CVE-2026-107331
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-p
CVSS
9.9
Critical
EPSS
0.5%
p43
KEV
—
Exploit Today
13
0-100
Published: Nov 8, 2026 · Last modified: Nov 8, 2026 · CWE-36
Not enough EPSS history yet.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1253906.5 MED—
———Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials.12hCVE-2026-1236196.8 MED40.7%
——12Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.4dCVE-2026-1166356.1 MED24.4%
——7Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.
To remediate this issue, users should upgrade to version v0.2.1.4dCVE-2026-1186934.7 MED3.5%
——1CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.7dCVE-2026-837848.8 HIG65.4%
——20Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.12dCVE-2026-837468.1 HIG67.0%
——20Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.28d