Loading story…
Multiple newly disclosed vulnerabilities exposed arbitrary file write paths through symlink handling and path validation failures in developer and server-side software. In Crawl4AI before 0.8.8, CVE-2026-56258 affects screenshot and PDF endpoints by combining weak output_path validation, symlink following, and a TOCTOU race, allowing unauthenticated remote attackers to write files outside the intended directory and potentially reach code execution. In Cursor Desktop before 3.0, CVE-2026-50549 lets a malicious agent escape the workspace sandbox by forcing path canonicalization to fail and then abusing an in-workspace symlink to write arbitrary files under the user’s privileges, including paths that could enable later unsandboxed execution.
A related pattern also appeared in archive extraction and privileged upload handling. The extract-zip package is affected by CVE-2026-56876, which fails to validate symlink targets inside ZIP archives, enabling path traversal outside the extraction directory and possible arbitrary file read or write when processing untrusted archives. Separately, pwnlift disclosed CVE-2026-56815 in a privileged upload handler that could be abused for arbitrary file write as root through direct symlink following and a TOCTOU race; an initial fix was bypassable before a follow-up patch was merged, while one downstream deployment mitigated exposure by removing the privileged sudo entry. Together, the disclosures highlight recurring risk from incomplete path canonicalization, unsafe symlink handling, and containment checks in file-write workflows.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-56876 was published for the extract-zip package, describing improper validation of symlink targets during ZIP extraction that can enable path traversal outside the extraction directory. The flaw may allow arbitrary file read or write depending on how the package is used.
CVE-2026-50549 was published for Cursor Desktop, detailing a sandbox escape caused by symlink abuse and failed path canonicalization during agent writes. The issue affects versions prior to 3.0 and was fixed in Cursor version 3.0.
MITRE assigned CVE-2026-56815 to the pwnlift privileged upload handler flaw, which can allow arbitrary file write as root via symlink following and a TOCTOU race. The advisory explicitly states the CVE was assigned on 2026-06-23.
CVE-2026-56258 was published for Crawl4AI, describing an unauthenticated arbitrary file write in screenshot and PDF endpoints caused by insufficient path validation, symlink following, and a TOCTOU condition. The issue affects versions before 0.8.8 and upgrading to 0.8.8 or later is recommended.
A follow-up fix for CVE-2026-56815 was merged in pwnlift after an initial remediation proved incomplete. The advisory says this fix was merged on 2026-06-18.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Attackers are actively exploiting **CVE-2026-5027**, a high-severity path traversal vulnerability in the open-source AI application platform **Langflow**, to write files to arbitrary locations on target systems and potentially achieve remote code execution. The flaw affects the `POST /api/v2/files` endpoint, where the `filename` parameter is not properly sanitized, and exploitation is made more severe by Langflow's default unauthenticated auto-login behavior, which lets attackers obtain a valid session token with a single unauthenticated request. VulnCheck reported observed attacks writing apparent test files to victim hosts, while Tenable identified the issue and assigned it a **CVSS 8.8** score. Internet exposure increases the risk: Censys data indicates about **7,000** Langflow instances are reachable online, with the largest concentration in North America. The exploitation report also fits a broader pattern of sustained attacker interest in Langflow, with other vulnerabilities including **`CVE-2026-0770`**, **`CVE-2026-21445`**, **`CVE-2026-33017`**, and **`CVE-2025-34291`** also reported as exploited in 2026; the last has been linked in public reporting to the Iranian state-backed group **MuddyWater**. Separately, a newly disclosed flaw in **Roxy-WI** (**`CVE-2026-45556`**) shows a similar arbitrary file-write-to-RCE pattern on managed load balancers, but no public patch was available at publication.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in **OpenClaw** and **ONNX** that can let attackers write to unintended files and potentially gain code execution. In OpenClaw, `GHSA-7XR2-Q9VF-X4R5` describes a symlink traversal issue involving `IDENTITY.md` that allows an authenticated attacker to append user-controlled content to any file writable by the Node.js process over the network with low complexity and no additional user interaction. The flaw was rated **CVSS 8.8** and can affect confidentiality, integrity, and availability, with reported outcomes including privilege escalation, persistent shell access, data corruption, denial of service, and remote code execution. A separate **CVSS 8.8** issue in ONNX, tracked as `CVE-2025-51480` / `GHSA-Q56X-G2FJ-4RJ6`, affects `save_external_data` and allows path traversal that can overwrite or read arbitrary files when a crafted model is processed. The reported impact includes overwriting files such as `~/.ssh/authorized_keys`, `~/.bashrc`, or scheduled task definitions, which can escalate to remote code execution under the privileges of the user running the ONNX workflow. In containerized environments, the flaw can also lead to full container compromise and possible lateral movement within a cluster.
Jun 29, 2026