GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-115353: Python Path Traversal Uncontained Join Opencve-2026-115353-python-path-traversal-uncontained-join-open

Path traversal (CWE-22): a file path is built with os.path.join($BASE, $P) and passed to open() without proving the resolved target stays inside $BASE. os.path.join silently discards $BASE when $P is absolute, and os.path.normpath only collapses "../" lexically, so an attacker-controlled $P can read any file readable by the process. Reject absolute arguments

PythonCVE-2026-115353CWE-22CWE-23CWE-73
by Provallyupdated 2026-10-27Apache-2.0
490 direct49 via packs
83
All matching rules loaded.