CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- airasia move appAirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversal4.8 Medium
- facefusionfacefusion before 3.7.0 Path Traversal via Job Identifier8.7 High
- spartnernl laravel-excelLaravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path7.5 High
- @vitest mocker, vitest-dev vitest +1 moreVitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock5.9 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthenticated Path Traversal Vulnerabilities Lead to Remote Code Execution in AOS-CX7.2 High
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthenticated Path Traversal Vulnerability Leads to Remote Unauthorized Access to Files in AOS-CX6.5 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreUnauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX8.8 High
- honojs honoHono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory6.5 Medium
- arubanetworks fabric composerUnauthenticated Path Traversal in HPE Networking Fabric Composer API Endpoint Allows Unauthorized File Modification4.8 Medium
- elastic kibanaImproper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources7.3 High
pnpmnpmpnpm: pacquet trust-lockfile install can create dependency symlinks outside the project7.1 High- nvidia megatron bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization...7.8 High
- argneshu appium-mcp-serverappium-mcp-server through 0.1.61 Path Traversal in write_file and write_files_batch6.9 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag7.5 High
- sage employee self serviceA path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality...5.9 Medium
- dokployDokploy Settings application.ts writeTraefikConfigInPath path traversal9.4 Critical
- pnpmpnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install7.5 High
- pnpmpnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph7.1 High
- getkirby kirbyKirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling8.2 High
- getkirby kirbyKirby: Access to image files outside of the site root via path traversal in the media handling6.9 Medium
- ellite wallosWallos: Zip Slip path traversal in database restore writes files to webroot8.5 High
- flatpakFlatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream7.2 High
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change...8.8 High
- apache wicketApache Wicket: Path traversal in resource style/variation/locale5.3 Medium
- ilias-elearning e.v. iliasILIAS Arbitrary File Read via SOAP addFile7.1 High
- yaojingang geoflowyaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal5.1 Medium
- ash-project ash adminPath traversal in AshAdmin file uploads via unsanitized client filename8.3 High
- seacmsSeaCMS Comment Cache member.php del_pl path traversal5.3 Medium
- seacmsSeaCMS Avatar Upload member.php unlink path traversal5.3 Medium
- No product listedA path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read...7.5 High
- ajcloud ajy ipc firmwareAJCloud AJY IPC Firmware Path Traversal via jdbhttpd8.7 High
- admidioAdmidio before 5.0.12 Path Traversal via Photo ZIP Download2.1 Low
- faberon pakePake arbitrary file write via unsanitized download_file filename8.8 High
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore6.6 Medium
- coderaiser cloudcmdCloud Commander before 19.20.2 Directory Traversal via REST and Markdown9.3 Critical
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities7.5 High
- yamcsYamcs: Unauthenticated Directory Traversal7.5 High
- aquaproj aquaaqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory6.6 Medium
- builderio gpt-crawlergpt-crawler Arbitrary File Write via outputFileName Parameter8.8 High
- qwenlm qwen-agentQwen-Agent Arbitrary File Read via Caller-Supplied Document Path8.7 High
- gilbertchen duplicacyDuplicacy Path Traversal during Restore via Unsanitized Snapshot Paths6.1 Medium
- houtini-ai houtini-lmhoutini-ai houtini-lm code_task_files index.ts path traversal5.1 Medium
- iswalle getnote-mcpiswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal5.3 Medium
- siyuan-note siyuanSiYuan before v3.8.1 Path Traversal via asset.upload6.9 Medium
- composerComposer: CVE-2026-59946 fix bypass via symlinked package bin path6.1 Medium
- No product listedfile_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to...3.3 Low
- wazuhWazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)9.1 Critical
- wazuhWazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion8.1 High
- maa-ai maamcpMAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal5.1 Medium
- arben-adm mcp-sequential-thinkingarben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal5.3 Medium
- Show moreLoading…