CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- sslzen ssl zen — ssl certificate installer & https redirectsSSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter4.9 Medium
- unknown link libraryLink Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter4.1 Medium
- botslab g980hBotslab G980H Dashcams Improper Limitation of a Pathname to a Restricted Directory7.1 High
- chonkie-inc littrschonkie-inc littrs lib.rs mount path traversal5.3 Medium
langchain-nvidia-ai-endpointsPyPIlangchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs7.5 High- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal5.3 Medium
- docmostDocmost: Public image fileName path traversal leads to unauthorized local file read5.3 Medium
- docmostDocmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion7.1 High
- volotat anagnorisisvolotat Anagnorisis page.html start_streaming path traversal5.3 Medium
- discourseDiscourse: Reject literal backslash path separators in iframe src traversal guard7.2 High
- No product listedDbGate files-style Endpoint files.js fs.readFile path traversal5.3 Medium
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +9 more +11 morePulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft8.1 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities7.1 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm contextforge, contextforge mcp gateway +1 moreIBM ContextForge MCP Gateway is affected by path traversal4.9 Medium
- havelsan liman mysPath Traversal in HAVELSAN's Liman MYS5.3 Medium
- delta electronics diaenergiePath Traversal in DIAEnergie9.1 Critical
- eesywp eesy id2wp – publish indesign html5eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter7.5 High
- papercut ng/mfPaperCut NG/MF: Remote Code Execution via Scan2Fax7.3 High
- unknown masterstudy lms wordpress pluginMasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget7.2 High
- yhx070424 shopxoyhx070424 ShopXO Ueditor Upload ueditor.php path traversal6.9 Medium
- No product listedMantisZip Preview MainWindow.UI.cs Path.Combine path traversal5.3 Medium
- weiqingwen spring-boot-forumweiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal5.3 Medium
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +8 more +10 moreOpenshift/console: openshift/console: unauthenticated path traversal in i18n locale handler7.5 High
- ibm concertMultiple Vulnerabilities in IBM Concert Software5.3 Medium
- wedevs wp user frontendWordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability6.5 Medium
- plex media serverPlex Media Server path traversal7.1 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: arbitrary write in host context via flatpak build-init6.5 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 extended lifecycle support +11 more +13 moreFlatpak: flatpak: arbitrary write access as root via extra-data extraction8.8 High
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability7.8 High
- abb mint workbench iMint Workbench I Path traversal Vulnerability8.2 High
- No product listedCyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through...6.5 Medium
- No product listedCyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the ...6.5 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities9.9 Critical
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities5.4 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities6.5 Medium
- joniles mpxjMPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers5.3 Medium
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)8.6 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path7.4 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport8.6 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials7.7 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)6.5 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call6.5 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue8.6 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)8.6 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files7.1 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: HTTP upload tools accept arbitrary server-local file paths8.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)8.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)8.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Arbitrary File Read via Upload Attachment Tools6.5 Medium
- Show moreLoading…