CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- getgrav gravGrav CMS before 2.0.16 Path Traversal via media_directory7.1 High
- getgrav gravGrav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile7.1 High
- vrana adminerAdminer before 5.4.3 Arbitrary File Deletion via SQLite Drop7.2 High
- cloudreveCloudreve before 4.16.1 Path Traversal via Remote Download2.3 Low
- faveo helpdeskFaveo Helpdesk Logo SettingsController.php unlink path traversal5.1 Medium
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile6.9 Medium
- draytek corporation vigorap 1060c, vigorap 903, vigorap 906 +3 more +5 moreDrayTek VigorAP Multiple Models OS Command Injection via ExportSettings8.6 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: project archive extraction allows path traversal file writes7.2 High
- ransomlookRansomLook Arbitrary File Read via Path Traversal in Post screen Field8.2 High
- webpack webpack-dev-middlewarewebpack-dev-middleware before 7.4.6 and 8.3.0 Path Traversal via Non-Slash-Terminated publicPath8.3 High
- mercadopagoMercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients8.8 High
- radiustheme, llc shopbuilder pro – elementor woocommerce builder addonsWordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability8.6 High
- vanquish woocommerce file approvalWordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability8.6 High
- super forms forms, webrehab super forms +1 moreWordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability7.5 High
- canonical lxdInstance template path traversal allows arbitrary host file write as root9.9 Critical
- achorein expo-share-intentachorein expo-share-intent Android File Copy Routine ExpoShareIntentModule.kt getDataColumn path traversal4.8 Medium
- gitlabImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab8.5 High
- webtoffee woocommerce pdf invoices, packing slips, delivery notes & shipping labelsWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter6.5 Medium
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.210.0 Critical
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.28.7 High
- nltkNLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read8.7 High
- nltkNLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers8.2 High
- nltkNLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.28.7 High
- nltknltk IPIPANCorpusReader Symlink Arbitrary File Read6.8 Medium
- nltkNLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass2.0 Low
- siyuan-note siyuanSiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate8.4 High
- basekick-labs arcArc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive8.3 High
- runatlantis atlantisAtlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation8.1 High
- infracostInfracost: Arbitrary file read via config-template readFile symlink traversal5.9 Medium
- omnigent-ai omnigentOmnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE8.8 High
- zanllp infinite-image-browsingInfinite Image Browsing is_path_trusted Prefix Comparison Omits the Trailing Path Separator8.7 High
- yootheme.com zoo extension for joomlaJoomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.666.9 Medium
- yootheme.com yootheme pro extension for joomlaJoomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.407.0 High
- juicedata juicefsJuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory7.1 High
- siyuan-note siyuanSiYuan before v3.7.4 Path Traversal via packageName9.4 Critical
- misp misp-stixPath Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library8.8 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS4.8 Medium
- microsoft azure logic appsAzure Logic Apps Elevation of Privilege Vulnerability9.6 Critical
- louislam dockgeDockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion8.7 High
- apple containerA malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. Thi…4.3 Medium
- wintercms winterWinter CMS before 1.2.13 Local File Inclusion via JavaScript6.9 Medium
- wintercms winterWinter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets4.9 Medium
- laravel-backpack crudbackpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk8.1 High
- muxinc next-videonext-video: Unauthenticated arbitrary file read via /api/video request handler6.9 Medium
- automattic mongooseMongoose: Path traversal in SSI #include directives enables arbitrary file read6.5 Medium
- velero-io veleroVelero vulnerable to file path traversal when extracting from backup's tarball5.9 Medium
- victoriametricsVictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root6.8 Medium
- heimdall data database proxyHeimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability7.2 High
- masci banksBanks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root6.0 Medium
- Show moreLoading…