CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- openclawOpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_get2.3 Low
- openclawOpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths6.3 Medium
- opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 moreOpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR8.4 High
- lsegal yardyard: Possible arbitrary path traversal and file access via yard server6.9 Medium
- daprDapr: Service Invocation path traversal ACL bypass8.1 High
- openclawOpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags8.9 High
- openclawOpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter7.1 High
- openclawOpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image4.9 Medium
- firebirdsql firebirdFirebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution10.0 Critical
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field7.5 High
- bytedance deerflow, deer-flow +1 moreByteDance DeerFlow Path Traversal and Arbitrary File Write via Bootstrap Mode7.1 High
- aguilatechnologies wp customer areaWP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file8.8 High
- prasathmani tinyfilemanagerprasathmani TinyFileManager POST Parameter filemanager.php path traversal5.3 Medium
- qihui jtbc5 cmsQihui jtbc5 CMS Code Endpoint manage.php path traversal5.3 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal7.5 High
- cubecartA path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an...5.1 Medium
- backupguard jetbackup – backup, restore & migrateJetBackup <= 3.1.19.8 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter4.9 Medium
- go-acme lego, red hat openshift dev spaces 3.28 +1 moreLego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider8.8 High
- flowiseFlowise - Path Traversal in Vector Store basePath Parameter4.9 Medium
- sqlalchemy makoMako: Path traversal via double-slash URI prefix in TemplateLookup7.7 High
- junrar, red hat fuse 7, jboss enterprise application platform 8 +1 more +3 moreJunrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix5.9 Medium
- psi-4ward psitransferPsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart7.5 High
- @fastify/static, fastify fastify-static +1 more@fastify/static vulnerable to path traversal in directory listing5.3 Medium
- shahinurislam career sectionCareer Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion8.8 High
- voidzero-dev vite-plus, voidzero vite\+ +1 more`vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`8.4 High
- hkuds openharnessOpenHarness Path Traversal Information Disclosure via /memory show7.1 High
- ocaml opam, debian linux, red hat enterprise linux 10 +1 more +3 moreIn OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to...7.3 High
- grafana lokiLoki Path Traversal - CVE-2021-36156 Bypass5.3 Medium
- weblateWeblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision5.0 Medium
- weblateWeblate: Arbitrary File Read via Symlink7.7 High
- weblateWeblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository6.8 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Multiple Remote Code Execution Vulnerability9.9 Critical
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 moreCisco Identity Services Engine Path Traversal Vulnerability4.9 Medium
- No product listedAn issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows...7.5 High
- designingmedia eleganzoEleganzo <= 1.2 - Authenticated (Subscriber+) Arbitrary Directory Deletion6.5 Medium
- wwbn avideoWWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters6.5 Medium
- wwbn avideoAVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo8.1 High
- nuget nugetgalleryNuGet Gallery: Arbitrary Blob Overwrite via Nuspec Confusion and URI Fragment Truncation9.6 Critical
- wwbn avideoWWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)8.7 High
- lfprojects zarfZarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write7.1 High
- goshsSFTP root escape via prefix-based path validation in goshs8.7 High
- jellyfinJellyfin: Potential RCE via subtitle upload path traversal + .strm chain10.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)7.7 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)8.6 High
- fortinet fortios, fortipam, fortiproxy +4 more +6 moreAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22]...5.4 Medium
- fortinet fortianalyzer, fortianalyzer cloud, fortimanager +1 more +3 moreAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability...5.4 Medium
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 moreAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability...6.2 Medium
- fortinet fortisandbox, fortisandbox cloud, fortisandbox paas +2 moreA improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in...6.2 Medium
- schneider electric powerchute™ serial shutdown, schneider-electric powerchute serial shutdown +1 moreCWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')...6.9 Medium
- apache pdfbox, apache software foundation pdfbox examples +1 moreApache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code4.3 Medium
- Show moreLoading…