arbitrary-file-write
2 live · 14 on record · last incident 6 days ago
Live2
- liveRuby on Rails Active Storage Ruby on Rails Vulnerable to Arbitrary File Read and Write in Active Storage
Patch now · Disclosed · since 4 Nov 2026
An ImageMagick integration flaw in Ruby on Rails Active Storage allows attackers to write and read arbitrary files. This could enable threat actors to gain unauthorized file access and move laterally.
Do:Check for vendor updates and apply patches for Ruby on Rails Active Storage.
- liveRuby on Rails Ruby on Rails Active Storage Flaw Allows Arbitrary File Writes
Patch now · Disclosed · Patched · since 4 Nov 2026
A critical vulnerability in Ruby on Rails Active Storage lets unauthenticated attackers write files to the server using crafted ImageMagick uploads. The project released versions 8.1.4.1 and 8.0.5.2 to address the issue.
Do:Update to Ruby on Rails 8.1.4.1 or 8.0.5.2.
Earlier12
- closed8.1Langflow CVE-2026-97677: IBM Langflow OSS Arbitrary File Read and Write
Patch now · Disclosed · since 8 Nov 2026 · CVE-2026-97677
AI - closedFlowise Flowise authenticated arbitrary file write in S3 Directory document loader
Patch now · Disclosed · since 4 Aug 2026
AI - closed8.8Langflow CVE-2026-7667: IBM Langflow OSS Arbitrary File Write Vulnerability
Patch now · Disclosed · since 17 Jul 2026 · CVE-2026-7667
AI - closed8.8F5-TTS F5-TTS Path Traversal Vulnerability in Gradio Handlers
Patch now · Disclosed · since 1 Jun 2026 · CVE-2026-43624
AI - closed9.9Langflow CVE-2026-33309: Langflow Arbitrary File Write via v2 API
Patch now · Disclosed · since 19 Mar 2026 · updated 24 Mar 2026 · CVE-2026-33309
AI - closed9.9Semantic Kernel CVE-2026-25592: Semantic Kernel Arbitrary File Write Vulnerability
Patch now · Disclosed · since 6 Feb 2026 · CVE-2026-25592
AI - closed7.7Claude Code + SDKs CVE-2026-24053: Claude Code path restriction bypass via ZSH clobber
Patch now · Disclosed · since 3 Feb 2026 · CVE-2026-24053
AI - closed7.1Langflow CVE-2025-68478: Arbitrary file creation vulnerability in Langflow
Patch now · Disclosed · since 19 Dec 2025 · CVE-2025-68478
AI - closed8.7Claude Code + SDKs CVE-2025-64755: Anthropic Claude Code Sed Command Validation Bypass
Patch now · Disclosed · since 20 Nov 2025 · updated 21 Nov 2025 · CVE-2025-64755
AI - closedFlowise Flowise allows arbitrary file write to RCE
Patch now · Disclosed · since 14 Mar 2025
AI - closed6.5Open WebUI CVE-2024-7037: open-webui allows writing and deleting arbitrary files
Patch now · Disclosed · since 9 Oct 2024 · CVE-2024-7037
AI - closed6.3Stable Diffusion WebUI CVE-2024-31462: Limited File Write in Stable Diffusion WebUI
Patch now · Disclosed · since 12 Apr 2024 · CVE-2024-31462
AI