CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- youdatasum cpas audit management systemYouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId8.7 High
- penta security systems wapplesPenta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer7.1 High
- kareadita kavitaKavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint8.7 High
- liukuo362573 yishaadminYiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint8.8 High
- orbiteam bscw serverOrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi8.7 High
- erzhongxmu jeewmsJeeWMS Path Traversal via showOrDownByurl.do8.7 High
- fanruan finereportFineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer9.3 Critical
- weaver network co., ltd. e-cologyWeaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload8.7 High
- woothemes diariseWooThemes Diarise 1.5.9 Local File Disclosure via download.php8.7 High
- metinfoMetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter8.7 High
- intermesh group-officeIntermesh Group-Office < 3.5.5 Path Traversal via compress.php8.7 High
- javo themes spotJavo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter8.7 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 morePatch: filename validation bypass in reversal fallback allows file creation outside the working directory5.5 Medium
- acf extended extendedWordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability6.5 Medium
- jupyter nbconvertnbconvert: File write via path traversal in cell output filenames8.8 High
- leomoon-studios wiki-goleomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal5.1 Medium
- leomoon-studios wiki-goleomoon-studios wiki-go API editor.go SourceHandler path traversal5.3 Medium
- leomoon-studios wiki-goleomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreOpenscap: openscap: arbitrary file write via path traversal in source datastream decomposition6.1 Medium
- apache software foundation pulsarApache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage7.7 High
- flipped-aurora gin-vue-admingin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint7.0 High
- storybookjs storybookStorybook dev server: devices on the same network can obtain the WebSocket token and write code into story files8.7 High
- storybookjs storybookStorybook: Missing origin validation in Storybook preview allows code injection from malicious websites8.6 High
- cisco emergency responder, unified communications manager, unity connection +1 more +3 moreCisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities7.8 High
- red hat build of apache camel for spring boot 4, enterprise linux 8, enterprise linux 9 +5 more +7 moreUndertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal3.7 Low
- bold grid weformsWordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability7.5 High
- polonel trudeskTrudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload5.3 Medium
- polonel trudeskTrudesk through 1.2.11 Path Traversal via Backup Delete and Restore API7.0 High
- dt42 berrynetDT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal5.1 Medium
- tenstorrent tt-metalTenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal5.3 Medium
- triggerdotdev trigger.devTrigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints8.6 High
- sveltejs kitSvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows8.7 High
- astral-sh uvAstral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction8.7 High
- r6410418 jackrong-llm-finetuning-guideR6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal5.3 Medium
- r6410418 jackrong-llm-finetuning-guideR6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal5.1 Medium
- djust-org djustdjust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool3.3 Low
- eyelock nano nxtEyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php8.7 High
- cherry team pluginCherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php8.7 High
- ian howatson memphis documents libraryMemphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview8.7 High
- aspose pdf exporterAspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php8.7 High
- aspose importer & exporterAspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php8.7 High
- aspose doc exporterAspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php8.7 High
- churchopeChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php8.7 High
- imithemes nativechurchNativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php8.7 High
- james charlesworth tinymce thumbnail galleryTinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php8.7 High
- totolinkA arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R ...9.1 Critical
- pypa virtualenvvirtualenv: Seed replacement does not contain metadata deletion paths4.5 Medium
- argoproj argo-cdArgo CD: A Jsonnet import can read files from the repo-server9.9 Critical
- google adk typescript (@google/adk)Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId9.1 Critical
- @apostrophecms import-export, apostrophecms apostrophe +1 moreApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test5.3 Medium
- Show moreLoading…