CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- altium 365, enterprise server +1 morePath Traversal in Altium Git Service Allows Remote Code Execution9.4 Critical
- oras-project oras-gooras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction7.1 High
land.oras:oras-java-sdkMavenland.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory0.0 None- gradio-app gradioGradio < 6.16.0 Path Traversal via FileExplorer.preprocess()8.7 High
easycorp/easyadmin-bundlePackagistEasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components5.3 Medium- horde impHorde IMP < 7.0.1 Path Traversal via Compose.php img src7.1 High
- hashicorp vault, vault enterprise +1 moreAudit Log Plugin Directory Guard Bypass via Legacy path Option4.4 Medium
- cisco catalyst center, catalyst center global manager +1 moreCisco Catalyst Center Arbitrary File Read Vulnerability7.5 High
- mycomplianceoffice mco, mycomplianceoffice +1 morePath Disclosure and Path Traversal in MCO5.1 Medium
- imagemagickImageMagick - Policy Bypass via Incorrect Path Validation4.8 Medium
- cap-go capgoCapgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy8.7 High
- offis dicom dcmtk toolkitOFFIS DCMTK Toolkit Path Traversal9.3 Critical
- offis dicom dcmtk toolkitOFFIS DCMTK Toolkit Path Traversal8.8 High
- ibm websphere application serverIBM WebSphere Application Server is affected by a Path Traversal vulnerability4.3 Medium
- cefsharpCefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder5.3 Medium
- hkuds vibe-tradingVibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type6.0 Medium
- hkuds vibe-tradingVibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier2.3 Low
- hkuds vibe-tradingVibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates7.2 High
- openbmb chatdevOpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete8.8 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)9.3 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)6.5 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)10.0 Critical
- gnome glib, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +35 more +37 moreGlib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive5.9 Medium
- sanko net::bittorrentNet::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadata5.3 Medium
- andrasweb pixmagix – wordpress image editorPixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameter6.5 Medium
- linuxcncrtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is...8.4 High
- zephyrproject zephyrPath traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read7.5 High
- apple ipados, macos, safari +5 more +7 moreA path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5...6.5 Medium
- google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 morePath Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder9.3 Critical
- snowflake cliSnowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction6.3 Medium
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution7.7 High
- videowhisper paid videochat turnkey siteWordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deletion vulnerability9.9 Critical
- frontaccountingFrontAccounting < 2.4.20 Path Traversal RCE via attachment upload8.7 High
- epiphyt embed privacyWordPress Embed Privacy plugin <= 1.12.3 - Arbitrary File Deletion vulnerability7.1 High
- spice-space spice-vdagent, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreSpice-vdagent: path traversal in file transfer via unsanitized filename4.4 Medium
- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal6.9 Medium
- gigamon gigavue-osGigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem.7.5 High
- No product listedRAGapp Knowledge File files.py FileHandler.remove_file path traversal5.3 Medium
- antlr antlr4antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal6.9 Medium
- pnpmpnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config8.2 High
- pnpmpnpm: patch-remove could delete project-selected files outside the patches directory7.1 High
- pnpmpnpm: hoisted install imports lockfile alias outside node_modules7.1 High
- daktronics dmp-5000, dmp-5000 firmware, dmp-8000 +3 more +5 moreDaktronics Controller Firmware Path Traversal9.3 Critical
@cardano402/mcp-servernpm@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url0.0 None- kestraKestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read7.7 High
better-helperjsnpmbetter-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server7.5 High- kestraKestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)7.7 High
- rustfsRustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection8.6 High
- wummel patoolPatool < 4.0.5 Path Traversal via safe_extract() Function5.3 Medium
- max-mapper extract-zipextract-zip unvalidated symlink path traversal8.6 High
- Show moreLoading…