Loading story…
Pathway disclosed and fixed CVE-2026-59094, a high-severity denial-of-service flaw affecting versions through 0.31.1. The vulnerability lies in the document-store and RAG REST servers, where attacker-controlled filepath_globpattern input is processed by a hand-written recursive glob matcher. Patterns containing repeated ** tokens can trigger exponential-time evaluation without memoization, allowing a remote unauthenticated attacker to drive heavy CPU consumption and deny service through exposed HTTP endpoints including /v1/inputs, /v1/retrieve, and /v2/answer.
The issue report said a short non-matching pattern with 14 ** segments produced roughly 40 million recursive calls and could pin a worker CPU core for more than 30 seconds per indexed document. Pathway addressed the flaw in commit d09722e and merged the fix through pull request #250, replacing the recursive logic with a memoized dynamic-programming approach and adding regression and performance tests showing pathological inputs now complete in under 0.5 seconds. Advisories also recommended limiting glob-pattern complexity, enforcing length and ** count restrictions, and validating user-supplied patterns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Advisories published details for CVE-2026-59094, describing an unauthenticated denial-of-service vulnerability in Pathway through version 0.31.1 caused by exponential glob pattern matching in the document store. The advisories noted that remote attackers could abuse unauthenticated HTTP endpoints with a small number of crafted requests and identified commit d09722e as the fix.
A Pathway commit replaced the vulnerable recursive "**" glob expansion logic with a memoized dynamic-programming approach to eliminate the exponential-time behavior. The change also updated the changelog and added a regression test showing the previously pathological pattern completed in under 0.5 seconds.
Pathway merged pull request #250, which implemented a memoized dynamic-programming fix for the exponential glob-matching denial-of-service issue and included related regression and performance test updates. The PR explicitly referenced issue #241 and was merged after checks passed.
A GitHub issue disclosed that Pathway Live Data Framework 0.31.1 was vulnerable to unauthenticated denial of service via exponential-complexity glob matching in filepath_globpattern on document-store and RAG REST endpoints. The report described affected endpoints, attack conditions, and testing showing severe CPU consumption from crafted patterns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcevulncheck.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple newly disclosed vulnerabilities exposed **arbitrary file write** paths through symlink handling and path validation failures in developer and server-side software. In **Crawl4AI** before `0.8.8`, `CVE-2026-56258` affects screenshot and PDF endpoints by combining weak `output_path` validation, symlink following, and a **TOCTOU** race, allowing unauthenticated remote attackers to write files outside the intended directory and potentially reach code execution. In **Cursor Desktop** before `3.0`, `CVE-2026-50549` lets a malicious agent escape the workspace sandbox by forcing path canonicalization to fail and then abusing an in-workspace symlink to write arbitrary files under the user’s privileges, including paths that could enable later unsandboxed execution. A related pattern also appeared in archive extraction and privileged upload handling. The **extract-zip** package is affected by `CVE-2026-56876`, which fails to validate symlink targets inside ZIP archives, enabling path traversal outside the extraction directory and possible arbitrary file read or write when processing untrusted archives. Separately, **pwnlift** disclosed `CVE-2026-56815` in a privileged upload handler that could be abused for arbitrary file write **as root** through direct symlink following and a TOCTOU race; an initial fix was bypassable before a follow-up patch was merged, while one downstream deployment mitigated exposure by removing the privileged `sudo` entry. Together, the disclosures highlight recurring risk from incomplete path canonicalization, unsafe symlink handling, and containment checks in file-write workflows.
Jul 2, 2026
Gogs disclosed a denial-of-service vulnerability, **CVE-2025-64719**, affecting `gogs.io/gogs` versions **0.14.2 and earlier**. A malicious user with permission to create a new repository file or wiki entry can use a specially crafted filename containing Git pathspec-related characters to trigger persistent **HTTP 500** errors on repository index and wiki listing pages. Public details in GitHub advisory `GHSA-3qq3-668m-v9mj` show a proof of concept using the filename: ```text [] ``` The flaw stems from commit information recovery logic in `internal/route/repo/view.go` and `internal/route/repo/wiki.go`, including a case where `commits[0]` may be dereferenced without confirming a valid value exists. The impact is limited to availability of the affected repository or wiki pages in the **web interface**; command-line Git operations are not affected, and the issue does not enable code execution or data theft. Gogs reported the bug was fixed in a release published on **2026-06-07**, with public disclosure following on **2026-06-19**.
Jun 29, 2026
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026