CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- roxy-wiRoxy-WI vulnerable to path traversal and arbitrary file writing8.9 High
- chainguard melangemelange has Path Traversal via .PKGINFO in --persist-lint-results4.4 Medium
- chainguard melangemelange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses6.1 Medium
- radare radare2radare2 < 6.1.4 Project Notes Path Traversal via Symlink6.9 Medium
- radare radare2radare2 < 6.1.4 Project Deletion Path Traversal Directory Deletion6.9 Medium
- zurich instruments labonePath Traversal Vulnerability in LabOne User Interface8.7 High
- zio ziostation2A path Traversal vulnerability exists in Ziostation2 v2.9.8.7 and earlier. A remote...8.7 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities4.9 Medium
- evomap evolverEvolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write8.1 High
- siyuan-note siyuanSiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint7.1 High
- mcphubMCPHub: Path Traversal via Malicious MCPB Manifest Name6.9 Medium
- flarum frameworkFlarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)4.9 Medium
- locize i18next-locize-backendPath traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend6.5 Medium
- espocrmEspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user9.1 Critical
- thexerteproject xerteonlinetoolkitsXerte Online Toolkits Path Traversal via connector.php7.1 High
- i18next i18next-fs-backendi18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite8.2 High
- i18next i18next-http-backendi18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns6.5 Medium
- i18next i18next-http-middlewarePrototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters8.6 High
- ci4-cms-erp ci4msci4ms Theme::upload is vulnerable to Zip Slip leading to RCE9.4 Critical
- ci4-cms-erp ci4msci4ms Backup::restore is vulnerable to Zip Slip leading to RCE9.4 Critical
- ddevDDEV has ZipSlip path traversal in tar and zip archive extraction6.5 Medium
- uutils coreutilsuutils coreutils rm Safeguard Bypass via Improper Path Normalization5.6 Medium
- uutils coreutilsuutils coreutils chmod Path Traversal Bypass of --preserve-root7.3 High
- python-poetry poetry, red hat ansible automation platform 2, ansible automation platform 2.6 +3 more +5 morePoetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.40.6 Low
- redhat instructlab, red hat enterprise linux ai (rhel ai) 3, redhat enterprise linux ai +2 moreInstructlab: instructlab: path traversal allows arbitrary directory creation and file write7.1 High
- doctorwp breaking news wpBreaking News WP <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Local File Inclusion/Read6.5 Medium
- get-hermes hermes web ui, nesquena hermes-webui +1 moreNesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_id7.2 High
- nesquena hermes-webuinesquena hermes-webui Arbitrary Workspace Directory Access5.3 Medium
- linuxfoundation tekton pipelines, tektoncd pipeline +1 moreTekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check5.4 Medium
- freescout-help-desk freescoutFreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE9.1 Critical
- crowdstrike logscale self-hostedCrowdStrike LogScale Unauthenticated Path Traversal9.8 Critical
- octobercms octoberOctober: Safe Mode Bypass via CSS Preprocessor Compilers4.9 Medium
- erlang otp, erlang\/otp, erlang\/ssh +2 moreSFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT5.3 Medium
- apktoolApktool: Path Traversal to Arbitrary File Write7.1 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace7.7 High
- jupyter nbconvertnbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding6.5 Medium
- jupyter nbconvertnbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames6.5 Medium
- gitlawb openclaudeOpenClaude has Sandbox Bypass via Early-Exit Logic Flaw that Allows Path Traversal8.4 High
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builderEverest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter8.1 High
- tomdever wpforo forumwpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path8.1 High
- openmage magento, magento-lts +1 moreOpenMage LTS has Path Traversal Filter Bypass in Dataflow Module4.9 Medium
- p2r3 convertp2r3 convert API buildCache.js Bun.serve path traversal5.3 Medium
- soniccloudorg sonic-serverSonicCloudOrg sonic-server File Upload Endpoint FileTool.java upload path traversal5.3 Medium
- teamt5 threatsonar anti-ransomwareTeamT5｜ThreatSonar Anti-Ransomware - Arbitrary File Deletion7.2 High
- transformeroptimus superagiTransformerOptimus SuperAGI Multipart Upload resources.py upload path traversal6.9 Medium
- No product listedComfyUI LoadImage Node folder_paths.py folder_paths.get_annotated_filepath path traversal5.3 Medium
- No product listedComfyUI Model Preview Endpoint model_manager.py get_model_preview path traversal5.3 Medium
- collabora kodexplorerkodcloud KodExplorer Public Share share.class.php initShareOld path traversal6.9 Medium
- charm wishWish has SCP Path Traversal that allows arbitrary file read/write9.6 Critical
ZioNuGetZio has SubFileSystem Path Confinement Bypass via Unresolved `..` Segment3.8 Low- Show moreLoading…