CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- wp chill download monitorWordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability4.4 Medium
- elightup meta box – wordpress custom fields frameworkWordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability6.8 Medium
- vitejs vite, voidzero vite\+ +1 moreVite: `server.fs.deny` bypass on Windows alternate paths8.2 High
- babelBabel: Arbitrary File Read via sourceMappingURL Comment in @babel/core3.2 Low
- cisco catalyst sd-wan managerCisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability6.5 Medium
- husain hb audio gallery liteWordPress Plugin HB Audio Gallery Lite 1.0.0 Path Traversal File Download8.7 High
- chrishurst simple backupWordPress Simple-Backup 2.7.11 Arbitrary File Deletion and Download8.7 High
- intelbras invu 7016 ftIntelbras iNVU 7016 FT Web syslog path traversal5.1 Medium
- microweberMicroweber API Endpoint thumbnail_img userfiles_path path traversal6.9 Medium
- No product listedAn issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via...7.5 High
- No product listedAn issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a...9.8 Critical
- agile logix store locator wordpressAgile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal3.4 Low
- grafana operatorOperator - Namespaced User Path Traversal6.4 Medium
- aurelienlws lws optimize – all-in-one speed booster & cache toolsWS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3.19 - Authenticated (Editor+) Arbitrary File Read4.9 Medium
- allegraAllegra exportReport Directory Traversal Information Disclosure Vulnerability6.5 Medium
- openclawOpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write Scope7.1 High
- filebrowserFile Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames6.8 Medium
- filebrowserFile Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope7.5 High
- nezhahq nezhaNezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key9.1 Critical
- mispMISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files5.3 Medium
- discourseDiscourse: Cross-site backup access via path traversal in multisite local backups6.8 Medium
esbuildnpmesbuild allows arbitrary file read when running the development server on Windows2.5 Low- actualbudget actualactual-server has a path traversal vulnerability5.3 Medium
- mattermost, mattermost server +1 moreCVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync7.6 High
- kedro-org kedro-org/kedro, linuxfoundation kedro +1 morePath Traversal in kedro-org/kedro7.1 High
- iei integration corp ivec tank-xm811Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion5.3 Medium
- iei integration corp ivec tank-xm811IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion7.2 High
- iei integration corp ivec tank-xm811IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Read6.9 Medium
- @clerk express, free5gc udm, udr +29 more +31 moreA malicious actor with access to the network could exploit a Path Traversal vulnerability found...8.6 High
- paloaltonetworks idira privileged session manager, cyberark software, a palo alto networks company privileged session manager, vault +1 moreIdira Privileged Session Manager (PSM): Potential Code Execution due to an Incomplete Input Validation8.7 High
- mar10 wsgidavWsgiDAV encoded dot segments can escape filesystem share roots7.1 High
- apple macosA parsing issue in the handling of directory paths was addressed with improved path validation....5.5 Medium
- hapijs inert@hapi/inert: Static-file confinement bypass via sibling-prefix path5.3 Medium
- raszi tmp, node-tmp +1 moretmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/template8.2 High
- perryts perryPerry < 0.5.1159 Path Traversal via ArtifactReady WebSocket8.6 High
- keras, keras-team keras-team/keras, red hat openshift ai (rhoai) +1 more +3 morePath Traversal in keras-team/keras8.1 High
- traefik, red hat openshift dev spaces 3.30 +1 moreTraefik StripPrefix Route-Level Auth Bypass via Path Normalization7.8 High
- neuron soft golem oee mesPath traversal in Neuron Soft Golem OEE MES8.3 High
- spring integration, vmware spring integration +1 moreRemote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization7.1 High
- jelmer dulwichDulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload7.5 High
- palo alto networks cortex xsoarCortex XSOAR: Path Traversal Vulnerability4.8 Medium
- pdm-project pdmpdm: Path traversal in wheel installation via overridden write_to_fs8.4 High
- rikyoz bit7zbit7z: Path Traversal via Null Byte Injection from `gcount()` Off-by-One in `restoreSymlink()`3.6 Low
- fissionFission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory7.7 High
- julien040 anyqueryAnyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion7.3 High
- roxy-wiRoxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)8.1 High
- roxy-wiRoxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)8.1 High
- apptainerApptainer: Incorrect path matching for 'limit container paths' directive4.8 Medium
- roxy-wiRoxy-WI: Authenticated arbitrary file write on every managed load balancer (and downstream RCE) via WAF rule save `config_file_name`9.9 Critical
- kubev2v assisted migration agentAssisted-migration-agent: vddk tarball chained-symlink arbitrary file write9.6 Critical
- Show moreLoading…