dotdotcoloncolon_bot (Atlassian edition)

https://infosec.exchange/@dotdotslash_bot

A bot that posts new directory traversal CVEs. Fame may be temporary but #directoryTraversalMemes are forever!

Posts are unlisted to avoid public timeline spamming.
I'll gladly take proposals for new templates.

Very much WIP right now

Operator: https://infosec.exchange/@nyanbinary
PFP based on: https://github.com/SymTrkl/emoji/tree/main/highres/neobot_code
Source (its bad): https://gitlab.com/malte.nyanbinary/dotdotslash_bot

Public Key

npub1dzwley4an6eeu2g0kpx26f7ky7rwgge33qrul506y8e7mllc6fjqtvmx4u

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsx380uj27eavu79y8mqn9dyltz0phyyvccsp7068azruldlludyeqprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyf8wumn8ghj7mmxve3ksctfdch8qatz0ylu4l

Publishing to

relay.momostr.pink

offchain.pub

relay.snort.social

Author Public Key

npub1dzwley4an6eeu2g0kpx26f7ky7rwgge33qrul506y8e7mllc6fjqtvmx4u

Show more details

Last Notes

2026-09-28 23:47:52 GMT

New directory traversal CVE!
CVE-2026-97730 - https://www.cve.org/CVERecord?id=CVE-2026-97730
Netgate - pfSense Plus
Netgate - pfSense CE
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/351/334/717/251/442/original/a63473967f14f5e3.mp4

2026-09-28 22:47:43 GMT

New directory traversal CVE!
CVE-2026-85185 - https://www.cve.org/CVERecord?id=CVE-2026-85185
Canonical - LXD
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/351/098/187/161/201/original/8176e853d5796d91.png

2026-09-28 17:47:50 GMT

New directory traversal CVE!
CVE-2026-96651 - https://www.cve.org/CVERecord?id=CVE-2026-96651
Plex - Media Server
Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/349/918/976/716/762/original/2aaf78439d82c57b.png

2026-09-18 15:49:20 GMT

New directory traversal CVE!
CVE-2025-14753 - https://www.cve.org/CVERecord?id=CVE-2025-14753
IBM - Cloud Pak for Data
IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/292/829/929/968/264/original/6a043106f148fce4.mp4

2026-08-31 18:48:50 GMT

New directory traversal CVE!
CVE-2026-79743 - https://www.cve.org/CVERecord?id=CVE-2026-79743
samanhappy - mcphub
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest is directly concatenated into a file path (line 107) without any sanitization or path traversal character validation. An attacker can craft a malicious MCPB file where manifest.name is set to something like ../../../etc/malicious, causing the file to be extracted to an arbitrary location on the file system. The cleanupOldMcpbServer function (line 110) also uses the unsanitized name, potentially allowing deletion of arbitrary directories. This issue has been patched in version 0.12.13.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/191/614/179/160/601/original/abe12390292afc97.png

2026-08-27 23:48:10 GMT

New directory traversal CVE!
CVE-2026-54083 - https://www.cve.org/CVERecord?id=CVE-2026-54083
wazuh - wazuh
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script builds a file path by concatenating the srcip field taken from alert JSON directly onto the fixed /ipblock/ base directory, without validating that the value is a well-formed IP address. Because the extraction routine returns the raw string unchecked, an attacker who can trigger alert-matching log events with a crafted srcip containing ../ sequences can escape the base directory. The block action opens the resulting path in append mode, creating an empty file at an arbitrary location, while the unblock action passes it to remove(), deleting an arbitrary file; since the active response daemon runs as root, this includes sensitive files such as system credentials and Wazuh configuration. Unlike the sibling scripts host-deny.c, default-firewall-drop.c, and firewalld-drop.c, which reject non-IP input via get_ip_version(), ip-customblock.c omits this validation. This issue is fixed in version 4.14.7.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/170/141/924/629/072/original/7841bd2617727344.mp4

2026-08-25 15:49:36 GMT

New directory traversal CVE!
CVE-2026-79781 - https://www.cve.org/CVERecord?id=CVE-2026-79781
rclone - rclone
rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/156/935/536/062/938/original/ba52d24b21f5cf15.mp4

