CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- dromara lamp-clouddromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal6.9 Medium
- dromara lamp-cloudDromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal6.9 Medium
- dromara lamp-cloudDromara lamp-cloud Code Generator DefGenProjectController.java path traversal5.3 Medium
- budibase serverBudibase before 3.40.0 Arbitrary File Write via Path Traversal9.4 Critical
- triggerdotdev trigger.devTrigger.dev: Cross-tenant object read/write via path traversal in packet presign API8.1 High
- triggerdotdev trigger.devTrigger.dev: Cross-tenant object store read and write via URL path traversal8.2 High
- triggerdotdev trigger.devTrigger.dev: Cross-tenant payload poisoning via packet write + replay4.2 Medium
- ibm documentation offlineIBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution7.5 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager4.3 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager2.7 Low
- ibm iIBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager3.8 Low
- ibm iIBM i is Affected By Multiple SQL Vulnerabilities [, ]8.5 High
- cyberpanelCyberPanel < 3.0.0 Path Traversal File Read via cloudAPI ReadReport6.9 Medium
- No product listedData::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalo…8.2 High
- rsyncproject rsyncrsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink9.2 Critical
- dep0we atomic-agents-stackatomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py8.7 High
- epc ai hubWordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability7.7 High
- daan.dev omgf proWordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability7.5 High
- roland barker participants databaseWordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability7.4 High
- spring framework, vmware spring framework +1 moreSpring Framework Path Traversal via Backslash in SpringTemplateLoader4.3 Medium
- red hat container native virtualization 4.12, container native virtualization 4.13, container native virtualization 4.14 +8 more +10 moreKubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host8.8 High
- rconfigrConfig < 8.2.13 Path Traversal File Read via FileDownloadController7.1 High
- ibm i access client solutionsIBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities8.8 High
- canonical lxdArbitrary file read+write on host via templates/ symlink in malicious image8.5 High
- canonical lxdPath traversal via unvalidated instance name in backup tarball restore enables root file write / RCE9.9 Critical
- ibm iIBM i is Affected By Multiple Vulnerabilities in Navigator for i6.5 Medium
- ibm iIBM i is Affected By Path Traversal Vulnerability in Navigator for i4.3 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in Navigator for i4.3 Medium
- progress whatsup goldWhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.6.8 Medium
- sshnet ssh.netSSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames7.1 High
- jfrog artifactoryAuthenticated users may write data outside the intended Docker cache path5.3 Medium
- jfrog artifactoryAuthenticated users may write files outside the intended Artifactory work directory4.3 Medium
- jfrog artifactoryRepository readers may access content outside configured upstream paths5.3 Medium
- seerr-team seerrSeerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag7.1 High
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.06.3 Medium
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.09.2 Critical
- snowflake python apisPath Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation8.1 High
- cisagov malcolmMalcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation5.3 Medium
- kekingcn kkfileviewkkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing5.3 Medium
- freecadFreeCAD: FCStd path traversal allows arbitrary file write via unsanitized file attribute in PropertyFileIncluded::Restore()7.8 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision8.1 High
- eosphoros-ai db-gptDB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header9.3 Critical
- redhat insights-client, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +4 more +6 moreInsights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path6.8 Medium
- electermelecterm's RDP clipboard file download may parse unsafe file name8.1 High
- electermelecterm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filename8.1 High
- electermelecterm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename8.1 High
- openbmb xagentXAgent Path Traversal Arbitrary File Read via /workspace/file8.7 High
- adobe lightroom, lightroom classic +1 moreLightroom Classic | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)8.6 High
- microsoft teams for android, teams +1 moreMicrosoft Teams Remote Code Execution Vulnerability8.8 High
- adobe c2pa, c2pa-web, c2patool +3 more +5 moreCAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)7.1 High
- Show moreLoading…