CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft azure logic appsAzure Logic Apps Elevation of Privilege Vulnerability8.2 High
- apple container, containerization +1 moreContainer and Containerization archive extraction does not guard against escapes from extraction base directory.7.8 High
- sigstoresigstore legacy TUF client allows for arbitrary file writes with target cache path traversal5.8 Medium
- linuxcontainers incusIncus container image templating arbitrary host file read and write8.7 High
- hangzhou kuozhi network technology co., ltd. edusohoEduSoho < 22.4.7 Arbitrary File Read via classroom-course-statistics8.7 High
- vibethemes wplmsWordPress WPLMS plugin <= 1.9.9.5.4 - Arbitrary File Deletion vulnerability8.6 High
- seatheme bm content builderWordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary File Download vulnerability6.5 Medium
- harmonic design hdformsWordPress HDForms plugin <= 1.6.1 - Arbitrary File Deletion vulnerability8.6 High
- aivahthemes hostme v2WordPress Hostme v2 theme <= 7.0 - Arbitrary File Deletion vulnerability7.5 High
- aivahthemes anonaWordPress Anona theme <= 8.0 - Arbitrary File Download vulnerability7.5 High
- aivahthemes anonaWordPress Anona theme <= 8.0 - Arbitrary File Deletion vulnerability8.6 High
- ovatheme movie bookingWordPress Movie Booking plugin <= 1.1.5 - Arbitrary File Deletion vulnerability8.6 High
- opensolution quick.cartRemote Code Execution via Local File Inclusion in Quick.Cart9.4 Critical
- pypa wheel, red hat discovery 2 for rhel 10, discovery 2 for rhel 8 +57 more +59 morewheel Allows Arbitrary File Permission Modification via Path Traversal7.1 High
- tmsglobalsoft tms management consoleA path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818)...6.5 Medium
- No product listedAn issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows...8.8 High
- backstage, red hat developer hub 1.8, developer hub 1.9 +2 moreBackstage has a Possible Symlink Path Traversal in Scaffolder Actions7.1 High
- yodinfo mini mouseMini Mouse 9.2.0 - Path Traversal8.7 High
- yodinfo mini mouseMini Mouse 9.3.0 - Local File inclusion / Path Traversal8.7 High
- chainlitChainlit < 2.9.4 Arbitrary File Read via /project/element7.1 High
- b3log siyuanSiYuan Vulnerable to Arbitrary File Read via File Copy Functionality8.3 High
- b3log siyuanSiYuan vulnerable to arbitrary file read7.8 High
- apache linkisApache Linkis: Arbitrary File Read via Double URL Encoding Bypass7.5 High
- esm esm.shesm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages7.7 High
- publiccmsSanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal5.1 Medium
- thimpress thim blocksGutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter6.5 Medium
- awesome motive youtube feed proFeeds for YouTube Pro <= 2.6.0 - Unauthenticated Arbitrary File Read via Path Traversal5.9 Medium
- kidocode crawl4aiCrawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling9.2 Critical
- weblate wlcwlc Path traversal: Unsanitized API slugs in download command8.1 High
- toa corporation multiple network cameras trifora 3 seriesPath Traversal vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA...7.1 High
- steelseries nahimicSteelSeries Nahimic 3 1.10.7 allows Directory traversal.7.8 High
- geovision geowebserverGeoVision Geowebserver 5.3.3 - Local FIle Inclusion8.7 High
- docmostDocmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)7.1 High
- donknap dpanelDPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface8.1 High
- softlink education oliver library server, softlinkint oliver v5 library +1 moreOliver Library Server v5 - Arbitrary File Download8.7 High
- invoiceplaneDirectory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers...5.3 Medium
- agora-projectDirectory traversal vulnerability in Omnispace Agora Project before 25.10 allowing...7.5 High
- checkpoint hramony saseLocal privilege escalation in Harmony SASE Windows Agent7.5 High
- vaghasia3 news and blog designer bundleNews and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion9.8 Critical
- gothamdev gotham block extra lightGotham Block Extra Light <= 1.5.0 - Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcode6.5 Medium
- woosaai integration opvius ai for woocommerceIntegration Opvius AI for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary File Deletion/Read via Path Traversal9.8 Critical
- e107, e107 cms +1 moree107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override8.6 High
- kyocera command center rxKyocera Command Center RX ECOSYS M2035dn - Directory Traversal File Disclosure (Unauthenticated)8.7 High
- skyjos owlfiles, owlfiles file manager +1 moreOwlfiles File Manager 12.0.1 - Path Traversal8.7 High
- phphtmledit cuteeditor, rich text editor +1 moreCuteEditor for PHP 6.6 - Directory Traversal5.3 Medium
- youphptubeYouPHPTube <= 7.8 - Directory Traversal8.7 High
- jaraco jaraco.contextjaraco.context Has a Path Traversal Vulnerability8.6 High
- datadog guarddogGuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE8.7 High
- fortinet fortivoiceAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability...5.7 Medium
- zohocorp manageengine admanager plusPath Traversal5.5 Medium
- Show moreLoading…