CVE-2023-32778
An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload.
CVSS
3.3
Low
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Sep 14, 2026 · Last modified: Sep 14, 2026 · CWE-23
Not enough EPSS history yet.
An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-458588.6 HIG—
———A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.2hCVE-2023-407724.3 MED—
———A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.2hCVE-2023-293776.6 MED—
———An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects.3hCVE-2026-890657.1 HIG4.1%
——1Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis.
To remediate this issue, users should upgrade to version 0.101.37. The corrected containment check is automatically applied by the projen runtime next time you run it.3dCVE-2026-849399.1 CRI55.5%
——17Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled).
This issue affects Apache FreeMarker from 2.2.0 through 2.3.34.
Users are recommended to upgrade to version 2.3.35. Disabling localized lookup in previous versions also mitigates this.
Note that even in versions affected by this vulnerability, the files that can be loaded remain restricted by the TemplateLoader that FreeMarker is configured to use. In particular, FileTemplateLoader prevents attempts to traverse outside the baseDir specified in its constructor. Other TemplateLoader implementations may allow access outside their designated base directory, but they are still constrained by the underlying storage mechanism—for example, a loader wrapping a Java class loader can only access resources that the class loader can load, while one wrapping a web application context can only access resources available through that context.3dCVE-2026-159137.7 HIG32.8%
——10In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.4d