CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- red hat openshift ai (rhoai)Feast: unauthenticated arbitrary file read7.5 High
- wwbn avideoAVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)8.6 High
- langflowLangflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading8.7 High
- h3js h3h3 before 1.15.9 Path Traversal via Double Decoding8.2 High
- wwbn avideoAVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter7.1 High
- b3log siyuanSiYuan has an Unauthenticated Arbitrary File Read via Path Traversal7.5 High
- cryptomatorCryptomator: Unverified masterkeyfile key IDs can access arbitrary local or UNC paths4.1 Medium
- stirling pdf, stirling-tools stirling-pdf +1 moreStirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP Extraction8.1 High
- ghera74 ilghera carta docente for woocommerceilGhera Carta Docente for WooCommerce <= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter6.5 Medium
- pyload, pyload-ng project pyload-ng +1 morepyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification8.1 High
- pydicompydicom: Path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root7.8 High
- leefish file thingieFile Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the ...4.3 Medium
- dreamfactory coreDreamFactory has a directory traversal7.2 High
- spring framework, vmware spring framework +1 moreSpring Framework Improper Path Limitation with Script View Templates5.9 Medium
- open-emr openemrOpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders6.5 Medium
- daguDagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG8.1 High
- langflowLangflow has an Arbitrary File Write (RCE) via v2 API10.0 Critical
- wwbn avideoAVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter8.1 High
- wwbn avideoAVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos7.5 High
- artifex software inc. *pymupdf* pymupdf, red hat enterprise linux ai (rhel ai) 3 +1 moreCVE-2026-30297.5 High
- ubiquiti inc unifi network applicationA malicious actor with access to the network could exploit a Path Traversal vulnerability found...10.0 Critical
- salvoSalvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass7.5 High
- wwbn avideoAVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration4.3 Medium
- nltk, red hat lightspeed core, openshift lightspeed +4 more +6 moreNLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite8.1 High
- wgstart wgcloudThere is an arbitrary file read vulnerability in the test connection function of backend database...7.5 High
- No product listedA path traversal vulnerability in /ftl/web/setup.cgi in Small Cell Sercomm SCE4255W (FreedomFi...6.5 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 morePath Traversal Vulnerability in mlflow/mlflow8.1 High
- linuxfoundation tekton pipelines, tektoncd pipeline, red hat builds for red hat openshift +9 more +11 moreTekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod9.6 Critical
- b3log siyuanSiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home6.8 Medium
- mesop-dev mesopMesop: Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion10.0 Critical
- statamic cms, statamic +1 moreStatamic has a path traversal in file dictionary fieldtype4.3 Medium
- qameta allure report, allure-framework allure2 +1 moreAllure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)8.6 High
- apostrophecms import-exportApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction10.0 Critical
- python software foundation cpythonpkgutil.get_data() does not enforce documented restrictions0.0 None
- h3js h3h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments8.2 High
- jenkins, red hat openshift developer tools and services 4.12, openshift developer tools and services 4.13 +9 more +11 moreJenkins has a link following vulnerability allows arbitrary file creation8.8 High
- anyscale ray, red hat ai inference server 3.2, enterprise linux ai (rhel ai) 3 +3 more +5 moreRay Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure8.7 High
- wazuhWazuh has Privilege Escalation to Root via Cluster Protocol File Write9.1 Critical
- b3log siyuanSiYuan has an Arbitrary File Read in its Desktop Publish Service9.9 Critical
- agent0ai agent-zerofrdel/agent0ai agent-zero files.py get_abs_path path traversal5.3 Medium
- taoofagi easegen-admintaoofagi easegen-admin Pdf2MdUtil.java recognizeMarkdown path traversal5.1 Medium
- oracle linuxA DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.5.5 Medium
- ctfer-io romeoRomeo is vulnerable to Archive Slip due to missing checks in sanitization8.3 High
- zwickroell gmbh & co. kg test data managementZwickRoell Test Data Management < 3.0.8 Path Traversal LFI8.7 High
- ctfer monitoringMonitoring is vulnerable to Archive Slip due to missing checks in sanitization8.8 High
- filebrowserFile Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter6.5 Medium
- b3log siyuanSiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes6.8 Medium
- b3log siyuanSiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write7.6 High
- b3log siyuanSiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets6.8 Medium
- craftcms cms, craft cms +1 moreCraft CMS has a Path Traversal Vulnerability in AssetsController5.3 Medium
- Show moreLoading…