CVE Watch12 nov 2026

CVE-2026-117542

Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could by

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 12 nov 2026 · Última mod.: 12 nov 2026 · CWE-35

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or assign them to a download. This could expose file contents and remove source files from their original locations.

Referencias oficiales

www.jdownloads.comhttps://www.jdownloads.com/

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-397347.5 ALT

40.3%

——12Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.13d CVE-2026-1186338.1 ALT

48.9%

——15A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.7d CVE-2026-444159.1 CRÍ

41.7%

——13Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.28d CVE-2026-444146.8 MED

41.0%

22.0%

——7Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the URL to include a path traversal payload. Successful exploitation of this vulnerability could allow an attacker to access critical system files containing confidential information.36d CVE-2026-1056833.8 BAJ

24.6%

——7Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0.36d