2026-08-24 13:49:22 GMT

New directory traversal CVE!
CVE-2026-78381 - https://www.cve.org/CVERecord?id=CVE-2026-78381
ransomlook - ransomlook
RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that the resolved file remains within the intended directory.
Because the screen field is free-form and can be populated either through the administrative post editor or through data imported from a remote RansomLook instance, a malicious upstream instance can provide traversal sequences such as ../config/generic.json. When the affected post is subsequently retrieved through the API, RansomLook resolves and reads the attacker-controlled path and returns the contents of the referenced file Base64-encoded in the API response.
This can allow an attacker (being admin) controlling imported post data to read arbitrary files accessible to the RansomLook process, potentially exposing sensitive configuration data, API credentials, password hashes, or other application secrets. The attack does not require the malicious upstream to possess an account on the affected RansomLook instance.
The vulnerability is addressed by resolving screen paths with os.path.realpath() and verifying that the resolved path remains beneath the application's source/ directory. Validation is performed both when values are written and immediately before files are read. Using canonical paths also prevents traversal through symbolic links that would bypass purely lexical path normalization checks.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/150/800/419/810/506/original/e15dc43c1666d86e.mp4

2026-08-21 10:49:28 GMT

New directory traversal CVE!
CVE-2026-77751 - https://www.cve.org/CVERecord?id=CVE-2026-77751
misp - misp-stix
A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export.
MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template directory, the object name, and definition.json. An object name originating from untrusted STIX or MISP content was not sufficiently restricted before being used in this filesystem path.
An attacker able to supply a crafted object name containing path separators or traversal sequences such as ../ could therefore cause template resolution to escape the expected template directory and attempt to load a definition.json file from another location accessible to the process.
During STIX 2 import, an attacker-controlled x_misp_name from a custom STIX object could directly reach this template-resolution mechanism.
The issue could also become persistent. A malicious object name stored in a MISP event could later be processed again during STIX 2 export. Consequently, content originally introduced in one security context could trigger filesystem access later when the event is exported by a process operating with different or greater privileges.
If a suitable definition.json file exists outside the intended template directory, its contents may be interpreted as a MISP object template and fields from that file copied into the converted object. This can result in unintended disclosure of locally accessible data represented by the template file and modification of the resulting object's metadata or semantics.
The patches introduce strict validation of object-template names. Valid names are restricted to a single path component containing letters, digits, hyphens, or underscores. Names that do not meet these requirements are replaced with the generic unknown-template name before reaching PyMISP template resolution. The original rejected name is preserved in the object's comment and a warning is generated, preventing traversal while retaining the source information.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/133/106/114/377/826/original/99c354c379e6576f.png

2026-08-17 20:49:40 GMT

New directory traversal CVE!
CVE-2026-57233 - https://www.cve.org/CVERecord?id=CVE-2026-57233
notepad-plus-plus - notepad-plus-plus
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/112/816/980/267/499/original/c5a39c2a88265c99.mp4

2026-08-17 15:49:19 GMT

New directory traversal CVE!
CVE-2026-73851 - https://www.cve.org/CVERecord?id=CVE-2026-73851
microsoft - kiota
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/111/635/920/221/722/original/c706315930b66791.mp4

2026-08-11 20:48:53 GMT

New directory traversal CVE!
CVE-2026-63134 - https://www.cve.org/CVERecord?id=CVE-2026-63134
cisagov - Malcolm
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `../` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/078/840/013/890/994/original/9b81dd9ef2b4e6c1.png

2026-08-10 19:49:07 GMT

New directory traversal CVE!
CVE-2026-69112 - https://www.cve.org/CVERecord?id=CVE-2026-69112
huggingface - accelerate
Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/072/942/690/329/806/original/1992f17a4829a8fe.png

2026-08-07 00:49:05 GMT

New directory traversal CVE!
CVE-2026-59115 - https://www.cve.org/CVERecord?id=CVE-2026-59115
Microsoft - Microsoft Entra Provisioning Service
'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/051/472/974/150/938/original/77bd8d159ea92984.png

2026-08-05 20:49:16 GMT

New directory traversal CVE!
CVE-2026-71309 - https://www.cve.org/CVERecord?id=CVE-2026-71309
rclone - rclone
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/044/867/641/000/776/original/75d0bddef9f6f977.mp4

2026-08-04 01:49:06 GMT

New directory traversal CVE!
CVE-2026-56845 - https://www.cve.org/CVERecord?id=CVE-2026-56845
Rocket.Chat - Rocket.Chat
An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/034/722/048/780/208/original/996d8d92839a8725.png

2026-08-01 12:48:28 GMT

New directory traversal CVE!
CVE-2026-67309 - https://www.cve.org/CVERecord?id=CVE-2026-67309
traefik - traefik
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ingress.kubernetes.io/rewrite-target annotation). When an Ingress path uses a regex that captures attacker-controlled text without requiring a path separator (e.g., path /api(.*) with rewrite target /$1), a crafted request such as /api../admin matches the public router, is rewritten to a dot-segment traversal path (/../admin), and is forwarded without post-replacement normalization validation. A backend that normalizes dot segments resolves the path to a protected endpoint (e.g., /admin) reachable only through a separate router secured with BasicAuth, DigestAuth, or ForwardAuth, resulting in route-level authentication bypass. The issue is fixed in v3.7.8.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/020/327/833/585/666/original/0676d63107f3e568.png

