CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- amr printer management beta web serviceDirectory Traversal in AMR Printer Management by AMR8.7 High
- gamerz wp-downloadmanagerWP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter6.5 Medium
- gamerz wp-downloadmanagerWP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter2.7 Low
- openclawOpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handling8.6 High
- openclawOpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile Parameters8.4 High
- isaacs node-tar, tar +1 morenode-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction7.1 High
- openclawOpenClaw has a path traversal in browser upload allows local file read7.1 High
- openclawOpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension7.5 High
- openclawOpenClaw 2026.1.29-beta.1 < 2026.2.1 - Path Traversal in Plugin Installation via Package Name7.0 High
- wangyunf blossomBlossom File Upload BLOSManager.java put path traversal5.3 Medium
- dell avamar server, avamar virtual edition, powerprotect dp series appliance (idpa) +2 moreDell Avamar Server and Avamar Virtual Edition, versions prior to 19.10 SP1 with CHF338912,...6.5 Medium
- dell avamar virtual edition, powerprotect dp series appliance (idpa) +1 moreDell Avamar, versions prior to 19.12 with patch 338905, contains an Improper Limitation of a...6.5 Medium
- dell avamar server, avamar virtual edition, powerprotect dp series appliance (idpa) +2 moreDell Avamar, versions prior to 19.12 with patch 338905, contains an Improper Limitation of a...4.7 Medium
- labstack echoEcho has a Windows path traversal via backslash in middleware.Static default filesystem5.3 Medium
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack has a Directory Traversal via Rack:Directory7.5 High
- flippercode wp maps – store locator,google maps,openstreetmap,mapbox,listing,directory & filtersWP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion8.8 High
- zentaoZenTao Editor control.php delete path traversal5.1 Medium
- zentaoZenTao Backup control.php delete path traversal5.3 Medium
- bdthemes element pack – widgets, templates & addons for elementorElement Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read6.5 Medium
- thebaldfatguy bfg tools – extension zipperBFG Tools – Extension Zipper <= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first_file' Parameter4.9 Medium
- tandoor recipesTandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read4.9 Medium
- bacnetstack bacnet stack, bacnet-stack +1 moreBACnet Stack Improperly Limits Pathnames to a Restricted Directory7.5 High
- lakefslakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access8.1 High
- libssh, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreLibssh: improper sanitation of paths received from scp servers5.0 Medium
- No product listedA zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1...10.0 Critical
- bullwark momentum series jawsBullwark Momentum Series JAWS 1.0 - 'Momentum Series JAWS' Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')8.7 High
- valmet dna, dna web tools +1 moreValmet DNA Web server arbitrary file read access8.7 High
- apple macos, visionos +1 moreA parsing issue in the handling of directory paths was addressed with improved path validation....5.5 Medium
- apple ipados, macos, visionos +2 more +4 moreA parsing issue in the handling of directory paths was addressed with improved path validation....5.5 Medium
- apple macosA parsing issue in the handling of directory paths was addressed with improved path validation....5.5 Medium
- apple ipados, macos, visionos +2 more +4 moreA path handling issue was addressed with improved validation. This issue is fixed in iOS 26.3 and...7.8 High
- apple macosA path handling issue was addressed with improved validation. This issue is fixed in macOS...7.8 High
- apple macosA path handling issue was addressed with improved logic. This issue is fixed in macOS Sonoma 14.8...5.5 Medium
- apple ipados, macos, safari +3 more +5 moreA path handling issue was addressed with improved logic. This issue is fixed in macOS Tahoe 26.3,...7.5 High
- apple ipados, ios and ipados, iphone os +2 moreA path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.5...5.5 Medium
- devdojo voyagerVoyager 1.3.0 - Directory Traversal8.7 High
- getoutline outlineOutline Affected an Arbitrary File Read via Path Traversal in JSON Import5.5 Medium
- minigal nano, rybber minigal nano +1 moreMiniGal Nano <= 0.3.5 Path Traversal via dir Parameter6.9 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 54.8 Medium
- qnap qsync centralQsync Central1.3 Low
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 55.2 Medium
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 51.3 Low
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 51.3 Low
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 51.3 Low
- qnap qsync centralQsync Central1.3 Low
- qnap file station, qnap systems inc. file station 5 +1 moreFile Station 51.3 Low
- opensatkitDirectory traversal vulnerability in OpenSatKit 2.2.1 allows attackers to gain access to...7.5 High
- unjs nanotarnanotar is vulnerable to path traversal in parseTar() and parseTarGzip()9.8 Critical
- No product listedA path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT...10.0 Critical
- No product listedA path-traversal vulnerability in the logout functionality of Shenzhen Zhibotong Electronics ZBT...5.3 Medium
- Show moreLoading…