Topic

Path Traversal: news, advisories and analysis

29 articlesUpdated 27 Oct 2026

CyberSecureToday covers Path Traversal across 29 articles published between 12 Sep 2026 and 27 Oct 2026. The coverage includes 29 vulnerability advisories. 29 advisories are rated critical or high severity, and 7 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Path Traversal most often intersect with CWE-22, Security Advisory and Remote Code Execution, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Google Path Traversal and Missing Authorization in cloud- Path Traversal Flaw Disclosed”, was published 27 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
Google Path Traversal and Missing Authorization in cloud- Path Traversal Flaw Disclosed
CVE-2026-93328 in Google Path Traversal and Missing Authorization in cloud- (Path Traversal) allows remote attackers to trigger arbitrary code execution. P
Aisha Noor27 Oct 202610 min read
ThreatsCloud & SaaSCritical
When a post is published, Postiz treats a media pa Path Traversal Flaw Disclosed
CVE-2026-115932 in When a post is published, Postiz treats a media pa (Path Traversal) allows remote attackers to trigger arbitrary code execution. Patch:
Aisha Noor25 Oct 202610 min read
ThreatsCloud & SaaSCritical
Azure Enterprise Services Path Traversal Flaw Disclosed
CVE-2026-70200 in Azure Enterprise Services (Path Traversal) allows remote attackers to trigger arbitrary code execution. Patch: Vendor security patch rele
Aisha Noor24 Oct 202610 min read
ThreatsCloud & SaaSHigh
Google Cloud Enterprise Services Path Traversal Flaw Disclosed
CVE-2026-79707 in Google Cloud Enterprise Services (Path Traversal) allows remote attackers to trigger arbitrary code execution. Patch: Version 1.21.0.
Aisha Noor19 Oct 202610 min read
ThreatsCloud & SaaSHigh
WhoDB Path Traversal Flaw Disclosed
CVE-2026-112005 in WhoDB (Path Traversal) allows remote attackers to trigger arbitrary code execution. Patch: Version 0.135.0 and later.
Aisha Noor19 Oct 202610 min read
ThreatsHealthcare & PharmaHigh
Thermo Fisher Torrent Suite Path Traversal Flaw Exposes Clinical Genomics Servers to File Exfiltration
A path traversal vulnerability in Thermo Fisher Torrent Suite Software (CVE-2026-107777) allows authenticated attackers to exfiltrate clinical genomics data.
CST Editorial Desk18 Oct 20269 min read
ThreatsCloud & SaaSCritical
QNAP Qsirch Path Traversal Flaw Disclosed
A path traversal vulnerability has been reported to affect Qsirch.
CST Editorial Desk16 Oct 20267 min read
ThreatsCloud & SaaSCritical
ONLYOFFICE Document Server Path Traversal Flaw Enables Remote Code Execution
ONLYOFFICE patches a critical path traversal vulnerability in Document Server DocService (CVE-2021-3199) allowing arbitrary file overwrite and remote code execution.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSCritical
Anthropic Model Context Protocol Server Flaw Enables Host Directory Traversal and Unauthenticated Tool Injection (CVE-2026-70114)
Anthropic issues advisory CVE-2026-70114 for the Model Context Protocol (MCP) filesystem server, patching a path traversal flaw that allowed tool-calling escapes.
CST Editorial Desk11 Oct 20268 min read
ThreatsCloud & SaaSCritical
Kiteworks Email Protection Gateway Flaw Lets Unauthenticated Attackers Run Code as Root
Kiteworks fixed a CVSS 10 root code-execution flaw in Email Protection Gateway (CVE-2026-54154) and three 9.8 account takeovers. Upgrade EPG and Core to 9.5.1.
Daniel Okafor4 Oct 20266 min read
ThreatsCloud & SaaSHigh
Office PowerPoint MCP Server Path Traversal Enables Indirect Prompt Injection File Overwrite (CVE-2025-71427)
A path traversal vulnerability in the Office-PowerPoint Model Context Protocol server allows AI agents to be manipulated via prompt injection into overwriting host files.
Priya Raman2 Oct 20268 min read
ThreatsCloud & SaaSCritical
Fortinet FortiMail Path Traversal Flaw Exploited for Unauthenticated Remote Code Execution
