CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- nationalsecurityagency ghidraGhidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server6.3 Medium
- nationalsecurityagency ghidraGhidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import8.4 High
- nationalsecurityagency ghidraGhidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names8.4 High
- nationalsecurityagency ghidraGhidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution4.6 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero1.2 Low
- qnap license centerLicense Center4.6 Medium
- adobe c2pa, c2pa-web, content credentials js sdk +1 more +3 moreCAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)5.5 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)8.8 High
- microsoft visual studio code, visual studio code copilot chat extension +1 moreMicrosoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability8.4 High
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Remote Code Execution Vulnerability6.5 Medium
- microsoft azure kubernetes serviceAzure Kubernetes Service (AKS) Remote Code Execution Vulnerability8.8 High
- omnissa workspace one® assist for macosOmnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability.7.8 High
- nesquena hermes-webuiHermes WebUI < 0.51.296 Workspace Boundary Bypass via api/workspace.py6.3 Medium
- apptha mac photo galleryWordPress Plugin Mac Photo Gallery 3.0 Arbitrary File Download8.7 High
- apptha slider gallery, appthaplugins apptha slider gallery +1 moreWordPress Plugin Apptha Slider Gallery 1.0 Path Traversal File Download8.7 High
- typo3 cmsTYPO3 CMS - Broken Access Control in Media Module7.1 High
- typo3 cmsTYPO3 CMS - Broken Access Control in File Abstraction Layer2.1 Low
- red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +3 more +5 moreAwxkit: path traversal via yaml !include directive4.7 Medium
- apache apache-airflow-providers-samba, apache software foundation airflow samba provider +1 moreApache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names6.5 Medium
- huawei harmonyosPath traversal vulnerability in the SMS app. Impact: Successful exploitation of this...5.4 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux5.9 Medium
- No product listedAn arbitrary file deletion vulnerability in the /api/delete-temp-license/{file} endpoint of...5.3 Medium
- No product listedAn unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3...8.8 High
- basekick-labs arcArc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks7.1 High
- tale headplaneHeadplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user8.1 High
- openbullet openbullet2OpenBullet2 0.3.2 Path Traversal via Wordlist Endpoint8.7 High
- adguardteam adguardhomeAdGuard Home Authentication Bypass via Path Traversal in Admin-Token Cookie9.2 Critical
- nlnet labs routinatorRoutinator cache path traversal using rogue rsync URIs8.3 High
- webkul bagistoPath Traversal Vulnerability in Bagisto8.7 High
- brooks24 admin-word-count-columnWordPress Plugin admin-word-count-column 2.2 Local File Read6.9 Medium
- hs-web hsweb-frameworkhs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal5.3 Medium
- jishenghua jsherpjishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal5.3 Medium
- iai lab pdf ai appiAI Lab PDF AI App chatpdf.pro getExternalCacheDir path traversal4.8 Medium
- davidfcarr quick playgroundQuick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter4.4 Medium
- thimpress learnpress – backup & migration toolLearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter4.9 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export4.9 Medium
- wpusermanager wp user manager – user profile builder & membershipWP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter7.5 High
- jxxghp moviepilotMoviePilot Path Traversal via Cloud Storage Download Handlers7.2 High
- altium 365, enterprise server +1 morePath Traversal in Altium Projects Service Allows Arbitrary File Read8.3 High
- altium 365, enterprise server +1 morePath Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code Execution10.0 Critical
- altium enterprise serverPath Traversal in Altium Enterprise Server Collaboration Service Allows Privilege Escalation9.4 Critical
- altium enterprise server, on-prem enterprise server +1 morePath Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File Read10.0 Critical
- altium enterprise server, on-prem enterprise server +1 morePath Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write9.4 Critical
skillctlcrates.ioskillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion7.1 High- haxtheweb haxcms-php, haxcms-nodejs +1 morehaxcms-php Local File Inclusion via saveOutline API Location Parameter v2.06.5 Medium
- altium enterprise server, on-prem enterprise server +1 moreUnauthenticated File Exfiltration in Altium Enterprise Server Vault Service via Hard-coded Cryptographic Key and Path Traversal10.0 Critical
- nasa-ammos ait-coreNASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)9.1 Critical
- dbgateDbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE9.3 Critical
- nocodbNocoDB: Path Traversal via SQLite Source Filename5.3 Medium
- siderolabs omniOmni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic2.7 Low
- Show moreLoading…