CWE-23: Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Also known as Zip Slip.
A kind of CWE-22 Path traversal.
From the CWE List. © The MITRE Corporation.
Newest
- github enterprise serverPath traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protections8.8 High
- auvesy-mdt autosave, autosave for system platform, mdt software a4sp +1 more +3 moreMDT AutoSave Relative Path Traversal7.5 High
- rockwell automation isagraf runtime, rockwellautomation aadvance controller, isagraf free runtime +14 more +16 moreRockwell Automation ISaGRAF5 Runtime Relative Path Traversal9.1 Critical
- yokogawa centum cs 3000, exaopc, yokogawa electric corporation centum vp +4 more +6 morePath traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa...8.8 High
- yokogawa centum cs 3000, exaopc, yokogawa electric corporation centum vp +4 more +6 moreThere is a path traversal vulnerability in CAMS for HIS Log Server contained in the following...8.1 High
- siemens comos, comos v10.2, comos v10.3 +1 more +3 moreA vulnerability has been identified in COMOS (All versions < V10.4.1). The COMOS Web component of...6.5 Medium
- frentix openolatPath Traversal in some REST methods leading to file upload to arbitrary places8.1 High
- sonicwall sma100, sma 200 firmware, sma 210 firmware +3 more +5 moreA relative path traversal vulnerability in the SMA100 upload funtion allows a remote...7.5 High
- goautodial, goautodial api +1 moreThe GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied ...8.8 High
- myscada mydesignermySCADA myDESIGNER7.3 High
- github enterprise serverPath traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read access6.5 Medium
- beckhoff automation twincat opc ua server, beckhoff tf6100 firmware, ts6100 firmware +2 moreBeckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server6.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreFile Traversal affecting SVG files on Nextcloud Server8.8 High
- rasaMaliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasa7.3 High
- civetweb, siemens sinec infrastructure network services +1 moreThe CivetWeb web library does not validate uploaded filepaths when running on an OS other than...9.8 Critical
- frentix openolatPath Traversal in Folder Component Leading to Local File Inclusion7.7 High
- vmware vcenter serverRhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of...5.3 Medium
- vmware vcenter server, cloud foundation +1 moreThe vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A...9.8 Critical
- sap netweaver, sap se netweaver (visual composer 7.0 rt) +1 moreSAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an...9.9 Critical
- aviatrix controllerAn issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a...9.8 Critical
- bblfsh bblfshdZipSlip vulnerability in bblfshd2.7 Low
- advantech webaccess/scada, webaccess\/scada +1 moreThe affected product is vulnerable to a relative path traversal condition, which may allow an...6.5 Medium
- isaacs node-tar, tar project tar, oracle graalvm +1 more +3 moreArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning8.2 High
- delta project deltaRelative Path Traversal in git-delta7.8 High
- advantech webaccess\/scadaAdvantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which...6.5 Medium
- facebook whatsapp business for android, whatsapp for android, whatsapp +1 more +3 moreA lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13...9.1 Critical
- qnap qts, quts hero +1 moreRelative Path Traversal Vulnerability in QTS and QuTS hero8.8 High
- sabnzbdCreation of files outside the Download Folder through malicious PAR2 files4.3 Medium
- esri arcgis geoevent serverArcGIS GeoEvent Server has a Directory Traversal security vulnerability.8.6 High
- esri arcgis earthArcGIS Earth has a File Parsing Directory Traversal Vulnerability7.8 High
- fossasia susi.ai, susi server +1 moreDirectory Traversal Vulnerability in SUSI.AI Server8.6 High
- anysupport, koino aquanplayer +1 moreAnySupport directory traversing vulnerability8.4 High
- vmware cloud foundation, vcenter server +1 moreThe vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server...9.8 Critical
- url-parse project url-parsePath traversal in url-parse5.3 Medium
- kubernetes java, java client +1 moreKubernetes Java client libraries unvalidated path traversal in Copy implementation9.1 Critical
- apache flinkApache Flink directory traversal attack: remote file writing through the REST API7.5 High
- siemens xhqA vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow...6.5 Medium
- citrix sd-wanUnauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions...9.8 Critical
- b. braun melsungen ag onlinesuite, bbraun onlinesuite application package +1 moreB. Braun OnlineSuite9.8 Critical
- pulsesecure pulse secure desktop clientA vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if...8.8 High
- eclipse vert.x, the eclipse foundation eclipse vert.x +1 morePath Traversal in Eclipse Vert9.8 Critical
- cisco nexus data brokerCisco Nexus Data Broker Software Path Traversal Vulnerability5.4 Medium
- facebook whatsapp business for ios, whatsapp for ios, whatsapp +1 more +3 moreA path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior...5.5 Medium
nhoustonnpmDirectory Traversal in nhouston5.3 Medium- rapid7 metasploit, metasploit framework +1 moreRapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump module8.1 High
- rapid7 metasploit, metasploit framework +1 moreRapid7 Metasploit Framework Relative Path Traversal in enum_osx module7.1 High
- spring cloud config, vmware spring cloud config, vmware tanzu spring cloud configuration (config) server +2 moreDirectory Traversal with spring-cloud-config-server7.5 High
- advantech webaccessAdvantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path...8.8 High
- advantech webaccessAdvantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path...9.8 Critical
- advantech webaccessAdvantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path...7.1 High
- Show moreLoading…