https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:29:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-229327 EUVD-2026-229327 https://cve.radiocsirt.org/vuln/euvd-2026-229327 https://cve.radiocsirt.org/vuln/fkie_cve-2022-46171 <p>Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.</p> <p>Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-46171 https://cve.radiocsirt.org/vuln/ghsa-6mv3-wm7j-h4w5 <p><strong>Affected:</strong> crates.io: tauri</p> <p>### Impact</p> <p>The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths.</p> <p>Example: The `fs` scope `$HOME/*.key` would also allow `$HOME/.ssh/secret.key` to be read even though it is in a sub directory of `$HOME` and is inside a hidden folder.</p> <p>Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected.</p> <p>### Patches</p> <p>The issue has been patched in the latest release and was backported into the currently supported 1.x branches.</p> <p>### Workarounds</p> <p>No workaround is known at the time of publication.</p> <p>### References</p> <p>The original report contained information that the `dialog.open` component automatically allows one sub directory to be read, regardless of the `recursive` option.</p> <p>Imagine a file system looking like ``` o ../ o documents/ - file.txt - deeper/ o deep_file.txt ```</p> <p>Reproduction steps:</p> <p>1. Trying to load “file.txt” or “deep_file.txt” doesn’t work. Expected 2. Select “documents” as folder to open(ie. with window.__TAURI__.dialog.open) 3. Trying to load “file.txt” works. Expected 5. Trying to load “deep_file.txt” also works, which isn’t expected</p> <p>The recursive flag is used in https://github.com/tauri-apps/tauri/blob/cd8c074ae6592303d3f6844a4fb6d262eae913b2/core/tauri/src/scope/fs.rs#L154 to scope the filesystem access to either files in the folder or to also include sub director…</p> <p><strong>Affected:</strong> crates.io: tauri</p> <p>### Impact</p> <p>The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths.</p> <p>Example: The `fs` scope `$HOME/*.key` would also allow `$HOME/.ssh/secret.key` to be read even though it is in a sub directory of `$HOME` and is inside a hidden folder.</p> <p>Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected.</p> <p>### Patches</p> <p>The issue has been patched in the latest release and was backported into the currently supported 1.x branches.</p> <p>### Workarounds</p> <p>No workaround is known at the time of publication.</p> <p>### References</p> <p>The original report contained information that the `dialog.open` component automatically allows one sub directory to be read, regardless of the `recursive` option.</p> <p>Imagine a file system looking like ``` o ../ o documents/ - file.txt - deeper/ o deep_file.txt ```</p> <p>Reproduction steps:</p> <p>1. Trying to load “file.txt” or “deep_file.txt” doesn’t work. Expected 2. Select “documents” as folder to open(ie. with window.__TAURI__.dialog.open) 3. Trying to load “file.txt” works. Expected 5. Trying to load “deep_file.txt” also works, which isn’t expected</p> <p>The recursive flag is used in https://github.com/tauri-apps/tauri/blob/cd8c074ae6592303d3f6844a4fb6d262eae913b2/core/tauri/src/scope/fs.rs#L154 to scope the filesystem access to either files in the folder or to also include sub director…</p> https://cve.radiocsirt.org/vuln/ghsa-6mv3-wm7j-h4w5 https://cve.radiocsirt.org/vuln/gsd-2022-46171 gsd-2022-46171 https://cve.radiocsirt.org/vuln/gsd-2022-46171