CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- jehovahs witnesses jw library appJehovahs Witnesses JW Library App org.jw.jwlibrary.mobile.activity.SiloContainer path traversal4.8 Medium
- apple macosA parsing issue in the handling of directory paths was addressed with improved path validation....5.5 Medium
- apple macosA parsing issue in the handling of directory paths was addressed with improved path validation....5.5 Medium
- iworks simple csv tableSimple CSV Table <= 1.0.1 - Directory Traversal to Authenticated (Contributor+) Arbitrary File Read6.5 Medium
- wpchill modula image gallery – photo grid & video galleryImage Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing6.5 Medium
- tharkun69 player leaderboardPlayer Leaderboard 1.0.0 - 1.0.2 - Authenticated (Contributor+) Local File Inclusion8.8 High
- sh1zen multi uploader for gravity formsMulti Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion9.8 Critical
- watchtowerhqWatchTowerHQ <= 3.16.0 - Authenticated (Administrator+) Arbitrary File Read via 'wht_download_big_object_origin' Parameter4.9 Medium
- weaviateWeaviate OSS has path traversal vulnerability via the Shard Movement API4.9 Medium
- weaviateWeaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip7.2 High
- vercel next.jsNext.js: Unauthenticated Remote Code Execution on windows-hosted servers9.0 Critical
- xbtitfmxbtitFM 4.1.18 Unauthenticated Path Traversal in nfogen.php8.7 High
- apc network management card 4APC Network Management Card 4 Path Traversal via Directory Traversal8.7 High
- wpjobportal wp job portal – ai-powered recruitment system for company or job board websiteWP Job Portal <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- baowzh hflybaowzh hfly download path traversal5.3 Medium
- baowzh hflybaowzh hfly delfile path traversal5.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.11 path traversal was possible via file upload3.8 Low
- cpanelAn issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the...8.8 High
- howfor qihang media web digital signageQiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Deletion8.8 High
- eibiz i-media server digital signageEibiz i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability8.7 High
- spenetix ag fusion digital signageSpinetiX Fusion Digital Signage 3.4.8 Authenticated Path Traversal via File Operations8.8 High
- mayuri-chan pyroforkPyrofork has a Path Traversal in download_media Method6.5 Medium
- jenkins redpen - pipeline reporter for jira, jenkins project redpen - pipeline reporter for jira plugin +1 moreJenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability4.3 Medium
- barracuda rmmBarracuda RMM < 2025.1.1 Service Center .NET Remoting Path Traversal RCE8.7 High
- gogsFile overwrite in file update API in Gogs8.7 High
- hippooo hippoo mobile app for woocommerceHippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read7.5 High
- specialk simple download counterSimple Download Counter <= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal4.9 Medium
- pipeshub, pipeshub-ai +1 morePipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload9.8 Critical
- uniteddevelopers document reader\A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC,...6.5 Medium
- a1apps office app-edit word\, pdf fileA lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word...6.5 Medium
- datagearDataGear v5.5.0 is vulnerable to Arbitrary File Deletion.9.1 Critical
- fearlessgeekmedia fearlesscmsDirectory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote...7.5 High
- fearlessgeekmedia fearlesscmsDirectory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote...7.5 High
- adobe coldfusionColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)9.1 Critical
- minidvblinuxMiniDVBLinux 5.4 Arbitrary File Read Vulnerability via About Page8.7 High
- stvs provisionSTVS ProVision Authenticated File Disclosure via archive.rb7.1 High
- hp omen gaming hub, system event utility +1 moreHP System Event Utility and Omen Gaming Hub – Potential Arbitrary Code Execution4.8 Medium
- fortinet fortivoiceMultiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal')...7.7 High
github.com/siyuan-note/siyuan/kernelGoSiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin8.6 High- b3log siyuanSiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE7.8 High
- ivanti endpoint managerPath traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote...7.1 High
- zauberzeug niceguiNiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading7.5 High
- jmriImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in...6.8 Medium
- robocodeDirectory Traversal in Robocode's CacheCleaner Component10.0 Critical
- unknown csv to sorttableCSV to SortTable <= 4.2 - Contributor+ LFI6.6 Medium
- cdpenergy snmp web pro firmwareAn unauthenticated directory traversal vulnerability in cgi-bin/upload.cgi in SNMP Web Pro 1.1...4.3 Medium
- yottamaster dm2, dm200, dm3 +3 more +5 moreYottamaster DM2/DM3/DM200 File Upload path traversal5.3 Medium
- orico cd3510ORICO CD3510 File Upload path traversal5.3 Medium
- sobey media convergence systemSobey Media Convergence System upload path traversal5.3 Medium
- 10web booster – website speed optimization, cache & page speed optimizer, booster +1 more10Web Booster <= 2.32.7 - Authenticated (Subscriber+) Arbitrary Folder Deletion via two_clear_page_cache9.6 Critical
- Show moreLoading…