CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- eptura archibusIn Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database...7.5 High
- flipped-aurora gin-vue-adminGin-vue-admin has arbitrary file upload vulnerability caused by path traversal7.3 High
- mindsdbMindsDB has improper sanitation of filepath that leads to information disclosure and DOS8.1 High
- broadcom dx netops spectrumSpectrum directory path traversal8.8 High
- busymac pal mcp serverA path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated...6.5 Medium
- devtoysDevToys Path Traversal (“Zip Slip”) Vulnerability in DevToys Extension Installation8.8 High
- vivotek ip7137, ip7137 firmware +1 morePath traversal in Vivotek IP7137 cameras6.9 Medium
- couchcmsAn Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary...6.5 Medium
- No product listedIn Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service...7.5 High
- @tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 moreReact Router has Path Traversal in File Session Storage9.1 Critical
- mmaitre314 picklescanpicklescan - Arbitrary File Read via Unsafe Pickle Deserialization8.7 High
- loopus wp cost estimation & payment forms builderWP Cost Estimation < 9.660 - Upload Directory Traversal6.5 Medium
- flir systems, inc. thermal camera f/fc/pt/dFLIR Thermal Camera F/FC/PT/D 8.0.0.64 Information Disclosure via File Reading8.7 High
- rustfsRustFS Path Traversal Vulnerability8.8 High
- css project css, wikimedia foundation mediawiki - css extension +1 morePath Traversal vulnerability in CSS extension on certain web servers7.5 High
- yocoadmin yoco paymentsYoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read7.5 High
- liangshao flashcard plugin for wordpressFlashcard Plugin for WordPress <= 0.9 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal6.5 Medium
- gnu wget2Wget2: arbitrary file write via metalink path traversal in gnu wget28.8 High
- project-monai monaiMONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download5.3 Medium
- secure computing snapgear management console sg560, securecomputing snapgear sg560 firmware +1 moreSecure Computing SnapGear Management Console SG560 3.1.5 Arbitrary File Read/Write8.7 High
- buddydev buddypress xprofile custom field typesBuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion8.8 High
- ninjateam fastdup – fastest wordpress migration & duplicatorFastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter6.5 Medium
- aio-libs aiohttpAIOHTTP allows for a brute-force leak of internal static filepath components6.3 Medium
- elated-themes frappeCertain Frappe requests are vulnerable to Path Traversal7.5 High
- redaxoRedaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read8.3 High
- parall jspdf, red hat advanced cluster security 4, advanced cluster security 4.8 +1 more +3 morejsPDF has Local File Inclusion/Path Traversal vulnerability9.2 Critical
- apache kyuubiApache Kyuubi: Unauthorized directory access due to missing path normalization8.8 High
- cld378632668 javamallcld378632668 JavaMall MinioController.java delete path traversal5.3 Medium
- yeqifu warehouseyeqifu warehouse AppFileUtils.java createResponseEntity path traversal5.3 Medium
- adonisjs coreAdonisJS Path Traversal in Multipart File Handling9.2 Critical
- qnap qfilingQfiling8.1 High
- qnap qts, quts hero +1 moreQTS, QuTS hero6.9 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero4.6 Medium
- qnap systems inc. qfinder pro mac, qsync for mac, qvpn device client for mac +2 moreQfinder Pro, Qsync, QVPN4.4 Medium
- yeqifu carrentalyeqifu carRental com.yeqifu.sys.controller.FileController downloadShowFile.action downloadShowFile path traversal6.9 Medium
- vatilon pa4 firmwareAn issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files...7.5 High
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi9.3 Critical
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated File Disclosure Vulnerability8.7 High
psitransfernpmPsiTransfer has Zip Slip Path Traversal via TAR Archive Download8.1 High- d-link dcs-850l, dlink dcs-850l firmware +1 moreD-Link DCS-850L Firmware Update Service uploadfirmware path traversal5.1 Medium
- symphorien nixseparatedebuginfodnixseparatedebuginfod before v0.4.1 is vulnerable to Directory Traversal.7.5 High
- rapid7 velociraptorRapid7 Velociraptor Directory Traversal Vulnerability6.8 Medium
- njtech greencmsGreenCMS File DataController.class.php path traversal5.1 Medium
- welltend bpmflowwebkitWELLTEND TECHNOLOGY｜ BPMFlowWebkit - Arbitrary File Read8.7 High
- sun.net wmproSunnet｜WMPro - Arbitrary File Read8.7 High
- innorix wpArbitrary File Download through Path Traversal in Innorix WP6.9 Medium
- nagios xiNagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin...7.5 High
- vvveb vvvebjsgivanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php.7.5 High
- prasathmani tinyfilemanager, tiny file manager +1 moreprasathmani TinyFileManager tinyfilemanager.php path traversal5.1 Medium
- croogoCroogo CMS has a path traversal vulnerability6.5 Medium
- Show moreLoading…