CWE-22

{
  "affected": [],
  "aliases": [
    "CVE-2008-0981"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-02-25T23:44:00Z",
    "severity": "MODERATE"
  },
  "details": "Open redirect vulnerability in spyce/examples/redirect.spy in Spyce - Python Server Pages (PSP) 2.1.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.",
  "id": "GHSA-4pxf-c3wq-87j3",
  "modified": "2022-05-01T23:35:30Z",
  "published": "2022-05-01T23:35:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-0981"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/3699"
    },
    {
      "type": "WEB",
      "url": "http://www.procheckup.com/Vulnerability_PR08-01.php"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/488336/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/27898"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-7179"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-27T23:16:03Z",
    "severity": "MODERATE"
  },
  "details": "A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function read_null_terminated_string of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. Such manipulation of the argument self.file_name leads to path traversal. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project maintainer confirms this issue: \"I accept the existence of the Path Traversal vulnerability. However, as stated in the Github link, it reached EOL and as a result no actions should be expected.\" The GitHub repository mentions, that \"[u]sers and contributors should migrate to binwalk v3.\" This vulnerability only affects products that are no longer supported by the maintainer.",
  "id": "GHSA-4q2j-jrvf-pc8h",
  "modified": "2026-04-28T00:31:40Z",
  "published": "2026-04-28T00:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7179"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/binwalk_path_traversal.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/802228"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359781"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/359781/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-31564"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-11T01:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The woduq1414/munhak-moa repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.",
  "id": "GHSA-4q38-756g-c8c9",
  "modified": "2022-07-16T00:00:31Z",
  "published": "2022-07-12T00:00:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31564"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/securitylab/issues/669#issuecomment-1117265726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/woduq1414/munhak-moa/commit/e8f800373b20cb22de70c7a994325b8903877da0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "gradio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-47868"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-10T22:03:03Z",
    "nvd_published_at": "2024-10-10T23:15:02Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n**What kind of vulnerability is it? Who is impacted?**\n\nThis is a **data validation vulnerability** affecting several Gradio components, which allows arbitrary file leaks through the post-processing step. Attackers can exploit these components by crafting requests that bypass expected input constraints. This issue could lead to sensitive files being exposed to unauthorized users, especially when combined with other vulnerabilities, such as issue TOB-GRADIO-15. The components most at risk are those that return or handle file data.\n\n### Vulnerable Components:\n1. **String to FileData:** DownloadButton, Audio, ImageEditor, Video, Model3D, File, UploadButton.\n2. **Complex data to FileData:** Chatbot, MultimodalTextbox.\n3. **Direct file read in preprocess:** Code.\n4. **Dictionary converted to FileData:** ParamViewer, Dataset.\n\n### Exploit Scenarios:\n1. A developer creates a Dropdown list that passes values to a DownloadButton. An attacker bypasses the allowed inputs, sends an arbitrary file path (like `/etc/passwd`), and downloads sensitive files.\n2. An attacker crafts a malicious payload in a ParamViewer component, leaking sensitive files from a server through the arbitrary file leak.\n\n### Patches\nYes, the issue has been resolved in `gradio\u003e5.0`. Upgrading to the latest version will mitigate this vulnerability.\n",
  "id": "GHSA-4q3c-cj7g-jcwf",
  "modified": "2025-01-21T17:18:26Z",
  "published": "2024-10-10T22:03:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-4q3c-cj7g-jcwf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47868"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gradio-app/gradio"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2024-217.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Gradio has several components with post-process steps allow arbitrary file leaks"
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-3460"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-05-20T11:13:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in Agent Manager in NetIQ Sentinel allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted pathname.",
  "id": "GHSA-4q3p-88gf-8qmr",
  "modified": "2025-04-12T12:33:53Z",
  "published": "2022-05-13T01:10:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3460"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58635"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/support/kb/doc.php?id=7015183"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/67487"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1030434"
    },
    {
      "type": "WEB",
      "url": "http://zerodayinitiative.com/advisories/ZDI-14-134"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2011-2653"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-12-08T11:55:00Z",
    "severity": "HIGH"
  },
  "details": "Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute arbitrary code by uploading an executable file.",
