CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- openlistteam openlistOpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal7.6 High
- budibaseBudibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))9.0 Critical
- cloudreveCloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account4.3 Medium
- postcssPostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure7.5 High
- facelessuser pymdown-extensionsPyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path5.3 Medium
- microsoft kiotaKiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)6.1 Medium
- huggingface datasetsDatasets Path Traversal via Unsanitized file_name Metadata6.9 Medium
- ahujasid blender-mcpBlenderMCP Path Traversal via download_polyhaven_asset API6.0 Medium
- posimyththemes nexter blocks – gutenberg blocks, page builder & ai website builderNexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter4.3 Medium
- ne-lexa php-zipNe-Lexa php-zip ZIP ZipFile.php extractTo path traversal6.9 Medium
- microweberMicroweber CMS 2.0.20 Path Traversal via ServeStaticFileController8.7 High
- kubernetes kubernetes-client/javaPath traversal via non-tar copyDirectoryFromPod2.7 Low
- huggingface diffusersDiffusers Path Traversal via weight_map Arbitrary File Read5.3 Medium
- mesheryMeshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload8.7 High
- vanna-ai vannaVanna 2.0.2 Path Traversal via FileSystemConversationStore8.8 High
- svc-develop-team so-vits-svcSoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Route9.3 Critical
- h2oai h2ogpth2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API9.3 Critical
- voideditor voidVoid 1.3.4 Path Traversal via AI Agent File-Reading Tools6.0 Medium
- gongrzhe office-word-mcp-serverOffice-Word-MCP-Server 1.1.11 Path Traversal via document tools7.6 High
- postcssPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments7.5 High
- bold reports (by syncfusion) standalone report designerBold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload8.7 High
- bold reports (by syncfusion) standalone report designerBold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download9.3 Critical
- bold reports (by syncfusion) standalone report designerBold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font Processing9.3 Critical
- bold reports (by syncfusion) standalone report designerBold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing9.3 Critical
- siyuan-note siyuanSiYuan before v3.7.2 Path Traversal via /export/temp/7.1 High
- roland barker participants databaseWordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability10.0 Critical
- wp chill kali formsWordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability7.7 High
- videowhisper broadcast live videoWordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability5.3 Medium
- picture-gallery picture galleryWordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerability7.1 High
- gowebsmarty wp encryption – lifetime free ssl cert & https, force ssl / https redirect, ssl securityWP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter4.4 Medium
- regularlabs.com modals pro extension for joomlaJoomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension6.5 Medium
- regularlabs.com rereplacer pro extension for joomlaJoomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension7.5 High
- regularlabs.com cache cleaner pro extension for joomlaJoomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension6.5 Medium
- regularlabs.com cdn for joomla pro extension for joomlaJoomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension6.2 Medium
- regularlabs.com geoip extension for joomlaJoomla Extension - regularlabs.com - Zipslip in GeoIP extension9.8 Critical
- kilbot wcpos – point of sale (pos) plugin for woocommerceWCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter6.5 Medium
- @fastify/static, fastify fastify-static +1 more@fastify/static vulnerable to route guard bypass via path traversal7.5 High
- boazsegev facil.ioboazsegev facil.io Public Folder http.c http_sendfile2 path traversal6.9 Medium
- n8nn8n before 2.32.1 Path Traversal via computer-use search_files4.9 Medium
- n8nn8n before 1.123.67 Path Traversal via Git Node Operations7.1 High
- dompdfDompdf: Local file read due to improper file path validation in SVG images encoded as data-URI6.3 Medium
- dompdfDompdf: Chroot Validation Bypass2.3 Low
- analog way picturall quad compact mark iiCVE-2026-149857.8 High
- progress telerik ui for asp.net ajaxAppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- red hat ansible automation platform 2Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal6.6 Medium
- traefikTraefik before v2.11.52 Authentication Bypass via ReplacePathRegex7.8 High
- veeam backup and replicationA vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a...8.4 High
- vitest-dev vitestVitest: Browser Mode provider commands bypass the file-access permission gate9.4 Critical
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthenticated Path Traversal Vulnerability Leads to Remote Code Execution in AOS-CX7.2 High
- progress sharefile storage zones controllerPath traversal in Progress ShareFile Storage Zones Controller (SZC)8.7 High
- Show moreLoading…