CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- cvat-ai cvatCVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes7.1 High
flowisenpm,flowise-componentsnpm +1 moreFlowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys7.2 High- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker...7.5 High
- nvidia triton inference serverNVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files...4.4 Medium
- veeam service provider consoleA vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management...9.0 Critical
- microck opencode-studioOpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music9.3 Critical
- perspective-dev perspectivePerspective 5.0.0 Path Traversal via cwd_static_file_handler8.7 High
- bilin software and informatics consultancy inc. humanist digital human resourcesPath Traversal Allows Arbitrary File Download in Bilin Software's HUMANIST Digital Human Resources6.5 Medium
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +1 more +3 moreA path traversal vulnerability in the CLI command used to execute configuration files in Zyxel...7.2 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8.1, jboss enterprise application platform expansion pack +1 more +3 moreWildfly-core: path traversal on wildfly domain controller4.4 Medium
- rocket.chatAn unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when...7.5 High
- blix email blue mail calendar appBlix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal4.8 Medium
- danpros htmlydanpros HTMLy Author Name htmly.php path traversal6.9 Medium
- danpros htmlydanpros HTMLy Admin Content Endpoint admin.php add_content path traversal5.3 Medium
- gitpython-developers gitpythonGitPython before 3.1.57 Arbitrary File Overwrite and Read7.2 High
- danpros htmlydanpros HTMLy Delete Username Endpoint htmly.php unlink path traversal5.3 Medium
- postcssPostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset6.3 Medium
- apache jena fusekiApache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions7.5 High
- openwrt luciOpenWrt luci-app-bmx7 Path Traversal via bmx7-info8.7 High
- getgrav gravGrav CMS before 2.0.11 Path Traversal via watermark8.7 High
- siyuan-note siyuanSiYuan before v3.7.3 Path Traversal via unvalidated avID8.3 High
- carazo import and export users and customersImport and export users and customers < 2.4.3 - Admin+ Arbitrary File Read4.9 Medium
- huggingface huggingface/transformersPath Traversal in huggingface/transformers7.1 High
- keras-team keras-team/kerasImproper Handling of HDF5 ExternalLinks in keras-team/keras6.5 Medium
- cubewp1211 cubewp frameworkCubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter7.5 High
- gm alex user access managerUser Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter7.5 High
- traefikTraefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass7.8 High
- freerdpFreeRDP before 3.29.0 Path Traversal via drive redirection5.3 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter8.1 High
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)4.9 Medium
- realmag777 huskyHUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view7.2 High
- palscode support genixSupport Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal5.3 Medium
- bitpressadmin bit integrations – form integration, webhook, spreadsheets, crm, lms & email automationBit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field7.5 High
guard-livereloadRubyGemsguard-livereload has a directory traversal vulnerability6.9 Medium- elyin gemini-bridgegemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode6.2 Medium
- copier-org copierCopier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)7.5 High
- contaoContao: Possible path traversal in job download URIs3.1 Low
- thumborThumbor has path traversal via post-validation URL decoding bypass in file_loader8.7 High
nltkDebian,python-nltkopenSUSE +1 moreNatural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)7.5 HighnltkDebianNatural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)7.5 High- apache zeppelinPath traversal in NotebookRepo note and folder path composition6.5 Medium
- apache kyuubiApache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases8.1 High
- comfy-org comfyuiComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration7.5 High
- comfy-org comfyuiComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read7.5 High
- codeigniter4CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames7.5 High
- persesPerses: Unvalidated project parameter enables filesystem path traversal7.1 High
- apache tikaApache Tika: Arbitrary Local File Read in ISArchiveParser5.9 Medium
- ibm langflow oss, langflow +1 moreLangflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints7.5 High
- masci banksBanks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document)7.5 High
- apache kyuubiApache Kyuubi: REST batch multipart upload path traversal allows controlled file write9.8 Critical
- Show moreLoading…