CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- jelmer dulwichDulwich doesn't sanitize commit subjects in `porcelain.format_patch`3.3 Low
- emlogThe template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing...7.2 High
- getarcaneapp arcaneArcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane7.7 High
- jelmer dulwichDulwich has an arbitrary file write via NTFS-hostile tree entries on Windows8.8 High
- bkddfs shamefileShamefile has an arbitrary file read via shamefile.yaml in shame next5.5 Medium
- elastic kibanaPath Traversal in Kibana Leading to Unauthorized Deletion of User Accounts4.6 Medium
- hkuds deepcodeDeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py8.7 High
- musicplayerdaemon mpdMusic Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling8.7 High
- vllm-project vllm-project/vllmHardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control8.8 High
- oscal-compass compliance-trestlecompliance-trestle - jinja has an Arbitrary File Write via Path Traversal8.4 High
- oscal-compass compliance-trestlecompliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal6.9 Medium
- canonical multipassSFTP Server VM Escape in Canonical Multipass8.4 High
- pip maintainers pip, red hat exploit intelligence, lightspeed core +34 more +36 morepip can extract console_scripts and gui_scripts outside installation directory4.1 Medium
- acer nitrorsense v3NitroSense V3: Security Vulnerability Information8.5 High
- oisf suricataSuricata datasets: save to absolute filename can be bypassed when combined with load command4.4 Medium
- kata-containersKata guest escape: runtime-rs guest-root to host-root escape via virtiofs9.2 Critical
- microsoft ufoMicrosoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory8.1 High
- asyncssh project asyncsshAsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username8.2 High
- avaiga taipyTaipy 4.1.1 Path Traversal via ElementLibrary.get_resource()8.7 High
- mattermost legal hold, mattermost +1 morePath traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write.8.0 High
- 3clyp50 agent-zeroAgent Zero < 1.15 Path Traversal File Read via image_get API7.1 High
- jenkins credentials binding, jenkins project credentials binding plugin +1 moreJenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials7.5 High
- ibm aspera high-speed transfer endpoint, aspera high-speed transfer server +1 moreMultiple vulnerabilities in Aspera applications.6.5 Medium
- ibm langflow oss, langflow +1 morePath Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution9.8 Critical
- ibm infosphere optim test data fabricationInfoSphere Optim Test Data Fabrication is affected by Arbitrary File Read7.5 High
- saleswonder llc webinarignitionWordPress WebinarIgnition plugin < 4.08.253 - Arbitrary File Deletion vulnerability9.9 Critical
- ludwig you quickwebp – compress / optimize images & convert webp | seo friendlyWordPress QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly plugin <= 3.2.7 - Arbitrary File Deletion vulnerability9.9 Critical
- e4jvikwp vikbooking hotel booking engine & pmsWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Arbitrary File Deletion vulnerability8.6 High
- synology surveillance stationImproper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in...2.7 Low
- cloud foundry foundation bosh director, cloud foundry bosh +1 moreLocal Blobstore may allow arbitrary reads/deletes4.3 Medium
- raszi tmp, node-tmp +1 moretmp: Path Traversal via unsanitized prefix/postfix enables directory escape7.7 High
- No product listedNorthern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows...3.1 Low
- getkirby kirbyKirby: Pre-authentication path traversal and PHP file inclusion during user lookup8.8 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260509] - LFI in HTMLView layout parameter7.5 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260510] - Path traversal in com_media webservice endpoint5.9 Medium
- xyproto algernonAlgernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir8.2 High
- xyproto algernonAlgernon: Path traversal file write via savein()8.7 High
- openkm community edition, professional edition +1 moreOpenKM 6.3.12 Local File Inclusion via Admin Scripting6.9 Medium
- acrel electrical eems enterprise power operation and maintenance cloud platformAcrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform upfile path traversal6.9 Medium
- devolutions server, mariadb +1 moreMariaDB: path traversal in mbstream6.3 Medium
- bingos archive::tar, archive\ \, red hat enterprise linux 10 +8 more +10 moreArchive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory9.1 Critical
- c-rick jimeng-mcpc-rick jimeng-mcp api.ts generateVideo path traversal5.3 Medium
- dazeb markdown-downloaderdazeb markdown-downloader index.ts create_subdirectory path traversal5.3 Medium
- dazeb cline-mcp-memory-bankdazeb cline-mcp-memory-bank index.ts handleInitializeMemoryBank path traversal5.3 Medium
- debugmcp mcp-debuggerdebugmcp mcp-debugger server.ts handleGetSourceContext path traversal5.3 Medium
- softneta meddream pacs server premiumSoftneta MedDream PACS Server Premium 6.7.1.1 Directory Traversal8.7 High
- pcviewerPCViewer vt1000 Directory Traversal via GET Request8.7 High
- kenik kg-5260xxxx-il-(g)2, kg-5230das-il-g3, kg-5230tas-il-3 +5 more +7 morePath Traversal in Kenik cameras8.3 High
- spring ai, vmware spring ai +1 moreLLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API6.5 Medium
- acer nitrorsense v3NitroSense V3: Local Privilege Escalation (LPE) vulnerability8.5 High
- Show moreLoading…