CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft visual studio codeVisual Studio Code Remote Code Execution Vulnerability9.6 Critical
- microsoft visual studio codeVisual Studio Code Information Disclosure Vulnerability6.8 Medium
- microsoft dynamics nav 2018Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability8.8 High
- abdurazaaq mohammed mp managerMP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass6.7 Medium
- fossify file managerFossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity4.6 Medium
- mucommandermuCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP5.6 Medium
- stonewuu ai-fusion-videoai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter5.3 Medium
- fortinet fortisiemA improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in...9.4 Critical
- risesoft-y9 digital-infrastructureDigital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile8.8 High
- risesoft-y9 digital-infrastructureDigital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream8.7 High
- ivanti xtractionA Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before...7.7 High
- ivanti xtractionA Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote...5.0 Medium
- commvault cloudHyperscale Path Traversal7.1 High
- No product listedYouTransfer Template Rendering template path traversal6.9 Medium
- wazuh wazuh-managerWazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file6.9 Medium
- wazuh wazuh-managerWazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions8.5 High
- wazuh wazuh-managerWazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers8.4 High
- wazuh wazuh-managerWazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers7.0 High
- nltkNLTK through 3.10.3 Path Traversal via WekaClassifier Model Path8.3 High
- nvidia aistore frameworkNVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction...8.1 High
- nvidia aistore frameworkNVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated...7.5 High
- nvidia aistore frameworkNVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename...8.1 High
- seldonio mlserverSeldonIO MLServer environment_tarball env.py _extract_env path traversal5.3 Medium
- No product listedDeepPavlov Model Download untar path traversal5.3 Medium
- composerMosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal5.3 Medium
- jbardin scp.pyjbardin scp.py SCP Receive _recv_pushd path traversal5.3 Medium
- siemens .net client library for simatic s7 webserver apiA vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers…8.7 High
- microsoft office appPolaris Office App Document Intake com.infraware.service.m.n.a path traversal4.8 Medium
- No product listedDirectory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000...9.8 Critical
- ericlbuehler mistral.rsEricLBuehler Mistral.rs handlers.rs calibration_apply path traversal6.9 Medium
- ibm tririga application platformSecurity Vulnerability identified in IBM TRIRIGA - Zip Slip8.8 High
- ibm planning analyticsIBM Planning Analytics Local is affected by security vulnerabilities7.5 High
- ibm planning analyticsIBM Planning Analytics Local is affected by security vulnerabilities8.2 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data Path Traversal9.6 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data Path Traversal9.6 Critical
- gohugoio hugoHugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver6.7 Medium
- gohugoio hugoHugo before v0.167.0 Path Traversal via css.Sass Import Fallback6.7 Medium
- ibm maximo application suiteIBM Maximo Application Suite Information Disclosure7.5 High
- lukejacksonn servorServor 1.0.0 through 4.0.2 Unauthenticated Path Traversal via URL-Encoded Dot Segments8.7 High
- 0xjacky nginx-uiNginx UI: Auto backup name allows path traversal outside validated storage path6.3 Medium
- c4illin convertxConvertX: Path Traversal vulnerability leading to Arbitrary File Write8.1 High
- 9001 copypartycopyparty FTP: upload outside defined volumes (limited path traversal)5.3 Medium
- gleamPath traversal in Gleam via unvalidated package application names5.9 Medium
- progress software corporation marklogic serverPath traversal in Progress MarkLogic Server Query Console7.7 High
- librenmsLibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter5.3 Medium
- siyuan-note siyuanSiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path6.9 Medium
- freerdpFreeRDP before 3.32.0 Path Traversal via Clipboard cFileName2.1 Low
- progress software corporation marklogic serverPath traversal and privilege management flaws in Progress MarkLogic Server InfoStudio8.5 High
- erlang rebar3Path traversal in rebar3 via unvalidated dependency app names7.5 High
- hexpm hexPath traversal in Hex via unvalidated dependency app names7.5 High
- Show moreLoading…