  "id": "GHSA-4q43-8hqg-w3px",
  "modified": "2025-04-11T03:53:18Z",
  "published": "2022-05-17T05:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2653"
    },
    {
      "type": "WEB",
      "url": "http://download.novell.com/Download?buildid=hPvHtXeNmCU~"
    },
    {
      "type": "WEB",
      "url": "http://zerodayinitiative.com/advisories/ZDI-11-342"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-31202"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-17T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The export function in SoftGuard Web (SGW) before 5.1.5 allows directory traversal to read an arbitrary local file via export or man.tcl.",
  "id": "GHSA-4q46-j5rr-3wvw",
  "modified": "2022-07-22T00:00:32Z",
  "published": "2022-07-18T00:00:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31202"
    },
    {
      "type": "WEB",
      "url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-softguard-network-management-extension-snmp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "compliance-trestle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.12.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "compliance-trestle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-36",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-28T17:44:03Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "**Relevant Products/Components:**\n\n* `trestle/core/commands/author/jinja.py`\n* `trestle author jinja`\n\n---\n\n## Detailed Description:\n\nThe `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace.\n\nThe application does not properly validate:\n\n* `../`\n* `..\\`\n* absolute paths\n\nThis allows arbitrary file write to attacker-controlled locations.\n\nVulnerable code:\n\n```python\noutput_file = trestle_root / r_output_file\n```\n\nAn attacker can overwrite files such as:\n\n* `.github/workflows/*.yml`\n* `.git/hooks/*`\n* user writable config files\n\nThis can lead to CI/CD compromise or local code execution.\n\n---\n\n## Steps To Reproduce:\n\n1. Clone the repository:\n\n```bash\ngit clone https://github.com/oscal-compass/compliance-trestle.git\ncd compliance-trestle\n```\n\n2. Create template:\n\n```bash\necho \"hello\" \u003e template.j2\n```\n\n3. Run:\n\n```powershell\ntrestle author jinja -i template.j2 -o \"subdir\\..\\..\\..\\..\\..\\poc.txt\"\n```\n\n4. Observe:\n\n```powershell\ndir E:\\poc.txt\n```\n\nThe file is written outside the repository workspace.\n\n---\n\n## Browsers Verified In:\n\nNot browser related.\n\nTested on:\n\n* Windows 11\n* Python 3.13\n\n---\n\n## Supporting Material/References:\n\nAffected file:\n\n```text\ntrestle/core/commands/author/jinja.py\n```\n\nSuccessfully verified:\n\n* directory traversal using `../`\n* Windows traversal using `..\\`\n* arbitrary file write outside workspace\n\n---\n\n## Access Vector Required for Exploitation:\n\nLocal\n\n---\n\n## Vulnerability Exists in Default Configuration?:\n\nYes\n\n---\n\n## Is the exploitation trivial or does it involve a multi-step process that may depend on user/victim interaction?:\n\nTrivial.\nSingle command execution.\n\n---\n\n## Exploitation Requires Authentication?:\n\nNo\n\n---\n\n## Under what privileges does the vulnerable service or component run?:\n\nRuns with privileges of the user executing the `trestle` command.\n\n## Impact\n\nAn attacker can write files outside the intended workspace directory and overwrite sensitive files writable by the current user.\n\nPossible impacts include:\n\n* overwriting `.github/workflows/*.yml` to execute attacker-controlled GitHub Actions workflows\n* overwriting `.git/hooks/*` for local code execution\n* modifying user configuration files such as `.bashrc`\n* tampering with repository files and generated compliance artifacts\n\nIn CI/CD environments, this may result in execution of attacker-controlled commands on build runners.",
  "id": "GHSA-4q5v-7g7x-j79w",
  "modified": "2026-05-28T17:44:03Z",
  "published": "2026-05-28T17:44:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-4q5v-7g7x-j79w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oscal-compass/compliance-trestle/commit/247fcce289f60103f3d8e28d8ec51a6986b94fb6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oscal-compass/compliance-trestle/commit/7d107b3ac53caca7bde97a6278b23cd739d94525"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oscal-compass/compliance-trestle"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "compliance-trestle - jinja has an Arbitrary File Write via Path Traversal"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-69095"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-03T14:16:30Z",
    "severity": "HIGH"
  },
  "details": "OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process.",
  "id": "GHSA-4q7q-8m76-5rv8",
  "modified": "2026-08-03T15:32:49Z",
  "published": "2026-08-03T15:32:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69095"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openwrt-luci-app-bmx7-path-traversal-via-bmx7-info"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-23772"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-30T14:15:14Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. An Arbitrary file create vulnerability exists in the KSchedulerSvc.exe, KUserAlert.exe, and Runkbot.exe components. This allows local attackers to create any file of their choice with NT Authority\\SYSTEM privileges.",
  "id": "GHSA-4q93-6p46-6x3h",
  "modified": "2024-08-10T00:30:54Z",
  "published": "2024-04-30T15:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23772"
    },
    {
      "type": "WEB",
      "url": "https://support.quest.com/kb/4375402/quest-response-to-kace-sma-agent-vulnerabilities-cve-2024-23772-cve-2024-23773-cve-2024-23774"
    },
    {
      "type": "WEB",
      "url": "https://www.quest.com/kace"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}