CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- givanz vvvebVvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global8.8 High
- givanz vvvebVvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter5.4 Medium
- dataease sqlbotSQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing7.3 High
- frappe lmsFrappe LMS: Path Traversal in SCORM File Serving8.7 High
- grafana enterprise, oss +1 moreCVE-2026-15815 CVE Record8.8 High
- chamilo chamilo-lmsChamilo LMS CStudio upload flow allows unauthenticated remote code execution9.8 Critical
- verizon cloud for androidVerizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity6.9 Medium
- brufdev many-notesMany Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults9.6 Critical
- midnightbsd mportmport sample file handling can write outside the configured root6.0 Medium
- midnightbsd mportmport package bundle downloads allow unsafe destination filenames8.3 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Argument and connection-string injection via the database field in the Backup tool8.7 High
- francoisjacquet rosariosisRosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter7.1 High
- infiniflow ragflowRAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal5.3 Medium
- dell openmanage server administrator, openmanage server administrator managed node (patch) for windows, openmanage server administrator managed node for rhel 8.10 +3 more +5 moreDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation...6.5 Medium
- red hat exploit intelligence, build of apicurio registry 3, build of quarkus +4 more +6 moreSmallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver5.3 Medium
- patriksimek vm2vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching2.3 Low
- hubzero hubzero-cmsHUBzero CMS through 2.2.32 Path Traversal via File Upload8.7 High
- cjbi admin3admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename7.2 High
- dell openmanage server administrator, openmanage server administrator managed node (patch) for windows, openmanage server administrator managed node for rhel 8.10 +3 more +5 moreDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation...7.5 High
- comfy-org comfyuiComfyUI before 0.30.0 Path Traversal via dataset save nodes8.5 High
- decaporg decap-cmsDecap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching9.3 Critical
- uber krakenUber Kraken through 0.1.29 Path Traversal via tag parameter8.7 High
- bc security empireBC Security Empire before 6.7.1 Path Traversal File Upload RCE8.7 High
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 moreCisco Identity Services Engine Arbitrary File Deletion Vulnerability4.9 Medium
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 moreCisco Identity Services Engine Arbitrary File Write Vulnerability4.9 Medium
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 moreCisco Identity Services Engine Arbitrary File Read Vulnerability4.9 Medium
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 moreCisco Identity Services Engine Information Disclosure Vulnerability5.3 Medium
- cisco nexus dashboardCisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Limitation of a Pathname8.8 High
- hp inc ac print & scan, output central +1 moreHP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write8.8 High
- apache nifi, apache software foundation nifi registry +1 moreApache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles7.2 High
- redocly redocly-cliRedocly CLI: Path traversal when using `split` command4.4 Medium
- junrarJunrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root3.7 Low
- stamusnetworks sciriusScirius through 3.8.0 Arbitrary File Write via PCAP Upload7.2 High
- oras-project oras-gooras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)8.8 High
- stanfordnlp stanzaStanza: Zip Slip Path Traversal in Model/Resource Extraction7.8 High
- jenkins project robot framework pluginJenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory...8.8 High
- jenkins project pipeline: groovy libraries pluginJenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the...4.2 Medium
- octopus deploy serverIn affected versions of Octopus Server, a user with permission to modify non built-in external...8.7 High
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal6.8 Medium
- oracle corporation graalvm for jdk, oracle graalvmVulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component:...8.1 High
- zereight gitlab-mcp@zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover9.8 Critical
- tencent mass service engine in cluster (msec)Tencent Mass Service Engine in Cluster (MSEC) path traversal9.3 Critical
- http4sHttp4s: ResourceService and Webjar Service path escape via percent-encoded separators5.9 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.78.7 High
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +7 more +9 morePodman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers4.5 Medium
- unclecode crawl4aicrawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy8.7 High
- flowiseai flowiseFlowise before 3.1.4 Remote Code Execution via SQL Database Chain8.7 High
- developers italia design-scuole-wordpress-themePath traversal vulnerability in WordPress theme design-scuole-wordpress-theme8.7 High
- wandbWeights & Biases wandb before 0.29.0 Path Traversal via File Download8.7 High
- flextypeFlextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API7.2 High
- Show moreLoading…