A critical zero-day flaw in Fortinet FortiMail secure email gateways allows unauthenticated remote attackers to write arbitrary files and execute code as root.
Priya Raman2 Oct 20269 min read
ThreatsCloud & SaaSHigh
LangChain Core Prompt Template Ingestion Flaw Exposes Host Systems to Path Traversal CVE-2026-34070
A high-severity path traversal vulnerability in langchain-core allows attackers processing untrusted prompt configurations to read arbitrary host filesystem data.
Daniel Okafor28 Sep 20268 min read
ThreatsIndustrial & OTHigh
Siemens SIMOVE Fleetmanager Path Traversal Flaw Exposes AGV Logistics Controls CVE-2026-67367
CISA Advisory ICSA-26-265-07 details a high-severity path traversal vulnerability in Siemens SIMOVE Fleetmanager allowing unauthenticated arbitrary file exfiltration.
Mei-Lin Chen28 Sep 20268 min read
ThreatsCloud & SaaSHigh
Atlassian Model Context Protocol Server Flaws Enable Unauthenticated Arbitrary File Exfiltration CVE-2026-77248
Critical authentication bypass and path traversal vulnerabilities in the Atlassian Model Context Protocol server allow unauthenticated attackers to read and exfiltrate host files.
Daniel Okafor27 Sep 20268 min read
ThreatsCloud & SaaSHigh
AWS Transform MCP Server Flaw Enables Arbitrary File Overwrites in Agent Workflows
AWS Security Bulletin 2026-075-AWS discloses critical path traversal flaw CVE-2026-18953 in aws-transform-mcp-server enabling unauthenticated arbitrary file overwrites.
Daniel Okafor26 Sep 202614 min read
ThreatsCloud & SaaSCritical
WordPress Core Template Traversal Flaw Weaponized for Remote Code Execution
WordPress releases emergency update 7.1.2 to patch critical path traversal flaw CVE-2026-87902 in get_page_template() weaponized in active web attacks.
Mei-Lin Chen26 Sep 202614 min read
ThreatsCloud & SaaSCritical
Dify Cross-Tenant Path Traversal Flaw Exposes Internal Plugin APIs to Unauthorized Access
A critical CVSS 9.4 path traversal flaw CVE-2026-41948 in Dify allows unauthenticated attackers to bypass workspace isolation and invoke internal Plugin Daemon APIs.
Priya Raman25 Sep 202617 min read
ThreatsCloud & SaaSCritical
WSO2 API Manager Path Traversal Flaw Weaponized to Extract Gateway Credentials
WSO2 patches critical path traversal flaw CVE-2026-5430 across API Manager and Gateway platforms, preventing unauthenticated remote extraction of master credentials.
Daniel Okafor25 Sep 202617 min read
ThreatsCloud & SaaSCritical
Check Point Security Management Server Path Traversal Exploited to Gain Root Access
Check Point and CISA confirm active in-the-wild exploitation of CVSS 9.8 flaw CVE-2026-93616 allowing unauthenticated attackers to write arbitrary files as root.
CST Editorial Desk23 Sep 202616 min read
ThreatsCloud & SaaSHigh
ORAS-Go Symlink Path Traversal Flaw Opens OCI Artifact Supply Chain to Compromise
A high-severity CVSS 8.8 path traversal vulnerability in oras-go allows malicious OCI container artifacts to escape extraction roots and execute arbitrary code.
CST Editorial Desk23 Sep 202616 min read
ThreatsCloud & SaaSHigh
CrewAI Multi-Agent Framework Flaw CVE-2026-37007 Allows Remote Code Execution via Path Traversal Tool Poisoning
Critical path traversal vulnerability CVE-2026-37007 in CrewAI FileWriterTool allows autonomous agents to be manipulated into executing arbitrary code on host systems.
Mei-Lin Chen22 Sep 202616 min read
ThreatsCloud & SaaSHigh
Amazon SSM Agent Path Traversal Flaw Enables Root Host Takeover via Malicious S3 Object Keys
AWS resolves high-severity CVSS 8.8 flaw CVE-2026-81849 in amazon-ssm-agent where crafted S3 object keys allow authenticated IAM actors to overwrite root host files.
Daniel Okafor20 Sep 202612 min read
ThreatsCloud & SaaSHigh
Azure Kubernetes Service Container Path Traversal Flaw Enables Node Escape and Code Execution
Microsoft patches high-severity vulnerability CVE-2026-32193 in Azure Kubernetes Service allowing container workloads to escape sandboxes via path traversal.
Priya Raman19 Sep 202611 min read