CWE-22: Path traversal
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Also known as Improper Limitation of a Pathname to a Restricted Directory, Directory traversal, Path transversal.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- apple macosA path traversal issue was addressed with improved path validation. This issue is fixed in macOS...6.2 Medium
- apple macosA parsing issue in the handling of directory paths was addressed with improved path validation....8.2 High
- apple ipados, macos, visionos +2 more +4 moreThis issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and...10.0 Critical
- apple ipados, ios and ipados, iphone os +2 moreA path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7.2...6.2 Medium
- apple macosA path handling issue was addressed with improved validation. This issue is fixed in macOS Golden...7.8 High
- apple macosA path handling issue was addressed with improved validation. This issue is fixed in macOS Golden...7.7 High
- apple macosA path traversal issue was addressed with improved path validation. This issue is fixed in macOS...9.0 Critical
- danielgatis rembgRembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs8.6 High
- backstageBackstage catalog rules can be bypassed for URL locations using encoded path segments6.5 Medium
- zip-rs zip2zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)7.4 High
- apache software foundation sisApache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files5.5 Medium
- google mcp toolbox for databases (googleapis/mcp-toolbox)Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write9.3 Critical
- No product listedA path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API…6.5 Medium
- innotim software, telecommunications and consulting trade ltd. co. logsign siemArbitrary File Read in Innotim Software's Logsign SIEM6.5 Medium
- pgyer codefeverPGYER codefever URI Sanitizer doc.php _detail path traversal6.9 Medium
- apache camelApache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)5.4 Medium
- apache camelApache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory5.4 Medium
- halo-dev halohalo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal6.9 Medium
- No product listedNexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.9.8 Critical
- rcloneRclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim7.0 High
- rcloneRclone before 1.75.2 Path Traversal via serve webdav MKCOL8.7 High
- siyuan-note siyuanSiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix5.9 Medium
- siyuan-note siyuanSiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool6.9 Medium
- leon-ai leonLeon before commit 50df142 Path Traversal via /download model Command6.9 Medium
- ananthakumaran paisaPaisa before 0.7.8 Path Traversal via Editor and Sheet API8.8 High
- eventcatalog sdkeventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal4.8 Medium
- 1999azzar designer-mcp1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal5.3 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import6.0 Medium
- gitroomhq postiz-appPath traversal in post media lets any registered user read server files9.6 Critical
- owen2345 camaleon-cmsCamaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action8.7 High
- paolo geodirectoryGeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal6.4 Medium
fallownpm,fallow-clicrates.io,@fallow-cli/fallow-nodenpm +2 more +4 moreFallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root3.3 LowsetuptoolsPyPIsetuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description1.0 Low- ubiquitouslearning mllmUbiquitousLearning mllm Convertor __init__.py load_model path traversal4.8 Medium
- fallow-rs fallow, @fallow-cli fallow-node, fallow-rs fallow-cli +1 more +3 moreFallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root3.3 Low
- intranda goobi-viewer-corePath traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer9.8 Critical
- baserproject basercmsbaserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure6.5 Medium
- baserproject basercmsbaserCMS: Encoded path traversal bypass in the theme file API7.2 High
- aiven-open pghoardPGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write8.4 High
- codepeople music store – wordpress ecommerceMusic Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter7.5 High
- kiloview e3 firmwareKiloview E3 NDI Encoder Path Traversal6.0 Medium
- python software foundation cpythontar filter allows writing outside destination via empty-named symlink6.9 Medium
- lxc incusIncus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes9.4 Critical
- lepture mistuneMistune before 3.3.0 Path Traversal and XSS via Include Directive8.7 High
- lepture mistuneMistune before 3.3.0 Arbitrary Local File Read via Include Directive7.1 High
- lepture mistuneMistune before 3.3.0 Path Traversal via include Directive9.2 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-89.6 Critical
- checkmarx github.com/checkmarx/ast-cliast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory6.3 Medium
- jgraph drawio-desktopdraw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)5.6 Medium
- rsyslogRsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE8.1 High
- Show moreLoading…