2026-07-30 15:48:39 GMT

New directory traversal CVE!
CVE-2026-15435
IBM - App Connect Enterprise
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/009/711/705/765/044/original/a8f7353ae86ab4f0.mp4

2026-07-23 18:48:54 GMT

New directory traversal CVE!
CVE-2026-65920
huggingface - diffusers
Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/970/784/291/440/541/original/5567a4f5ec303dee.mp4

2026-07-23 17:48:11 GMT

New directory traversal CVE!
CVE-2026-65695
GongRzhe - Office-Word-MCP-Server
Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute paths or ../ traversal sequences directly to document open and save operations, bypassing the check_file_writeable and ensure_docx_extension helpers which perform no base-directory confinement or realpath validation.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/970/545/586/409/956/original/42494290eb224b6a.png

2026-07-22 11:48:47 GMT

New directory traversal CVE!
CVE-2026-65600
traefik - traefik
Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/963/470/063/889/720/original/9240493561e276f3.png

2026-07-17 20:48:44 GMT

New directory traversal CVE!
CVE-2026-7667
IBM - Langflow OSS
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header (e.g., filename="../../../target/path" ), enabling arbitrary file write operations with attacker-controlled content to any path accessible by the Langflow process.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/937/281/658/475/850/original/84a3dde26f83556f.mp4

2026-06-29 09:02:36 GMT

New directory traversal CVE!
CVE-2026-45390
n/a - n/a
In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. This is not desired behavior, and tar(1) rejects such extractions, but ocaml-tar decompresses it anyway. The impact is that it allows arbitrary file writes outside of the desired extraction directory (to an attacker that can reach a tar decompression endpoint).
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/832/583/447/869/268/original/abfbc77dab852ea9.png

2026-06-19 06:47:53 GMT

New directory traversal CVE!
CVE-2026-54414
error311 - FileRise
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename() and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %). The raw filename is then passed to UploadModel::handleUpload, where it is reconstructed as trim(urldecode(basename($fileName))), re-introducing path separators after validation (e.g. ..%2fusers%2fusers.txt becomes ../users/users.txt). UploadNamePolicy::isAllowedForWrite() applies basename() internally and therefore only evaluates the final component (users.txt), allowing the traversal sequence to pass the extension policy. The destination path is then used directly in move_uploaded_file() with no realpath containment check, allowing a write outside the intended upload directory. An attacker who possesses a valid, non-expired, upload-enabled shared-folder link/token (which are designed to be shared publicly) can overwrite users/users.txt to create an administrator account, resulting in unauthenticated admin takeover and, depending on configuration, remote code execution. Exploitation requires possession of a valid, non-expired, upload-enabled shared-folder link/token. This issue is fixed in 3.16.0, which URL-decodes before validation and rejects any path separators in the upload filename.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/775/430/641/205/200/original/0207056fe99c5d25.png

2026-06-10 13:49:23 GMT

New directory traversal CVE!
CVE-2026-52752
nationalsecurityagency - ghidra
Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious extensions with traversal sequences like ../ in filenames to write arbitrary files outside the intended directory, enabling code execution.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/726/127/234/815/519/original/a3f5de278f2c0ea6.png

2026-06-01 14:47:35 GMT

New directory traversal CVE!
CVE-2026-44885
portainer - portainer
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, Portainer's backup restore feature accepts a .tar.gz archive and extracts it to a target directory on the server. The extraction function (ExtractTarGz in api/archive/targz.go) constructed output paths using filepath.Clean(filepath.Join(outputDirPath, header.Name)). This combination does not prevent directory traversal — a tar entry named ../../etc/cron.d/evil resolves to a path outside the extraction root, so a crafted archive can write files to arbitrary locations on the server filesystem. This vulnerability is fixed in 2.33.8.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/675/395/301/548/097/original/01f17aff3bccc2d1.mp4

2026-05-18 19:45:37 GMT

New bot just dropped! :foxDance:
This bot checks CVE descriptions for the string `../`[1] & posts any new here.
Posts contain one CVE as well as the description & some (sometimes vendor-themed) #directorytraversalmemes . Posts are at most hourly & unlisted, working through the backlog as required. Expect about 1-2 posts per day on average.
@npub1t9q…r0p6 will gladly accept new memes (generic or vendor specific).
[1]: "But nyan, why don't you use CWE-22 and children": Because thats >800 this year so far & this is a shitpost bot, not actual threat intel, you want to go to #GAYINT for that. The bot repo contains a "library" including a function to filter for these if you actually care.

2026-05-18 13:38:50 GMT

New directory traversal CVE!
CVE-2026-7302
SGLang - SGLang
SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/595/853/234/944/298/original/e54d685ff6d87c5e.png