https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T17:55:00.057485+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-231407 EUVD-2026-231407 2026-10-05T17:55:00.105461+00:00 EUVD-2026-231407 https://cve.radiocsirt.org/vuln/fkie_cve-2025-24907 fkie_cve-2025-24907 2026-10-05T17:55:00.105514+00:00

Overview

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API.

Impact

This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

 https://cve.radiocsirt.org/vuln/ghsa-2fg7-5jv3-82cc GHSA-2fg7-5jv3-82cc 2026-10-05T17:55:00.105592+00:00

Overview

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API.

Impact

This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.