CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
local-operatorPyPIArbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit7.5 Highlocal-operatorPyPIPath traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator9.1 Critical- joomunited wp file downloadWP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter6.5 Medium
- arraytics eventinEventin < 4.1.21 - Contributor+ LFI via Event Layout Meta6.6 Medium
- samuel marshall jch optimizeJCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal2.7 Low
- sonicwall network security manager (nsm)A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and...9.1 Critical
- emlogEmlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE6.9 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components6.5 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components5.4 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components6.5 Medium
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components8.1 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components6.5 Medium
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components6.5 Medium
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components7.7 High
- plandex-ai plandexPlandex 2.2.1 Path Traversal via ApplyFiles8.5 High
- agentscope-ai agentscopeAgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skill8.7 High
- usebruno brunoBruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path7.1 High
- haris-musa excel-mcp-serverexcel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode9.3 Critical
- c4illin convertxConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives7.1 High
- firecrawl firecrawl-mcp-serverfirecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath8.7 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components6.5 Medium
- gfi software clearview, exinda ai +1 moreGFI Exinda AI / ClearView < 7.6.5 Path Traversal via Diagnostic File Deletion Handler7.0 High
- gfi software clearview, exinda ai +1 moreGFI Exinda AI / ClearView < 7.6.5 Path Traversal via Configuration Download Handler6.9 Medium
- siyuan-note siyuanSiYuan before v3.8.2 Path Guard Bypass via Case Mismatch7.1 High
- google cloud agent development kit (adk)Arbitrary File Read in Google Agent Development Kit (ADK)8.7 High
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path Traversal5.5 Medium
- eleveo quality managementEleveo Quality Management Questionnaire Service QuestionnaireService.runDataExportNow path traversal5.3 Medium
- openvpnThe Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated...5.6 Medium
- pleskPath traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to...8.5 High
- mit moos-ivpMOOS-IvP through 24.8.1 alog Splitting Path Traversal on Windows6.8 Medium
- domainaware parsedmarcparsedmarc 9.0.6 < 11.0.1 Path Traversal via Forensic Report Subject6.3 Medium
- rubyziprubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix8.7 High
- openlistteam openlistOpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool6.5 Medium
- eclipse foundation aeriosEclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability...8.8 High
- @fastify/http-proxy, fastify fastify\/http-proxy +1 more@fastify/http-proxy vulnerable to prefix escape via backslash dot-segments7.5 High
- reader tools pdf reader appReader Tools PDF Reader App File ActSplashNew.handleDeeplink path traversal4.8 Medium
- drupal media library importerMedia Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-1295.4 Medium
- jenkins project file parameter pluginJenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary...8.8 High
- jenkins project allure pluginA path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with...8.8 High
- jenkins project thinbackup pluginJenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration...7.1 High
- elastic kibanaImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion6.3 Medium
- elastic kibanaImproper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources7.3 High
- elastic kibanaStored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources6.5 Medium
- elastic maps serverImproper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure5.3 Medium
@humanfs/nodenpmhumanfs: Recursive copy follows symlinked files and copies data from outside the source tree5.7 Medium- progress software telerik ui for asp.net ajaxRadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX7.5 High
- bdthemes sigmaforms pro – ai generated formsSigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field9.8 Critical
- mapquest get directions appMapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt getDataColumn path traversal4.8 Medium
- joomunited wp file downloadWP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter8.1 High
- piwigoPiwigo Image Derivative i.php path traversal6.9 Medium
- Show moreLoading…