CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- mediawikiHTML rest endpoint needs PoolCounter and proper parser cache check0.0 None
- wikimedia foundation mediawikiWith MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList2.1 Low
- wikimedia foundation mediawikiAutoblocks from global account suppressions are publicly visible2.3 Low
- signalk signal k server, signalk-server +1 moreSignalK Server has Path Traversal leading to information disclosure5.0 Medium
- wildfirechat im-serverWildfire has Arbitrary File Upload via Directory Traversal in UploadFileAction9.8 Critical
- bpg terraform-provider-proxmox, terraform provider +1 moreterraform-provider-proxmox has insecure sudo recommendation in the documentation8.7 High
- openlistteam openlistOpenList affected by Path Traversal in file copy and remove handlers8.8 High
- ibm websphere application server liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty Path Traversal7.6 High
- pip maintainers pipLimited path traversal when installing wheel archives2.0 Low
- abc pro sp. z o.o. eap legislatorPath Traversal in EAP Legislator8.6 High
- product owner: webile webileWebile 1.0.1 Directory Traversal Vulnerability via Web Application7.1 High
- author: scott ferreira free photo & video vault - wifi transferFree Photo & Video Vault 0.0.2 Directory Traversal Vulnerability via Web Request7.1 High
- sunfounder pironman dashboard (pm dashboard)SunFounder Pironman Dashboard <= 1.3.13 Path Traversal Arbitrary File Read/Deletion9.3 Critical
- citeum openctiOpenCTI 3.3.1 - Directory Traversal7.1 High
- hellowebHelloWeb 2.0 - Arbitrary File Download8.7 High
- backstage@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator5.3 Medium
- hiksemi hs-afs-s1h1Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of...4.6 Medium
- arcadia technology, llc crafty controllerImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller8.2 High
- arcadia technology, llc crafty controllerImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Crafty Controller9.9 Critical
- runtipiRuntipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal7.6 High
- chainguard malcontentmalcontent's archive extraction could write outside extraction directory5.5 Medium
- umbraco forms, umbraco.forms.issues +1 moreUmbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac6.0 Medium
- b3log siyuanSiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE9.1 Critical
- ruijienetworks ruijie networks switch eweb s29 rgosRuijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal7.1 High
- red hat osim, redhat open security issue management +1 moreosim: Path Traversal via query parameters in Nginx configuration7.5 High
- jishenghua jsherpjishenghua jshERP installByPath install path traversal5.1 Medium
- jishenghua jsherpjishenghua jshERP PluginController uploadPluginConfigFile path traversal5.3 Medium
- b3log siyuanSiYuan has a File Read Interface Case Bypass Vulnerability7.5 High
- erugoAuthenticated Remote Code Execution via Arbitrary File Upload10.0 Critical
- d-link dcs-700l, dlink dcs-700l firmware +1 moreD-Link DCS-700L Music File Upload Service setUploadMusic uploadmusic path traversal4.8 Medium
- pmb services servicesPMB 5.6 - 'chemin' Local File Disclosure6.9 Medium
- inc2734 snow monkey formsSnow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal9.8 Critical
- isaacs node-tar, tar, red hat cryostat 4 +27 more +29 morenode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal8.2 High
- altumcode 66biolinksA directory traversal (Zip Slip) vulnerability exists in the “Static Sites” feature of 66biolinks...6.5 Medium
- infiniflow ragflowRAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser9.8 Critical
- c4illin convertxConvertX Vulnerable to Arbitrary File Deletion via Path Traversal in `POST /delete`8.1 High
- hewlett packard enterprise (hpe) hpe aruba networking fabric composerUnauthenticated Limited File Read allows Data Exposure in Web Interface7.5 High
- avalanche123 cassandra webCassandra Web 0.5.0 - Remote File Read8.7 High
- ralim ironosA Potential SPA-vulnerability in Ralim/IronOS6.9 Medium
- hustojHUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE9.3 Critical
- theupdateframework go-tufgo-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names4.7 Medium
- fastapiexpert python-multipart, red hat lightspeed core, openshift lightspeed +11 more +13 morePython-Multipart has Arbitrary File Write via Non-Default Configuration8.6 High
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM vulnerable to Path Traversal7.2 High
- pnpmpnpm has Path Traversal via arbitrary file permission modification6.7 Medium
- bentomlBentoML has a Path Traversal via Bentofile Configuration7.4 High
- pnpmpnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)6.5 Medium
- pnpmpnpm has Windows-specific tarball Path Traversal6.5 Medium
- pnpmpnpm has symlink traversal in file:/git dependencies6.7 Medium
- adonisjs http-serverC++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File Read7.5 High
- 7-zip7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability7.0 High
- Show moreLoading…