CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- roocodeinc roo-codeRooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal5.3 Medium
- dolibarr, dolibarr erp\/crm +1 moreDolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename8.8 High
- spring ai, vmware spring ai +1 moreArbitrary File Write via Path Traversal in ResourceCacheService5.9 Medium
- unitree robotics g1 eduUnitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal8.7 High
- elwerene libreoffice-convertlibreoffice-convert: path traversal / arbitrary file write6.5 Medium
- dangerblack n8n-node-sqlite3n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)6.1 Medium
- nltkNLTK through 3.10.3 Path Traversal via Model-Artifact APIs8.3 High
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Plugin Sandbox Path Traversal8.7 High
- eclipse foundation sw360In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipu…6.0 Medium
- volmarg personal-management-systemVolmarg Personal Management System Path Traversal via get-file Endpoint7.1 High
- flowintelFlowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection7.5 High
- blackms aistackblackms aistack Static File server.ts path traversal6.9 Medium
- flowintelFlowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing7.1 High
- wp manage ninja fluent boards proWordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability6.8 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Improper Path Limitation in XsltView9.8 Critical
- boxpositron with-context-mcpboxpositron with-context-mcp index.ts project_folder path traversal6.9 Medium
- bsmi021 mcp-file-context-serverbsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal6.9 Medium
- danielpopamd linkedin-ads-mcpdanielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal6.9 Medium
- No product listedA path traversal vulnerability exists in the built-in preview/development web server of Lektor <3...7.5 High
- No product listedThe static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to...9.8 Critical
- No product listedArbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File...8.1 High
- No product listedPath traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax...6.5 Medium
- No product listedA vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to...9.8 Critical
- spring integration, vmware spring integration +1 moreZipTransformer uses file_name header to build workDirectory path without sanitization5.4 Medium
- weblateorg weblateWeblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)7.7 High
- mage-aiMage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser_items Endpoint7.1 High
- zlmediakitZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision6.9 Medium
- izpackIzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entries7.4 High
- strategy11 formidable chartsFormidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter7.5 High
- rustdeskRustDesk Path Traversal via macOS Clipboard File-Paste6.9 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission5.4 Medium
- jordy meow ai engineAI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter7.7 High
- No product listedyx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are...7.5 High
- No product listedIn DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller...7.5 High
- No product listedPath traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and...7.5 High
- oscal-compass compliance-trestleTrestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)7.7 High
- eosphoros-ai db-gptDB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename9.3 Critical
- nvidia openshellNVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause a path...8.5 High
- that1drifter browse-mcpbrowse-mcp: Arbitrary file write via unconfined download and state paths8.6 High
- kaltura html5 video player, html5 libraryCVE-2026-199129.8 Critical
- nltkNLTK before 3.10.3 Path Traversal via Symlink Bypass8.2 High
- mervinpraison praisonaiPraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location7.1 High
- mervinpraison praisonaiPraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks7.1 High
- dekdee adobe-xd-mcpdekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversal6.9 Medium
- crater-invoice-inc craterCrater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint8.7 High
- liketrek trekliketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal6.3 Medium
- typo3 extension "mask"Path Traversal in extension "Mask" (mask)6.0 Medium
- sky co., ltd. skymec it manager, skysea client view +1 moreSKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this...5.8 Medium
- peerigon unzip-crx, unzip-crx-3 +1 morepeerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal4.8 Medium
- gitpython-developers gitpythonGitPython before 3.1.59 Path Traversal via separate-git-dir8.7 High
- Show moreLoading…