CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- black lantern security bbotSymlink guard bypass in unarchive module allows planting symlinks during extraction3.1 Low
- filebrowserFile Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope6.3 Medium
- seaweedfsSeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read7.7 High
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0...2.7 Low
- omnissa workspace one® tunnel for windows, workspace one tunnel +1 moreOmnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.7.8 High
- sayantandas20 bulk order update for woocommerceBulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter5.3 Medium
- tombgtn simple coherent formSimple Coherent Form <= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter9.1 Critical
- jssor slider by jssor.comJssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter7.5 High
- zhenorzz goployGoploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise7.7 High
- zhenorzz goployGoploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare7.1 High
- dataeaseDataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management7.2 High
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0...9.8 Critical
- egroupwareRemote Code Execution Vulnerability in EGroupware8.7 High
- coollabsio coolifyCoolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE8.8 High
- hashicorp terraform enterprisePath traversal allows arbitrary file read in Terraform Enterprise container7.7 High
- langroidLangroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls9.3 Critical
- xhmikosr decompressdecompress: Archive extraction can create files and links outside the target directory9.1 Critical
- esri arcgis serverDirectory Traversal in ArcGIS Server9.8 Critical
- t-systems archivo, buroweb, estima +1 more +3 moreUnauthorized access to files in T-Systems products6.0 Medium
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 moreApache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)8.1 High
- nousresearch hermes-agentNousResearch hermes-agent skills_tool.py skill_view path traversal5.3 Medium
- ail-project ail-frameworkAuthenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Read7.1 High
- codeigniter ecommerce-codeigniter-bootstrapkirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager AddProduct.php do_upload_others_images path traversal5.3 Medium
- codeigniter ecommerce-codeigniter-bootstrapkirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversal6.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal6.9 Medium
- gitea open source git serverGitea repository dumps write release assets using unsafe path names5.3 Medium
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0...2.3 Low
- apache lucene.netApache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server8.9 High
- apache lucene.netApache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client8.9 High
- printcart web to print product designer for woocommercePrintcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion9.1 Critical
- web and print design ar for woocommerceAR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter7.5 High
- webandprint ar for wordpressAR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter7.5 High
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Arbitrary File Write via Path Traversal in Management Web UI8.6 High
- gravitlauncher launcherGravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler9.8 Critical
- leshchenko1979 fast-mcp-telegramfast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection9.4 Critical
@asymmetric-effort/nogginlessdomnpm@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write8.7 High- ajith-ab react-native-receive-sharing-intentreact-native-receive-sharing-intent Path Traversal via _display_name7.0 High
- cockpit-hq cockpitCockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php8.2 High
- electermelecterm: Path Traversal in Zmodem and Trzsz Download Filename Handling7.1 High
- drakkan sftpgoSFTPGo: Path confinement bypass in public browsable share partial ZIP download5.9 Medium
- tinypng – jpeg, png & webp image compressionTinyPNG <= 3.6.13 - Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post Meta8.1 High
- langroidLangroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read8.7 High
- langroidLangroid: Path traversal in the file tools allows read/write outside configured current directory7.1 High
- ubiquiti inc unifi access application, ui unifi access +1 moreA malicious actor with access to the network could exploit a Path Traversal vulnerability found...8.6 High
- ubiquiti inc unifi protect floodlight, ui protect floodlight firmware +1 moreA malicious actor with access to the network could exploit a Path Traversal vulnerability found...7.5 High
- ubiquiti inc unifi network applicationA malicious actor with access to the network and high privileges could exploit a Path Traversal...8.7 High
- ubiquiti inc cloud gateways, cloud keys, dream machines +40 more +42 moreA malicious actor with access to the network could exploit a Path Traversal vulnerability found...8.6 High
- saturdaydrive ninja forms - file uploadsNinja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter7.5 High
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'6.5 Medium
- perfmattersPerfmatters <= 2.6.4 - Unauthenticated Arbitrary File Read via 's' Parameter7.5 High
- Show moreLoading…