CWE-23: Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Also known as Zip Slip.
A kind of CWE-22 Path traversal.
From the CWE List. © The MITRE Corporation.
Newest
- sonicwall email securityAn improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in...4.9 Medium
- file manager pro, file manager project manager, filemanagerpro file manager pro +1 more +3 moreFile Manager And File Manager Pro (Multiple Versions) - Directory Traversal9.9 Critical
- zkteco zkbio mediaZKTeco ZKBio Media Service Port 9999 download path traversal5.3 Medium
- artica tech proxy, articatech artica proxy +1 moreArtica Proxy Unauthenticated LFI Protection Bypass Vulnerability7.5 High
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions ...7.3 High
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 morePrivileged User using traversal to read system files9.6 Critical
- fortinet fortimanager, fortianalyzer +1 moreA relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0...8.6 High
- helmDependency management path traversal in helm6.4 Medium
- devfile registry-support, red hat openshift developer tools and services, openshift container platform 4 +1 more +3 moreRegistry-support: decompress can delete files outside scope via relative paths8.0 High
- dell unity, unity operating environment +1 moreDell Unity, versions prior to 5.4, contain a path traversal vulnerability in its...3.3 Low
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives5.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives2.8 Low
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL...5.3 Medium
- b&r industrial automation automation studioZip Slip Vulnerability in B&R Automation Studio Project Import6.3 Medium
- rapid software llc scada, rapidscada rapid scada +1 moreRelative Path Traversal in Rapid SCADA6.5 Medium
- jupyter jupyterlab, notebook, fedoraproject fedora +2 morePotential authentication and CSRF tokens leak in JupyterLab7.6 High
- jupyter language server protocol integration, jupyter-lsp jupyterlab-lsp +1 moreUnsecured endpoints in the jupyter-lsp server extension7.3 High
- lifplatforms lif auth server, lif-platforms lif-auth-server +1 moreLif Auth Server vulnerable to uncontrolled data in path expression4.2 Medium
- nvidia triton inference serverCVE7.5 High
- deepin deepin-compressor, linuxdeepin developer-center +1 moreZip Path Traversal in Deepin-Compressor9.3 Critical
- europeana repoxRelative Path Traversal in Repox7.5 High
- jeecg jimureportjeecgboot JimuReport image path traversal6.3 Medium
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, satellite 6.14 for rhel 8 +3 more +5 moreHub: insecure galaxy-importer tarfile extraction6.3 Medium
- fortinet fortiwlmA relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5...7.3 High
- telit cinterion bgs5, ehs5, els61 +17 more +19 moreA CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion...4.4 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter10.0 Critical
- parse community server, parse-community parse-server +1 moreParse Server may crash when uploading file without extension7.5 High
- aqua esolutions drive, aquaesolutions aqua drive +1 moreRelative path traversal in Aqua eSolutions9.9 Critical
- setelsa security conacwin cb, setelsa-security conacwin +1 moreRelative path traversal in Setelsa Security ConacWin CB7.5 High
- argoproj argo cd, argo-cd +1 morePath traversal allows leaking out-of-bound Helm charts from Argo CD repo-server5.0 Medium
- memorysafety sudo, sudo-rs +1 moresudo-rs Session File Relative Path Traversal vulnerability3.3 Low
- eclipse foundation rap, eclipse remote application platform +1 moreRemote Code Execution in Eclipse RAP on Windows7.6 High
- cecil, cecilapp cecilapp/cecil +1 moreRelative Path Traversal in cecilapp/cecil5.8 Medium
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 moreRelative Path Traversal in mintplex-labs/anything-llm8.7 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 12 +1 more +3 moreMicrosoft Exchange Server Remote Code Execution Vulnerability8.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +26 more +28 moreWindows Kernel Elevation of Privilege Vulnerability7.8 High
- keysight geolocation server, keysight technologies n6845a geolocation server +1 moreKeysight N6845A Relative Path Traversal7.8 High
- rockwell automation thinmanager thinserver, rockwellautomation thinmanager +1 moreRockwell Automation ThinManager ThinServer Path Traversal Vulnerability7.5 High
- zoom video communications, inc. client sdk, zoom software development kit +1 moreRelative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized...3.3 Low
- samrtsoft smartbpm.netSmartBPM.NET - Path Traversal6.5 Medium
- microsoft visual studio codeVisual Studio Code Spoofing Vulnerability6.6 Medium
- fortinet fortios, fortiproxy, fortiswitchmanager +2 moreA relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3,...6.2 Medium
- fortinet fortiadcA relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a...5.7 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreRelative Path Traversal in mlflow/mlflow10.0 Critical
- nongnu dmidecodeDmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance...7.1 High
- fortinet forticlient, forticlientwindows +1 moreA relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 -...7.1 High
- sap crm (webclient ui), customer relationship management s4fnd, customer relationship management webclient ui +2 moreHTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)5.4 Medium
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software Web UI Path Traversal Vulnerability6.5 Medium
- microsoft office for android, 365 copilot +1 moreOffice for Android Spoofing Vulnerability5.5 Medium
- fortinet fortios, fortiproxy +1 moreA relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2,...7.8 High
- Show moreLoading…