https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 27 Oct 2026 07:02:16 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-236578 EUVD-2026-236578 https://cve.radiocsirt.org/vuln/euvd-2026-236578 https://cve.radiocsirt.org/vuln/fkie_cve-2021-45448 <p>Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user-supplied path to access resources that are out of bounds.</p> <p>The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.  By using special elements such as &#34;..&#34; and &#34;/&#34; separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system.</p> <p>Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user-supplied path to access resources that are out of bounds.</p> <p>The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.  By using special elements such as &#34;..&#34; and &#34;/&#34; separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-45448 https://cve.radiocsirt.org/vuln/ghsa-6rjj-325g-5j42 <p>Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user-supplied path to access resources that are out of bounds. The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. By using special elements such as &#34;..&#34; and &#34;/&#34; separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system.</p> <p>Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 using the Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user-supplied path to access resources that are out of bounds. The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. By using special elements such as &#34;..&#34; and &#34;/&#34; separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system.</p> https://cve.radiocsirt.org/vuln/ghsa-6rjj-325g-5j42 https://cve.radiocsirt.org/vuln/gsd-2021-45448 gsd-2021-45448 https://cve.radiocsirt.org/vuln/gsd-2021-45448