CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- wp media backwpup – wordpress backup & restore pluginBackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter7.2 High
- wkentaro gdowngdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall6.5 Medium
- haris-musa excel-mcp-serverImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-server9.4 Critical
- ubiquiti inc unifi play audio port, unifi play poweramp +1 moreA malicious actor with access to the UniFi Play network could exploit a Path Traversal...9.8 Critical
- gleam, red hat enterprise linux 10, enterprise linux 7 +2 more +4 moreImproper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification8.3 High
github.com/daptin/daptinGoDaptin has Unauthenticated Path Traversal and Zip Slip10.0 Critical- gramps-project gramps-web-apiGramps Web API has Zip Slip Path Traversal in Media Archive Import9.1 Critical
- xrootdXRootD: Path traversal in directory listing allows access to the parent directory via trailing ".." pattern5.3 Medium
- astral-sh uvAstral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries8.7 High
- chamilo lms, chamilo-lms +1 morePath Traversal (Arbitrary File Delete) in Chamilo LMS8.3 High
- saltcornSaltcorn has an Unauthenticated Path Traversal in sync endpoints allows arbitrary file write and directory read8.2 High
- mervinpraison praisonaiPraisonAI affected by arbitrary file write via path traversal in `praisonai recipe unpack`9.4 Critical
- danielgatis rembgRembg has a Path Traversal via Custom Model Loading5.3 Medium
- falkordb browserUnauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution9.8 Critical
- tenda i6, i6 firmware +1 moreTenda i6 HTTP R7WebsSecurityHandlerfunction path traversal6.9 Medium
- zhayujie chatgpt-on-wechat cowagentzhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal6.9 Medium
- perfmattersPerfmatters <= 2.5.9 - Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter8.1 High
- mervinpraison praisonaiagentsPraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary5.3 Medium
- helmHelm Chart extraction output directory collapse via `Chart.yaml` name dot-segment4.8 Medium
- flatpak flatpak-builderflatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files7.1 High
- openclawOpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image6.0 Medium
- tenda ch22, ch22 firmware +1 moreTenda CH22 httpd R7WebsSecurityHandlerfunction path traversal6.9 Medium
- helm, red hat helm cli 4.1 +1 moreHelm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory8.4 High
- hashicorp tooling, red hat openshift container platform 4, trusted artifact signer +1 more +3 moreGo-getter may allow to arbitrary filesystem reads through git operations7.5 High
- tenda i12, i12 firmware +1 moreTenda i12 HTTP path traversal6.9 Medium
- tenda i3, i3 firmware +1 moreTenda i3 HTTP R7WebsSecurityHandler path traversal6.9 Medium
- abrignoni aleappALEAPP NQ Vault Artifact Parser Path Traversal8.4 High
- sleuthkit the sleuth kit, sleuthkit +1 moreSleuth Kit tsk_recover Path Traversal8.4 High
- inc2734 mw wp formMW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys8.1 High
- agixtAGiXT has a Path Traversal in safe_join()8.8 High
- mervinpraison praisonaiPraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor8.7 High
- quarkiverse quarkus-openapi-generator, quarkus openapi generator +1 moreZip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class7.7 High
- elastic logstashImproper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write8.1 High
- harttle liquidjsLiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read6.3 Medium
- zauberzeug niceguiNiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization5.9 Medium
- danbilabs advanced members for acfAdvanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal8.8 High
- honoHono has a path traversal in toSSG() allows writing files outside the output directory5.9 Medium
- honoHono has a middleware bypass via repeated slashes in serveStatic5.3 Medium
- hono node-server@hono/node-server has a middleware bypass via repeated slashes in serveStatic5.3 Medium
- emmettEmmett has a path traversal in internal assets handler9.1 Critical
- flatpakFlatpak affected by arbitrary file deletion on the host filesystem8.7 High
- danny-avila librechatLibreChat Affected by Arbitrary File Write via `execute_code` Artifact Filename Traversal6.3 Medium
- wwbn avideoWWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs7.6 High
- vitejs vite, vite-plus, voidzero vite\+ +2 moreVite has a Path Traversal in Optimized Deps `.map` Handling6.3 Medium
- orangehrmOrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader4.6 Medium
openclawnpmOpenClaw: QQ Bot structured payloads could read arbitrary local files6.9 Medium- openclawOpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths6.1 Medium
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may...4.8 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has a Path traversal leads to RCE9.1 Critical
- moritzmyrz coursevault-previewPath traversal in coursevault-preview due to improper base-directory boundary validation5.1 Medium
- Show moreLoading…