Daptin has Unauthenticated Path Traversal and Zip Slip in github.com/daptin/daptin

Description

References

• daptin/daptin security advisory · ADVISORY
• daptin/daptin commit 8d626bb · FIX

More vulnerabilities in github.com/daptin/daptin

• CVE-2026-62160HIGHDaptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
• GO-2026-4991Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change in github.com/daptin/daptin
• CVE-2026-44349HIGH 7.1Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resource_findallpaginated.go:1484 …
• CVE-2026-41422HIGH 8.3Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parame…
• GHSA-258c-965c-p3hcMEDIUM 6.5Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change