CWE hub

CWE-187 vulnerabilities

This hub groups CVEs that NVD maps to CWE-187, so you can review recent disclosures, common vendors, and related weakness patterns in one place.

RSS View CWE-187 on MITRE

Definition mirrored from MITRE CWE (MITRE CWE 4.13). CVE list is sourced live from NVD.

Mapped CVEs

Records currently returned for this weakness id.

Top vendor

jellyfin

1 mapped CVEs in the aggregate scan.

Weakness roll-up for CWE-187

Showing 1-3 of 3 vulnerabilities.

CWE: CWE-187

Sort current page

CVE-2026-35031CriticalCVSS9.9Published Apr 14, 2026

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the "Upload Subtitles" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface.

Affected vendor

jellyfin

Affected product

jellyfin

Coverage

Single affected product entry

CVSS

9.9

CRITICAL

Published

Apr 14, 2026

CVE-2026-34785HighCVSS7.5Published Apr 2, 2026

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or "/css-backup.sql". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Affected vendor

rack

Affected product

rack

Coverage

3 affected product entries

CVSS

7.5

HIGH

Published

Apr 2, 2026

CVE-2026-30874LowCVSS1.8Published Mar 19, 2026

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially leading to privilege escalation. The function is intended to filter out sensitive environment variables like PATH when executing hotplug scripts in /etc/hotplug.d, but a bug using strcmp instead of strncmp causes the filter to compare the full environment string (e.g., PATH=/some/value) against the literal "PATH", so the match always fails. As a result, the PATH variable is never excluded, enabling an attacker to control which binaries are executed by procd-invoked scripts running with elevated privileges. This issue has been fixed in version 24.10.6.

Affected vendor

openwrt

Affected product

openwrt

Coverage

Single affected product entry

CVSS

1.8

LOW

Published

Mar 19, 2026