CVE-2026-66381
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
CVSS
5.3
Medio
EPSS
0.3%
p22
KEV
—
Exploit Today
7
0-100
Publicado: 12 ago 2026 · Última mod.: 2 sept 2026 · CWE-22
0.3%EPSS · 30 días0.3%
2026-08-132026-09-07
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-870308.5 ALT—
———Tanium addressed a path traversal vulnerability in Comply.5hCVE-2026-870238.5 ALT—
———Tanium addressed a path traversal vulnerability in Comply.5hCVE-2026-145056.6 MED—
———Tanium addressed a path traversal vulnerability in Tanium Data Service.5hCVE-2026-535819.0 CRÍ—
———OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue.9hCVE-2026-86995——
———n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote from that configuration instead of the checked parameter. An authenticated workflow editor could therefore point Git at any local repository readable by the n8n process and receive its contents through packages/nodes-base/nodes/Git/GenericFunctions.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.10hCVE-2026-86079——
———n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.10h