CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- moby buildkitBuildKit: Malicious client can bypass destination directory validation on local sources upload7.2 High
- moby buildkitLLB file operation can be tricked to remove /tmp directory contents3.3 Low
- moby buildkitMalicious client can bypass destination directory validation on local sources upload6.9 Medium
- home-assistant home assistant coreHome Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload9.0 Critical
- unknown bit formBit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal5.9 Medium
- No product listedDirectory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker...7.8 High
- No product listedDirectory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the...7.5 High
- No product listedDirectory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to...7.5 High
- apache mina sshdApache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows7.1 High
- apache mina sshdApache MINA SSHD: Path traversal in SCP file reception7.5 High
- freescout-help-desk freescoutFreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path4.9 Medium
- themexpert.com quix page builder pro extension for joomlaJoomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.18.7 High
- lharries whatsapp-mcp, verygoodplugins whatsapp mcp server +1 moreWhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration7.7 High
- datacycle-engine datacycle-coredataCycle Public Markdown Path Traversal Via /docs/*path7.5 High
- gtsteffaniak filebrowserFileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files7.7 High
- red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +10 more +12 morePulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport9.0 Critical
- servmask all-in-one wp migration and backupAll-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal6.5 Medium
- libgit2libgit2: Submodule path traversal4.3 Medium
- No product listedDirectory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit...7.8 High
- multiple open source open-iscsiremote limited file-write as root via discovery in open-iscsi6.9 Medium
- flatpak xdg-desktop-portalXDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal8.8 High
- croogo cmsCroogo CMS Admin File Manager FileManager.php isEditable path traversal5.3 Medium
- @fastify/http-proxy, fastify fastify\/http-proxy +1 more@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal8.7 High
- halo-dev halohalo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal5.1 Medium
- broadcom vmware avi load balancer, vmware avi load balancer +1 moreVMware Avi Load Balancer Directory Traversal Vulnerability8.8 High
proot-distroPyPIPRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs6.6 Medium- mkreyman mcp-memory-keeperMCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath6.2 Medium
- ibm langflow oss, langflow +1 morePath Traversal Vulnerability in API Request Component Content-Disposition Header Processing8.8 High
- ibm langflow oss, langflow +1 morePath Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass7.5 High
- ibm langflow oss, langflow +1 morePath Traversal in APIRequest Component via Content-Disposition Header9.9 Critical
- github enterprise serverPath traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths8.6 High
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter4.9 Medium
- saturdaydrive ninja forms - excel exportNinja Forms - Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal4.3 Medium
- openclawOpenClaw < 2026.5.18 Authorization Bypass via Glob Matching7.7 High
- wazuhWazuh: Unauthenticated Path Traversal in authd via Agent Group Name7.5 High
- arcadedata arcadedb, com.arcadedb arcadedb-engine +1 moreArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users7.1 High
- nuclioNuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container4.9 Medium
- avwo whistleWhistle: Path traversal8.7 High
- activepiecesActivepieces: Arbitrary file write in git-sync via path traversal and symlinks5.9 Medium
- manyfold3d manyfoldManyfold: Authenticated Path Traversal via File Rename7.1 High
- lenovo app storeA potential path traversal vulnerability was reported in Lenovo App Store, distributed...7.0 High
- microsoft promptyPrompty: Arbitrary File Read via ${file:path} Reference Expansion7.5 High
- microsoft kiotaKiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref7.1 High
- microsoft kiotaKiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName9.3 Critical
- microsoft kiotaKiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions9.3 Critical
- microsoft kiotaKiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF7.0 High
- No product listedLogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the...6.5 Medium
- No product listedDirectory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3...7.3 High
obsidian-local-rest-apinpmobsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete8.8 High- nvm-sh nvmnvm path traversal via a malicious mirror's LTS codename writes outside the alias directory2.1 Low
- Show moreLoading…