CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- rarlab rar, rar app +1 moreRarlab RAR App com.rarlab.rar path traversal2.3 Low
- zhaoyachao zdh webzdh_web is a data collection, processing, monitoring, scheduling, and management platform. In...8.8 High
- yeqifu warehouse management systemWarehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability....8.1 High
- yeqifu warehouse management systemThe warehouse management system version 1.2 contains an arbitrary file read vulnerability. The...7.5 High
- fanvil x210 firmwareDirectory traversal vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on...8.3 High
- cksource ckfinderIn CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from...5.0 Medium
- synology beedrive, beedrive for desktop +1 moreImproper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in...7.8 High
- synology router manager, router manager (srm) +1 moreA vulnerability in portenable cgi allows remote authenticated users to get the status of...7.2 High
- synology router manager, router manager (srm) +1 moreA vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.4.3 Medium
- synology router manager, router manager (srm) +1 moreA vulnerability in FileStation file cgi allows remote authenticated users to read file metadata...4.3 Medium
- synology router manager, router manager (srm) +1 moreA vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image...5.4 Medium
- alexusmai laravel file manageralexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality9.1 Critical
- composioComposioHQ has a directory traversal vulnerability7.5 High
- thermofisher torrent suite softwareAn issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The ...8.8 High
- wpchill modula image gallery, image gallery – photo grid & video gallery +1 moreModula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion7.2 High
- alexusmai laravel file manageralexusmai laravel-file-manager is vulnerable to Directory Traversal6.5 Medium
- rareprob hd video player all formats app, hd video player all formats +1 moreRareprob HD Video Player All Formats App com.rocks.music.videoplayer path traversal4.8 Medium
- yohann0617 oci-helperYohann0617 oci-helper OCI Configuration Upload OciServiceImpl.java addCfg path traversal5.3 Medium
- solidserver ipam, efficientip solidserver ip address management +1 moreDirectory traversal vulnerability in EfficientIP's SOLIDserver IPAM5.1 Medium
- flipped-aurora gin-vue-adminGin-vue-admin has an arbitrary file deletion vulnerability8.7 High
- getgrav gravGrav vulnerable to Path Traversal allowing server files backup6.8 Medium
- getgrav gravGrav is vulnerable to Arbitrary File Read8.5 High
- getgrav gravGrav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption8.8 High
- elated-themes frappeFrappe vulnerable to a path traversal allowing reading certain files6.8 Medium
- moxi159753 mogu blog v2, mogublog project mogublog +1 moremoxi159753 Mogu Blog v2 ZIP File unzipFile FileOperation.unzip path traversal5.3 Medium
- jsnjfz webstack-gunsjsnjfz WebStack-Guns KaptchaController.java renderPicture path traversal6.9 Medium
- publiccmsPublicCMS V5.202506.b is vulnerable to path traversal via the doUploadSitefile method.7.5 High
- epubfilereader epub file readerSoftSea EPUB File Reader 1.0.0.0 is vulnerable to Directory Traversal. The vulnerability resides...7.1 High
- scada-ltsScada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversal5.3 Medium
- mariadbMariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability7.0 High
- keras-team keras-team/kerasPath Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file()8.0 High
- eaton galileo softwareImproper input sanitization in the file archives upload functionality of Eaton Galileo software...7.3 High
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreArbitrary File Overwrite via Tar Extraction Path Traversal9.3 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Path Traversal with Arbitrary File Deletion7.7 High
- iidk-the-actual consoleConsole is vulnerable to path traversal regarding custom assets8.7 High
- synergetic data systems, inc. unform serverUnForm Server < 10.1.15 Doc Flow Unauthenticated File Read8.7 High
- asus routerA path traversal vulnerability has been identified in certain router models. A remote,...6.9 Medium
- asus routerA path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated...8.2 High
- asus routerAn authentication-bypass vulnerability exists in AiCloud. This vulnerability can be triggered by...9.2 Critical
github.com/lf-edge/ekuiperGo,github.com/lf-edge/ekuiper/v2Go +1 moreLF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction9.3 Critical- fluentbit fluent bitCVE-2025-129725.3 Medium
- craws openatlasAn issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute...8.1 High
- desktopalert pingalert application serverA Directory Traversal vulnerability was found in the Application Server of Desktop Alert...9.9 Critical
- apple macosA parsing issue in the handling of directory paths was addressed with improved path validation....5.5 Medium
- basis international ltd. bbjBASIS BBj < 25.00 Unauthenticated Arbitrary File Read RCE9.3 Critical
- dreampie restyDreampie Resty HttpClient HttpClient.java request path traversal6.3 Medium
- 7-zip7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability7.0 High
- esm esm.shesm.sh CDN service has arbitrary file write via tarslip8.2 High
- astroAstro middleware authentication checks based on url.pathname can be bypassed via url encoded values6.9 Medium
- astroAstro Development Server is Vulnerable to Arbitrary Local File Read3.5 Low
- Show moreLoading…