Topic
A software vulnerability class where attacker-supplied path components, such as ../ sequences or absolute paths, access files outside intended directories.
CISA added Atlassian's CVE-2026-21589, rated CVSS 9.3, to its Known Exploited Vulnerabilities catalog on October 15. An attacker needs a file's exact path, and in one watchTowr test that was enough to reach Jira administrator access.
Reality
CISA added CVE-2026-93616, a 9.8-rated Check Point management flaw, to its Known Exploited Vulnerabilities catalog on September 22, 2026. A dev.to write-up says no final patch covers every release yet, so port exposure is the control.
Reality
Atlassian rates CVE-2026-21589 critical at CVSS 4.0 9.3, a no-login file-read flaw in every version of eight self-hosted products. Honeypots saw exploitation attempts by October 6, a day after the advisory, according to a dev.to write-up that found no public report of confirmed victims.
Reality
Atlassian disclosed CVE-2026-21589, a 9.3-rated unauthenticated file-read flaw affecting all eight of its self-hosted Data Center products. A public proof of concept drew exploitation attempts within two hours of landing on 7 October.
Reality
Atlassian disclosed a 9.3-rated flaw, CVE-2026-21589, that lets attackers with no login read known files in 8 self-hosted Data Center products. It wants internet-facing instances taken offline or cut off from outside access until they are upgraded or behind a blocking rule.
Perspective Coverage
15 publishersReality
Dell has fixed CVE-2026-86360, a critical path traversal in Dell System Update that lets an unauthenticated remote attacker run code as root. Any server on a DSU build older than 2.3.0.0 stays exposed until it is updated.
Perspective Coverage
3 publishersReality
GitLab's September 10 patch release closes CVE-2026-85706, a CVSS 10.0 path confinement failure in the repository commits API. GitLab.com was already patched, so the exposure sits with self-managed servers.
Perspective Coverage
3 publishersReality
Six LLMs on a 12-task Kaggle security benchmark all caught SQL injection, hardcoded keys and pickle RCE, but Gemini 3.7 Flash missed a path traversal. With one scenario per flaw class, the run shows which textbook patterns the models know and says little about trusting one to review real code.
Reality
ABB's PCM600 IED manager, versions 2.14 and earlier, lets a standard local user take control of the host through a Scheduler Service running as LocalSystem. ABB's remedy is a workaround it says reduces the risk without correcting the underlying flaw.
Reality
The affected releases stretch back to Next.js 13.4, and for Windows self-hosters the only remedy Vercel offers is the version bump. The AVIF bug shipped in the same release at least has a config gate.
Reality
The fix ships in 19.3.2, 19.2.6 and 19.1.8, and scanning for the flaw started the day after disclosure. Whether you can tell if a read succeeded on your instance depends on whether your proxy logs request bodies.
Perspective Coverage
3 publishersReality
CVE-2026-93616 lets a remote attacker upload a file and execute a script on Check Point's management, log and SmartEvent servers with no credentials. Check Point says it observed targeted attacks on July 23, 2026.
Reality
Siemens ProductCERT reported the traversal itself, and fixed builds are out for four SIMOVE Fleetmanager branches and SIPLANT V3.1. For SIPLANT V1.7, V2.2 and V3.0 the advisory's remedy is an email to support.
Reality
Anil Madhavapeddy's account of the cohttp 6.3.0 path traversal fix puts a number on the gap between publishing a patch and being probed for the bug it closes. The three alternatives he examined each cost a small maintainer something.
Reality
The fix decodes a request path exactly once before removing dot segments, so ..%2f..%2f no longer resolves outside the docroot. Servers that gate access on path prefixes still have to call the new Cohttp.Path.normalise themselves.
Reality
Anil Madhavapeddy patched a path traversal bug in OCaml's cohttp and found probes for it in his logs ten minutes after opening the fix PR. His own agent had already built the exploit from a bug-class hint.
Reality
The author of mcpscan checked rule MCP007 against the year's four MCP path-traversal CVEs, found its sink regex only matched read calls, and closed the gap by adding write sinks that escalate to HIGH on sight.
Reality
Aikido Security says a Blueprint audio node exposed to community maps accepted any file path, letting a lobby host's map plant files on every player's machine. The maintainers fixed it in the 4.0.0 update.
Reality