https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:37:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-231357 EUVD-2026-231357 https://cve.radiocsirt.org/vuln/euvd-2026-231357 https://cve.radiocsirt.org/vuln/fkie_cve-2025-24908 <p>Overview</p> <p>The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize &#39;.../...//&#39; (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)</p> <p>Description</p> <p>Hitachi Vantara Pentaho Data Integration &amp; Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service.</p> <p>Impact</p> <p>This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.</p> <p>Overview</p> <p>The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize &#39;.../...//&#39; (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)</p> <p>Description</p> <p>Hitachi Vantara Pentaho Data Integration &amp; Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service.</p> <p>Impact</p> <p>This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-24908 https://cve.radiocsirt.org/vuln/ghsa-485r-phmq-84vw <p>Overview</p> <p>The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize &#39;.../...//&#39; (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)</p> <p>Description</p> <p>Hitachi Vantara Pentaho Data Integration &amp; Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service.</p> <p>Impact</p> <p>This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.</p> <p>Overview</p> <p>The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize &#39;.../...//&#39; (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)</p> <p>Description</p> <p>Hitachi Vantara Pentaho Data Integration &amp; Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service.</p> <p>Impact</p> <p>This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.</p> https://cve.radiocsirt.org/vuln/ghsa-485r-phmq-84vw