Loading story…
DriveLock disclosed two directory traversal information disclosure vulnerabilities in its web services that allow remote, unauthenticated attackers to access sensitive files by supplying crafted paths. The flaws are tracked as CVE-2026-5489 / ZDI-26-285 / ZDI-CAN-28719 and CVE-2026-5491 / ZDI-26-287 / ZDI-CAN-28722, and both stem from improper validation of user-supplied paths before file operations are performed.
The first issue affects the DriveLock web service on TCP port 4568 and carries a CVSS score of 5.3, while the second affects the service on TCP port 6067 by default and is rated 7.5. In both cases, successful exploitation can disclose information accessible to the service account without authentication. DriveLock has released updates to remediate the vulnerabilities, and the disclosures credit the researcher stuxxn.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The Zero Day Initiative publicly disclosed two DriveLock directory traversal information disclosure vulnerabilities, ZDI-26-285 and ZDI-26-287, on April 15, 2026. The issues were credited to stuxxn and described as allowing remote unauthenticated attackers to access sensitive information via improper path validation.
DriveLock released updates to remediate two directory traversal vulnerabilities in its web service, later tracked as CVE-2026-5489 and CVE-2026-5491. The flaws affected services listening on TCP ports 4568 and 6067 by default and could allow remote unauthenticated attackers to disclose sensitive information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
drivelock.help
Open sourcezerodayinitiative.com
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Microsoft disclosed **CVE-2026-34339**, an **Important** denial-of-service flaw in **Windows Lightweight Directory Access Protocol (LDAP)** caused by a `NULL` pointer dereference. The company said an authorized local attacker with low privileges could trigger the bug without user interaction, causing a loss of availability but not affecting confidentiality or integrity. Microsoft assigned the issue a **CVSS 3.1 score of 5.5**, said exploitation is considered less likely, and reported no public disclosure or active exploitation at publication; a vendor fix is available. Microsoft also published **CVE-2026-29169**, a denial-of-service vulnerability affecting **Apache HTTP Server `mod_dav_lock`** through an indirect lock crash tied to **CWE-476 NULL Pointer Dereference**. That flaw carries a **CVSS 3.1 score of 7.5** and is rated remotely exploitable over the network with no privileges or user interaction required, again impacting availability rather than confidentiality or integrity. The disclosures follow earlier Microsoft advisories for Windows denial-of-service issues including **CVE-2024-49113** and **CVE-2024-49121** in LDAP and **CVE-2025-59259** in the Windows Local Session Manager.
Jun 29, 2026
Multiple newly disclosed vulnerabilities exposed **arbitrary file write** paths through symlink handling and path validation failures in developer and server-side software. In **Crawl4AI** before `0.8.8`, `CVE-2026-56258` affects screenshot and PDF endpoints by combining weak `output_path` validation, symlink following, and a **TOCTOU** race, allowing unauthenticated remote attackers to write files outside the intended directory and potentially reach code execution. In **Cursor Desktop** before `3.0`, `CVE-2026-50549` lets a malicious agent escape the workspace sandbox by forcing path canonicalization to fail and then abusing an in-workspace symlink to write arbitrary files under the user’s privileges, including paths that could enable later unsandboxed execution. A related pattern also appeared in archive extraction and privileged upload handling. The **extract-zip** package is affected by `CVE-2026-56876`, which fails to validate symlink targets inside ZIP archives, enabling path traversal outside the extraction directory and possible arbitrary file read or write when processing untrusted archives. Separately, **pwnlift** disclosed `CVE-2026-56815` in a privileged upload handler that could be abused for arbitrary file write **as root** through direct symlink following and a TOCTOU race; an initial fix was bypassable before a follow-up patch was merged, while one downstream deployment mitigated exposure by removing the privileged `sudo` entry. Together, the disclosures highlight recurring risk from incomplete path canonicalization, unsafe symlink handling, and containment checks in file-write workflows.
Jul 2, 2026