Rails Active Storage before 8.0.5.2 and 8.1.4.1 can read and write files
The November 5 advisory covers image-analysis file access and points to rails releases 8.0.5.2 and 8.1.4.1.
Stories per day · 30 days
1 RSS
Relatedcisa2cisco2kev2secure-email-gateway2active-storage1amp1asyncos1cve-2026-765191directory-traversal1email-security1image-analysis1mailemail1plex1remote-code-execution1ruby-on-rails1
14 stories, newest first · one card per story
Stories tagged #arbitrary-file-write
MailEnable arbitrary file creation vulnerability
ZDI-26-869 CVSS 7.4 lets remote attackers create arbitrary files on MailEnable without authentication.
CISA adds Plex arbitrary file-write flaw to KEV (CVE-2026-96656)
An admin can write files that load as unsigned .so modules on Plex before 1.43.3.10861; due date is October 23.
Cisco security advisory (AV26-1042) – Update 1
Cisco says CVE-2026-76519 in Secure Email Gateway is exploited and now on CISA’s KEV list.
2
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
Cisco Secure Email Gateway flaw lets unauthenticated attackers write files and run root commands via crafted attachments.
Fortinet FortiMail Path Traversal Flaw Actively Exploited to Compromise Servers
Attackers are exploiting critical FortiMail path-traversal CVE-2026-104286 to write files and compromise email appliances.
Improper limitation of a pathname to a restricted directory
Fortinet warns of a CVSS 9.8 path traversal that lets unauthenticated attackers write arbitrary files, with in-the-wild exploitation reported.
2
[webapps] TigerGraph_Community_Edition 4.2.4 - arbitrary file write
Exploit-DB lists an arbitrary file-write flaw in TigerGraph Community Edition 4.2.4.
[NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Directory
Input Leap 3.0.3 path traversal lets a connected peer write files outside the drop directory.
HPE Networking ALE Flaws Let Hackers Bypass Security Controls and Compromise Systems
HPE fixed critical unauthenticated flaws in Networking ALE that enable credential abuse and arbitrary file writes.
[NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Directory
Input Leap 3.0.3 lets a connected peer write files outside the drag-and-drop directory via path traversal.
[0day-rubbish] TigerGraph Community Edition 4.2.4 Default credentials plus GSQL TO_CSV arbitrary file write to SSH code execution (9.8)
TigerGraph Community Edition 4.2.4 default credentials and GSQL file write enable unauthenticated SSH command execution.
USN-8766-1: Suricata-Update vulnerability
Ubuntu patches Suricata-Update path validation flaw allowing arbitrary file writes outside the rules directory from malicious rule archives.
[webapps] flyto-core 2.26.7 - Arbitrary File Write
flyto-core 2.26.7 has an arbitrary file write vulnerability with a public proof-of-concept exploit on Exploit-DB.