Philips Hue Bridge Pro argument injection allows restricted file writes
ZDI rates CVE-2026-118631 at CVSS 3.8 and requires low-privileged code inside a container first.
Stories per day · 30 days
Relatedactive-storage1apache-camel1argument-injection1camel-docling1hue-bridge1imagemagick1path-traversal1philips1rails1zdi1
5 stories, newest first · one card per story
Stories tagged #file-write
Rails flaw lets attackers write files via ImageMagick uploads
Ruby on Rails Active Storage before 8.1.4.1 and 8.0.5.2 allows arbitrary file write and read of secrets via crafted uploads processed by ImageMagick.
2
Camel Docling output path header allows arbitrary writes (CVE-2026-95629)
A low-privileged caller can steer conversion output to an arbitrary directory through an unvalidated header.
CVE-2026-93995: Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server
Authenticated users can make Apache MINA SSHD sshd-git write a server file via a JGit archive command.
[webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution
A path traversal to remote code execution exploit for Langflow 1.8.4, a popular LLM application builder, was published on Exploit-DB.