Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read
Searchlight Cyber showed a patched Discourse upload chain letting basic users read server files via ImageMagick.
5
Stories per day · 30 days
2 RSS
12 stories, newest first · one card per story
Stories tagged #file-read
Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
Attackers probed critical Atlassian CVE-2026-21589 within hours of a public PoC, with 190 honeypot attempts.
5
PoC Exploit Released for Critical Atlassian Flaw That Can Lead to Jira Admin Access
watchTowr released a detection PoC for unauthenticated Atlassian file-read CVE-2026-21589 that can yield Jira admin access.
6
Add GitLab WorkHorse File Read Auxiliary Module (CVE-2026-85706)
Metasploit adds a new module to exploit CVE-2026-85706, a file read vulnerability in GitLab WorkHorse.
Mass Scanning Targets Exposed Vite Servers to Steal AWS Keys and Azure Tokens
Attackers mass-scanned exposed Vite dev servers exploiting CVE-2026-39364 to read .env files and steal AWS keys and Azure tokens, per F5 Labs honeynet data.
GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read – Exploited Within 24 Hours
GitLab path traversal CVE-2026-85706 (CVSS 10.0) was actively probed and exploited within 24 hours of disclosure and added to CISA's KEV catalog.
10
Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM
Unpatched Windows Defender zero-day 'ShieldCrash' PoC lets local attackers read arbitrary files as SYSTEM, apparently bypassing the CVE-2026-69414 patch.
Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read
Flextype CMS v1.0.0-alpha.3's stored filesystem shortcode allows arbitrary file reads because paths are not restricted to an approved directory.
KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)
Critical CVE-2026-66066 in Rails' Active Storage/libvips allows unauthenticated arbitrary file read and possible RCE; active exploitation now observed.
5
Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
CERT/CC disclosed unpatched Kaltura mwEmbed flaws CVE-2026-19913 and CVE-2026-19912 allowing unauthenticated file reads and remote code execution.
2
[webapps] Nodemailer 9.0.0 - File Read/ SSRF
A public proof-of-concept demonstrates arbitrary file read and SSRF in Nodemailer 9.0.0.
[webapps] Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF
Exploit demonstrates arbitrary file read via SSRF in Planyo Online Reservation System 3.0.