Topic

CWE-22: news, advisories and analysis

9 articlesUpdated 14 Oct 2026

CyberSecureToday covers CWE-22 across 9 articles published between 17 Sep 2026 and 14 Oct 2026. The coverage includes 9 vulnerability advisories. 9 advisories are rated critical or high severity, and 3 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on CWE-22 most often intersect with Path Traversal, Remote Code Execution and Zero-Day, with Technology, Cloud & SaaS the most affected sector. The most recent story, “ONLYOFFICE Document Server Path Traversal Flaw Enables Remote Code Execution”, was published 14 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
ONLYOFFICE Document Server Path Traversal Flaw Enables Remote Code Execution
ONLYOFFICE patches a critical path traversal vulnerability in Document Server DocService (CVE-2021-3199) allowing arbitrary file overwrite and remote code execution.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSHigh
Office PowerPoint MCP Server Path Traversal Enables Indirect Prompt Injection File Overwrite (CVE-2025-71427)
A path traversal vulnerability in the Office-PowerPoint Model Context Protocol server allows AI agents to be manipulated via prompt injection into overwriting host files.
Priya Raman2 Oct 20268 min read
ThreatsCloud & SaaSCritical
Fortinet FortiMail Path Traversal Flaw Exploited for Unauthenticated Remote Code Execution
A critical zero-day flaw in Fortinet FortiMail secure email gateways allows unauthenticated remote attackers to write arbitrary files and execute code as root.
Priya Raman2 Oct 20269 min read
ThreatsCloud & SaaSHigh
LangChain Core Prompt Template Ingestion Flaw Exposes Host Systems to Path Traversal CVE-2026-34070
A high-severity path traversal vulnerability in langchain-core allows attackers processing untrusted prompt configurations to read arbitrary host filesystem data.
Daniel Okafor28 Sep 20268 min read
ThreatsCloud & SaaSCritical
Dify Cross-Tenant Path Traversal Flaw Exposes Internal Plugin APIs to Unauthorized Access
A critical CVSS 9.4 path traversal flaw CVE-2026-41948 in Dify allows unauthenticated attackers to bypass workspace isolation and invoke internal Plugin Daemon APIs.
Priya Raman25 Sep 202617 min read
ThreatsCloud & SaaSCritical
WSO2 API Manager Path Traversal Flaw Weaponized to Extract Gateway Credentials
WSO2 patches critical path traversal flaw CVE-2026-5430 across API Manager and Gateway platforms, preventing unauthenticated remote extraction of master credentials.
Daniel Okafor25 Sep 202617 min read
ThreatsCloud & SaaSCritical
Check Point Security Management Server Path Traversal Exploited to Gain Root Access
Check Point and CISA confirm active in-the-wild exploitation of CVSS 9.8 flaw CVE-2026-93616 allowing unauthenticated attackers to write arbitrary files as root.
CST Editorial Desk23 Sep 202616 min read
ThreatsCloud & SaaSHigh
ORAS-Go Symlink Path Traversal Flaw Opens OCI Artifact Supply Chain to Compromise
A high-severity CVSS 8.8 path traversal vulnerability in oras-go allows malicious OCI container artifacts to escape extraction roots and execute arbitrary code.
CST Editorial Desk23 Sep 202616 min read
ThreatsCloud & SaaSCritical
Adobe ColdFusion Critical Path Traversal Flaw CVE-2026-48282 Exploited in Active Attacks
CISA incorporates Adobe ColdFusion path traversal vulnerability CVE-2026-48282 (CVSS 9.8) into KEV catalog following active exploitation against enterprise application servers.
Mei-Lin Chen17 Sep 202614 min read