CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- coding-solo godot-mcptugcantopaloglu godot-mcp run_project index.js validatePath path traversal4.8 Medium
- makafeli n8n-workflow-buildermakafeli n8n-workflow-builder update_node_from_file server.cjs path traversal4.8 Medium
- No product listedOpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent...7.5 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Arbitrary File Write and Command Execution9.4 Critical
- mervinpraison praisonaiPraisonAI before 4.6.78 Path Traversal via Custom Commands6.8 Medium
- boldgrid w3 total cacheW3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter7.5 High
- webfactory under construction page (pro)UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter6.5 Medium
- elated-themes frappeFrappe: TarSlip RCE in Package Import8.6 High
- elated-themes frappeFrappe: Path Traversal via /backups Route6.9 Medium
- elated-themes frappeFrappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator7.1 High
- grokability snipe-itSnipe-IT: Path traversal vulnerability via CSV import `image` field6.5 Medium
- sooperset mcp-atlassianMCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment7.7 High
- sooperset mcp-atlassianMCP Atlassian: Arbitrary server-side file read via attachment upload7.7 High
notrinos/notrinos-erpPackagistNotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)8.8 High- mervinpraison praisonaiPraisonAI FastContext before 1.6.78 Path Traversal6.9 Medium
- mervinpraison praisonaiPraisonAI before 4.6.78 Path Traversal via ContextGatherer6.8 Medium
- mervinpraison praisonaiPraisonAI before 1.6.78 Path Traversal via config.toml6.9 Medium
- phpmyfaqphpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function5.1 Medium
- dell unisphere for powermaxDell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a path traversal...6.5 Medium
- apache software foundation iotdbApache IoTDB: Path Traversal in Pipe File Transfer Receiver9.1 Critical
- templatic1 hide my wp liteHide My WP Lite <= 1.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter7.5 High
- zhayujie cowagentzhayujie CowAgent Skill Installation service.py _add_package path traversal5.3 Medium
- halo-dev halohalo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal5.1 Medium
- No product listedAn unauthenticated path traversal vulnerability exists in the web management interface of WTI ...7.5 High
- psd-toolspsd-tools: arbitrary file write via smart-object filename4.6 Medium
- conda py-rattler, rattler cache +1 moreRattler vulnerable to package cache path traversal via conda package build string5.4 Medium
- siyuan-note siyuanSiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db7.7 High
- stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wpUsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field8.8 High
- mockoonMockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)6.5 Medium
- totolink x5000rTOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal6.9 Medium
- open-webui, openwebui open webui +1 moreopen-webui terminal proxy path traversal guard bypass via 9x encoded traversal7.7 High
- enchant97 note-markNote Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)8.6 High
phantom-audioPyPIPhantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths7.7 High- bitpressadmin bit form – contact form, payment forms, multi step forms, calculator & custom form builderBit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter7.1 High
- cloudfoundry bosh cli, cloudfoundry foundation bosh cli tool +1 moreblobs.yaml Path Traversal Allows File Writes8.5 High
- tumf mcp-text-editortumf mcp-text-editor text_editor.py _validate_file_path path traversal5.3 Medium
- rclonerclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories8.8 High
- rclonerclone archive extract allows S3 destination prefix escape via crafted archive paths5.0 Medium
- decompress project decompressdecompress before 4.2.2 contains an improper path containment check that enables directory...6.2 Medium
- appium, appium appium\/storage-plugin +1 moreAppium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin8.6 High
- ronf asyncsshAsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion5.9 Medium
- ronf asyncsshAsyncSSH: SCP Path Traversal to Arbitrary File Write8.1 High
- dspaceDSpace: Path Traversal possible in LDN message generation5.5 Medium
- dspaceDSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)5.5 Medium
- composerComposer: Arbitrary file write outside vendor via malicious transitive package name7.0 High
- composerComposer: Path traversal in package bin field lets dependencies chmod arbitrary host files6.1 Medium
- berriai litellmLiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')6.1 Medium
- lepture mistuneMistune: Arbitrary File Read via Include directive path traversal5.9 Medium
- copier-org copierCopier: trust-prefix bypass via path traversal runs tasks unprompted8.8 High
- black lantern security bbotPath traversal in github_workflows allows writing artifacts outside output directory3.1 Low
- Show moreLoading…