CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- nltk, nltk nltk/nltk, red hat lightspeed core +5 more +7 moreArbitrary File Read via Absolute Path Input in nltk.util.filestring()8.6 High
- actual sync server, actualbudget actual +1 moreActual Sync Server 26.2.1 - Authenticated Path Traversal5.3 Medium
- mbs ubr-01 mk ii, ubr-02, ubr-lon +1 more +3 moreArbitrary Write with wwwupload.cgi8.8 High
- mbs ubr-01 mk ii, ubr-02, ubr-lon +1 more +3 moreArbitrary Write with ubr-restore8.8 High
- mbs ubr-01 mk ii, ubr-02, ubr-lon +1 more +3 moreArbitrary Read with ubr-logread6.5 Medium
- doramart doracmsdoramart DoraCMS v1.js createFileBypath path traversal5.3 Medium
- sunbird sunbirded-portalAn issue pertaining to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path...7.5 High
- tsinghua unigroup electronic archives systemTsinghua Unigroup Electronic Archives System downLoad path traversal6.9 Medium
- remyandrade modern image gallery appSourceCodester Modern Image Gallery App delete.php path traversal6.9 Medium
- parse-community parse-serverParse Server: `PagesRouter` path traversal allows reading files outside configured pages directory6.3 Medium
- aiven karapaceKarapace: Path Traversal in Backup Reader4.1 Medium
- metabox meta boxMeta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion7.2 High
- ellite wallosWallos: SSRF via url parameter leading to File Traversal8.7 High
- b3log siyuanSiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage9.3 Critical
- go standard library os, golang go +1 moreFileInfo can escape from a Root in os2.5 Low
- lfprojects zarfZarf: Symlink targets in archives are not validated against destination directory8.2 High
- arixolab nominasNominas 0.27 SQL Injection via username Parameter8.8 High
- getsurreal surreal todoSurreal ToDo 0.6.1.2 Local File Inclusion via index.php6.9 Medium
- musiccoMusicco 2.0.0 Arbitrary Directory Download via Path Traversal8.7 High
- rul10 easyndexerEasyndexer 1.0 Arbitrary File Download via showtif.php8.7 High
- windmillWindmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly6.9 Medium
- natroteam natro macro, natromacro +1 moreNatro Macro: Malicious actions allowed through Discord RC Commands by any user6.4 Medium
- talisharTalishar: Critical Path Traversal in gameName Parameter7.5 High
- home-gallery homegallery, xemle home-gallery +1 moreHomeGallery: Path Traversal (Arbitrary File Read)8.6 High
- opensiftOpenSift: Insufficient path containment checks in storage helpers could allow path traversal-style file operations8.8 High
- microsoft aci confidential containersMicrosoft ACI Confidential Containers Elevation of Privilege Vulnerability6.7 Medium
- eclipse openmq, eclipse foundation glassfish +1 moreAn unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files...9.1 Critical
- huawei harmonyosPath traversal vulnerability in the certificate management module. Impact: Successful...5.9 Medium
- seppmailSEPPmail User Web Interface Arbitrary File Write to RCE10.0 Critical
- stylemix ulistingWordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability4.9 Medium
- wpwax formgentWordPress FormGent plugin <= 1.7.0 - Arbitrary File Deletion vulnerability8.6 High
- robert seyfriedsberger ioncube tester plusWordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability7.5 High
- dbt-labs dbt-commondbt-common: commonprefix() doesn't protect against path traversal2.0 Low
- isaacs node-tar, tar, red hat cryostat 4 +20 more +22 morenode-tar: Hardlink Path Traversal via Drive-Relative Linkpath8.2 High
- backstage, linuxfoundation backstage\/integration +1 more@backstage/integration: Potential reading of SCM URLs using built in token2.7 Low
- govcert-lu eml parsereml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write5.5 Medium
- dlink dir-513 firmwareD-Link DIR-513 version 1.10 contains a critical-level vulnerability. When processing POST...9.8 Critical
- vibrantlabsai ragas, red hat openshift ai (rhoai) +1 moreRAGAS has an Arbitrary File Read vulnerability7.5 High
- dgtlmoon changedetection.io, webtechnologies changedetection +1 morechangedetection.io: Zip Slip vulnerability in the backup restore functionality8.8 High
- nekename opendeckOpenDeck affected by path traversal allows arbitrary file read5.9 Medium
openclawnpmOpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection6.9 Medium- nltk, nltk nltk/nltk, red hat lightspeed core +5 more +7 morePath Traversal in nltk/nltk8.6 High
- seppmail secure email gateway, seppmail +1 morezip_attachments Path Traversal9.3 Critical
- datacast sfx2100 firmware, international datacasting corporation (idc) sfx series superflex satellite receiver web management interface +1 moreLFI in /IDC_Logging/checkifdone.cgi, "file" parameter Allowing for File Existence Enumeration On IDC Satellite Receiver Web Management Interface Version 1015.3 Medium
- openclawOpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths6.9 Medium
- openclawOpenClaw < 2026.2.24 - Path Traversal via @-prefixed Absolute Paths in Workspace Boundary Validation6.0 Medium
openclawnpmOpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot7.8 High- open-emr openemrOpenEMR Arbitrary File Write leading to Remote Code Execution8.7 High
- openclawOpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypass7.6 High
- craftcms cms, craft cms +1 moreCraft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget7.5 High
- Show moreLoading…