CWE-23: Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Also known as Zip Slip.
A kind of CWE-22 Path traversal.
From the CWE List. © The MITRE Corporation.
Newest
- advantech webaccess/nms, webaccess\/nms +1 moreAn attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's ...9.1 Critical
- advantech webaccess/nms, webaccess\/nms +1 moreAn attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's...9.8 Critical
- visam vbase editor, vbase web-remote module, vbase web-remote +2 moreVISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL...7.5 High
- vercel next.jsDirectory Traversal in Next.js versions below 9.3.24.4 Medium
- http4sLocal file inclusion vulnerability in http4s7.6 High
- horde groupware, groupware webmail edition, debian linux +2 moreThis vulnerability allows remote attackers to execute local PHP files on affected installations...6.3 Medium
- spring cloud config, vmware spring cloud config +1 moreDirectory Traversal with spring-cloud-config-server6.5 Medium
- 1up-lab oneup/uploader-bundle, 1up oneupuploaderbundle +1 moreRelative Path Traversal in oneup/uploader-bundle8.8 High
- siemens control center server (ccs), sinvr 3 central control server, sinvr 3 video server +2 moreA vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR...7.7 High
- siemens en100 ethernet module dnp3 variant, en100 ethernet module iec 61850 variant, en100 ethernet module modbus tcp variant +7 more +9 moreA vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100...5.3 Medium
- mikrotik routeros, tenable mikrotik routeros +1 moreRouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary...8.8 High
- juniper junos, juniper networks junos os +1 moreJunos OS: NFX150 Series, QFX10K Series, EX9200 Series, MX Series, PTX Series: Path traversal vulnerability in NFX150 and NG-RE leads to information disclosure.5.5 Medium
- androvideo advan vd-1 firmware, vd 1 firmware, geovision gv-vd8700 firmware +1 more +3 moreAdvan VD-1 allows users to download arbitrary files7.5 High
- qnap systems inc. photo stationRelative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before...4.3 Medium
- synology moments, photo moments +1 moreRelative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1...8.0 High
- mikrotik routerosMikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6...8.1 High
- humhub calendarRelative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2...4.3 Medium
- opensuse factory, suse linux enterprise server 15, obs-service-tar scm +2 moreobs-service-extract_file's outfilename parameter allows to write files outside of package directory4.3 Medium
- ics-cert lcds laquis scada, lcds laquis scada +1 moreLCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations...5.3 Medium
- opensuse open build servicepath traversal in obs-service-tar_scm3.1 Low
- emerson deltavDeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path...8.8 High
- ge mds pulsenet and mds pulsenet enterprise, mds pulsenet +1 moreDirectory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS...8.1 High
- ics-cert abb srea-01 and srea-50, abb srea-01 firmware, srea-50 firmware +2 moreIn ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A:...9.8 Critical
- medtronic 2090 carelink programmer, 2090 carelink programmer firmware, 29901 encore programmer +2 moreMedtronic 2090 Carelink Programmer Relative Path Traversal4.8 Medium
- gitlab, debian linux, gitlab community and enterprise editions +2 moreGitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI...8.8 High
- loytec lvis-3me firmwareA Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The...8.8 High
- 3s-smart software solutions codesys, codesys control rte, codesys control runtime embedded +4 more +6 more3S CoDeSys Relative Path Traversal10.0 Critical
- specviewSpecView Directory Traversal2.6