CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- python-poetry poetryPoetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write7.1 High
- sillytavernSillyTavern: Path traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root8.3 High
- sillytavernSillyTavern: Path traversal allows file existence oracle5.3 Medium
- sillytavernSillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory8.1 High
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Arbitrary File Write vis Path Traversal in Fireware Web UI8.6 High
- payloadcms payloadPayload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints6.5 Medium
- linuxfoundation onnxONNX: External Data Symlink Traversal5.5 Medium
- linuxfoundation onnxONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load4.7 Medium
- cisco nexus dashboard, nexus dashboard insights +1 moreCisco Nexus Dashboard Insights Arbitrary File Write Vulnerability4.9 Medium
- dell powerstore, powerstore 1000t, powerstore 1200t +11 more +13 morePowerStore, contains a Path Traversal vulnerability in the Service user. A low privileged...4.4 Medium
- dell secure connect gatewayDell Secure Connect Gateway (SCG) 5.0 Appliance and Application version(s) 5.28.00.xx to 5.32.00...4.7 Medium
- sanster iopaintSanster IOPaint File Manager file_manager.py _get_file path traversal6.9 Medium
- tinacms, ssw tinacms\/graphql +1 more@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions7.1 High
- tinacms, ssw tinacms\/cli +1 more@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions7.1 High
- openclawOpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter6.0 Medium
- linuxfoundation onnx, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreONNX: Path Traversal via Symlink8.7 High
- anthropic claude sdk for typescript, anthropics anthropic-sdk-typescript +1 moreClaude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories6.3 Medium
- cmsmadesimple cms made simpleCMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal5.1 Medium
- openclawOpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters7.1 High
- 3ds 3dexperience, dassault systèmes delmia factory resource manager +1 morePath Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x7.1 High
- scitokens, scitokens library +1 moreSciTokens: Authorization Bypass via Path Traversal in Scope Validation8.1 High
- basercmsbaserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE7.2 High
- intouchapp intouch contacts \& caller idAn arbitrary file overwrite vulnerability in InTouch Contacts & Caller ID APP v6.38.1 allows...8.4 High
- funambol zefiroAn arbitrary file overwrite vulnerability in Funambol, Inc. Zefiro Cloud v32.0.2026011614 allows...9.8 Critical
- zoraAn arbitrary file overwrite vulnerability in Zora: Post, Trade, Earn Crypto v2.60.0 allows...9.8 Critical
- peaksel animal sounds and ringtonesAn arbitrary file overwrite vulnerability in PEAKSEL D.O.O. NIS Animal Sounds and Ringtones v1.3...9.8 Critical
- uxgroupllc cast to tvAn arbitrary file overwrite vulnerability in UXGROUP LLC Cast to TV Screen Mirroring v2.2.77...9.0 Critical
- squareapps my locationAn arbitrary file overwrite vulnerability in Squareapps LLC My Location Travel Timeline v11.80...8.4 High
- funair fly is funAn arbitrary file overwrite vulnerability in FLY is FUN Aviation Navigation v35.33 allows...9.8 Critical
- triumph-adler mobile printAn arbitrary file overwrite vulnerability in PDF Reader App : TA/UTAX Mobile Print v3.7.2.251001...8.4 High
- No product listedA directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1...7.6 High
- openclawOpenClaw < 2026.3.24 - Sandbox Media Root Bypass via Unnormalized mediaUrl and fileUrl Parameters7.1 High
- tinacms, ssw tinacms\/graphql +1 more@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files8.1 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreNginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory6.9 Medium
- gotenbergGotenberg: Chromium deny-list bypass via case-insensitive URL scheme7.8 High
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 morePath Traversal Vulnerability in mlflow/mlflow9.6 Critical
- elecv2 elecv2pelecV2 elecV2P Wildcard log path.join path traversal6.9 Medium
- elecv2 elecv2pelecV2 elecV2P :key path.join path traversal6.9 Medium
- z-9527 adminz-9527 admin isImg Check upload.js uploadFile path traversal5.3 Medium
- sinaptik ai pandasaiSinaptik AI PandasAI sql_sanitizer.py is_sql_query_safe path traversal6.9 Medium
- iselectiSelect 1.4.0-2+b1 Local Buffer Overflow via key parameter8.6 High
- yasr screen readerYasr 0.6.9-5 Buffer Overflow via Command-line Parameter8.6 High
- ticalc texas instrument emulatorTiEmu 3.03-nogdb+dfsg-3 Buffer Overflow via ROM Parameter8.6 High
- langchain core, langchain-ai langchain, red hat openshift lightspeed +4 more +6 moreLangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions7.5 High
- mobile-next mobile-mcp, mobilenexthq mobile mcp +1 more@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools8.1 High
- langflowLangflow - Path Traversal Arbitrary File Write via upload_user_file8.8 High
- nec aterm wx3600hp firmware, nec platforms, ltd. aterm wx3600hp +1 morePath Traversal vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to wtite over...6.0 Medium
- theunwindai awesome llm appsA path traversal vulnerability exists in the awesome-llm-apps project in commit...7.5 High
- dovecot, open-xchange gmbh ox dovecot pro +1 moreWhen dovecot has been configured to use per-domain passwd files, and they are placed one path...5.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`4.3 Medium
- Show moreLoading…