": "2025-10-07T21:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62187"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ankitects/anki/pull/4041"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ankitects/anki/pull/4041/commits/51476e05b281737a0c2924342bccdb6e5be52ea9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ankitects/anki/releases/tag/25.02.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-47287"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-09T17:17:34Z",
    "severity": "MODERATE"
  },
  "details": "Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.",
  "id": "GHSA-cw93-p7fx-xgqx",
  "modified": "2026-06-09T18:30:54Z",
  "published": "2026-06-09T18:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47287"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47287"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-11067"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-11T08:15:08Z",
    "severity": "HIGH"
  },
  "details": "The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device\u0027s default password is a combination of the MAC address, attackers can obtain the MAC address through this vulnerability and attempt to log in to the device using the default password.",
  "id": "GHSA-f3qc-f3rx-3hrm",
  "modified": "2024-11-24T15:31:38Z",
  "published": "2024-11-11T09:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11067"
    },
    {
      "type": "WEB",
      "url": "https://www.bleepingcomputer.com/news/security/d-link-wont-fix-critical-bug-in-60-000-exposed-eol-modems"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/en/cp-139-8233-903d9-2.html"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-8226-0b07b-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-53082"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-29T06:15:23Z",
    "severity": "MODERATE"
  },
  "details": "An \u0027Arbitrary File Deletion\u0027 in Samsung DMS(Data Management Server) allows attackers to delete arbitrary files from unintended locations on the filesystem. Exploitation is restricted to specific, authorized private IP addresses.",
  "id": "GHSA-f463-v52q-mjh6",
  "modified": "2025-07-29T06:30:22Z",
  "published": "2025-07-29T06:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53082"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungda.com/securityUpdates.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-google-storage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.14.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-google-storage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.15.0"
            },
            {
              "fixed": "4.18.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.camel:camel-google-storage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.19.0"
            },
            {
              "fixed": "4.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-66907"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T21:55:10Z",
    "nvd_published_at": "2026-08-24T17:18:06Z",
    "severity": "HIGH"
  },
  "details": "Relative path traversal vulnerability in Apache Camel Google Storage component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0.\n\nThe camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when the downloadFileName option is set. That option is documented as a folder or a filename, and when its value contains no expression token the consumer builds the local destination by appending the object name to it: evaluateFileExpression sets the Exchange file-name header to the remote object name and evaluates downloadFileName + \"/${file:name}\". The ${file:name} token returns the file-name header verbatim, unlike ${file:onlyname}, which applies FileUtil.stripPath to it. The resulting string was passed directly to new File(result) and blob.downloadTo(file.toPath()) with no lexical normalization and no check that the destination stayed inside the configured directory. The object name is not route-controlled data: the consumer lists the bucket, iterates every returned blob and creates one exchange per object from blob.getBlobId().getName() verbatim, and the filter option that could restrict those names is not applied at all unless it has been explicitly set. Google Cloud Storage object names are opaque UTF-8 keys that the service stores and lists exactly as written, with no server-side canonicalization, and a forward slash is only a display convention for pseudo-directories, so a key containing parent-directory segments survives round-tripping intact. An object name containing such segments therefore resolved to a location outside the configured downloadFileName directory, letting anyone able to influence the names present in the consumed bucket cause Camel to create or overwrite a file at a location of their choosing, with the privileges of the Camel process. Depending on what the process can write to, overwriting a file outside the download directory can escalate beyond the loss of integrity of that file. The downloadFileName option is an ordinary consumer parameter and carries no security marker, so nothing signalled to users that its value was not being enforced as a containment boundary. The defect is consumer-only; the producer has no download-to-file sink. Camel\u0027s other file-download consumers - camel-file, camel-ftp, camel-smb, camel-mina-sftp, camel-azure-files and the Azure Storage download paths - already constrained their local downloads to the configured directory using a path-segment boundary check; camel-google-storage was the remaining object-store download sink not covered by that work.\n\nUsers are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, set the filter option to a regular expression that accepts only simple single-segment object names, so that any name carrying a path separator or a parent-directory segment is excluded before an exchange is created; note that no filtering whatsoever is applied when the option is left unset, and that the expression is matched against the whole object name. Alternatively, give downloadFileName an explicit expression that does not carry the remote path through, for example one built on ${file:onlyname} rather than the implicit ${file:name}, keeping in mind that a downloadFileName containing an expression is treated as route-author-controlled and is not covered by the containment check added in the fix. As defence in depth, treat the object names in any externally writable bucket as untrusted input and do not derive local filesystem paths from them.",
  "id": "GHSA-f78g-9385-qxqj",
  "modified": "2026-08-28T21:55:10Z",
  "published": "2026-08-24T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66907"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/25179"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/25180"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/25181"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/pull/25182"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/277ab7b7af9bd3beb789d458d54b00b704647191"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/4b9b4ade15148e1512b39f302075b36c7a092e86"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/commit/a6f73c6d2828fe2b76bf423bad92f98d80af7437"
    },
    {
      "type": "WEB",
      "url": "https://camel.apache.org/security/CVE-2026-66907.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/camel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/releases/tag/camel-4.14.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/releases/tag/camel-4.18.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/camel/releases/tag/camel-4.22.0"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/CAMEL-24279"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/08/24/11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-8209"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-09T04:16:28Z",
    "severity": "MODERATE"
  },
  "details": "Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges. Exploitation could result in loss of availability of the web application.",
  "id": "GHSA-f8qc-g9ff-p4m7",
  "modified": "2026-05-09T06:31:36Z",
  "published": "2026-05-09T06:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8209"
    },
    {
      "type": "WEB",
      "url": "https://github.com/GibbonEdu/core/releases/tag/v30.0.01"
    },
    {
      "type": "WEB",
      "url": "https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/#denial-of-service-via-path-traversal"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-0335"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-03T19:15:43Z",
    "severity": "HIGH"
  },
  "details": "\nABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may \nbe used by several Symphony Plus products (e.g., S+ Operations, S+ Engineering and S+ Analyst)\n\nThis issue affects Symphony Plus S+ Operations: from 3..0;0 through 3.3 SP1 RU4, from 2.1;0 through 2.1 SP2 RU3, from 2.0;0 through 2.0 SP6 TC6; Symphony Plus S+ Engineering: from 2.1 through 2.3 RU3; Symphony Plus S+ Analyst: from 7.0.0.0 through 7.2.0.2.\n\n",
  "id": "GHSA-f982-vxqp-wp2r",
  "modified": "2024-04-03T21:31:41Z",
  "published": "2024-04-03T21:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0335"
    },
    {
      "type": "WEB",
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=7PAA002536\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-0339"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-28T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass.This issue affects Access Management Web Policy Agent: through 5.10.1.",
  "id": "GHSA-f9v2-3453-rj68",
  "modified": "2023-03-09T21:30:19Z",
  "published": "2023-02-28T18:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0339"
    },
    {
      "type": "WEB",
      "url": "https://backstage.forgerock.com/downloads/browse/am/featured/web-agents"
    },
    {
      "type": "WEB",
      "url": "https://backstage.forgerock.com/knowledge/kb/article/a21576868"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}