https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:11:48 +0000 https://cve.radiocsirt.org/vuln/cve-2025-24907 <p><strong>Affected:</strong> Hitachi Vantara Pentaho Data Integration &amp; Analytics</p> <p>Overview</p> <p>The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize &#39;.../...//&#39; (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)</p> <p>Description</p> <p>Hitachi Vantara Pentaho Data Integration &amp; Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API.</p> <p>Impact</p> <p>This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.</p> <p><strong>Affected:</strong> Hitachi Vantara Pentaho Data Integration &amp; Analytics</p> <p>Overview</p> <p>The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize &#39;.../...//&#39; (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)</p> <p>Description</p> <p>Hitachi Vantara Pentaho Data Integration &amp; Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API.</p> <p>Impact</p> <p>This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.</p> https://cve.radiocsirt.org/vuln/cve-2025-24907