CWE-23: Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Also known as Zip Slip.
A kind of CWE-22 Path traversal.
From the CWE List. © The MITRE Corporation.
Newest
- trcore dvcTRCore DVC - Arbitrary File Read through Path Traversal7.5 High
- trcore dvcTRCore DVC - Arbitrary File Read through Path Traversal7.5 High
- fortinet fortianalyzer, fortimanager, fortianalyzer big data +2 moreAn improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability ...2.2 Low
- fortinet fortianalyzer, fortimanager, fortianalyzer big data +2 moreMultiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0...4.8 Medium
- d-link dsl6740c, dlink dsl6740c firmware +1 moreD-Link DSL6740C - Arbitrary File Reading through Path Traversal7.5 High
- webangon the pack elementor addonsWordPress The Pack Elementor addons plugin <= 2.0.9 - Local File Inclusion vulnerability7.5 High
- wellchoose administrative management systemWellchoose Administrative Management System - Arbitrary File Read through Path Traversal7.5 High
- litespeed technologies cache, litespeedtech litespeed cache +1 moreWordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability8.8 High
- james park analyse uploadsWordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerability8.6 High
- ragic enterprise cloud databaseRagic Enterprise Cloud Database - Arbitrary File Read through Path Traversal7.5 High
- splunk, splunk enterprise +1 morePotential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk8.0 High
- teamplus technology team+, teamplus team\+ pro +1 moreTEAMPLUS TECHNOLOGY Team+ - Arbitrary File Move through Path Traversal4.9 Medium
- teamplus technology team+, teamplus team\+, team\+ pro +2 moreTEAMPLUS TECHNOLOGY Team+ - Arbitrary File Read through Path Traversal7.5 High
- lollms, parisneo parisneo/lollms +1 morePath Traversal in api open_personality_folder in parisneo/lollms-webui4.4 Medium
- microsoft defender for endpoint, defender for endpoint for linux +1 moreMicrosoft Defender for Endpoint for Linux Spoofing Vulnerability5.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary...4.9 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was...4.9 Medium
- idurar project idurar, idurar idurar-erp-crm +1 moreIDURAR has a Path Traversal (unauthenticated user can read sensitive data)7.5 High
- cisco nexus dashboard fabric controller, data center network manager +1 moreCisco Nexus Dashboard Fabric Controller Remote Code Execution Vulnerability8.8 High
- pluck cms cms, pluck-cms pluckcms +1 moreAn incorrect limitation of a path to a restricted directory (path traversal) has been detected in...5.3 Medium
- backstageStorage bucket Directory Traversal in @backstage/plugin-techdocs-backend6.5 Medium
- microsoft windows server 2008 service pack 2, windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation) +14 more +16 moreWindows Remote Desktop Licensing Service Remote Code Execution Vulnerability7.1 High
- microsoft windows server 2008 service pack 2, windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation) +14 more +16 moreWindows Remote Desktop Licensing Service Information Disclosure Vulnerability6.5 Medium
- mobsf mobile security framework, mobile-security-framework-mobsf +1 moreMobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files8.0 High
- team johnlong software raiden maild remote management system, raidenmaild +1 moreTeam Johnlong software Raiden MAILD Remote Management System - Arbitrary File Reading through Path Traversal7.5 High
- stitionai devika, stitionai/devika +1 moreLocal File Inclusion in stitionai/devika7.5 High
- changing mobile one time passwordCHANGING Mobile One Time Password - Arbitrary File Reading4.9 Medium
- stitionai devika, stitionai/devika +1 moreDirectory Traversal in stitionai/devika7.5 High
- dell powerprotect dd, data domain operating system +1 moreDell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC...4.1 Medium
- toshiba tec corporation tec e-studio multi-function peripheral (mfp), toshibatec e-studio-2010-ac, e-studio-2015-nc +48 more +50 moreDirectory Traversal Remote Code Execution Vulnerability8.8 High
- hitachi energy fox61x, xmc20 +1 moreIf exploited an attacker could traverse the file system to access files or directories that...6.9 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreRemote Code Execution due to Full Controlled File Write in mlflow/mlflow10.0 Critical
- parisneo lollms-webui, parisneo/lollms-webui, lollms web ui +2 morePath Traversal in parisneo/lollms-webui4.0 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible6.5 Medium
- byron gitoxidegix traversal outside working tree enables arbitrary code execution8.8 High
- zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 moreMultiple arbitrary file writes in ZkTeco-based OEM devices10.0 Critical
- zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 moreMultiple arbitrary file reads in ZkTeco-based OEM devices7.5 High
- cyberpower powerpanel businessCyberPower PowerPanel business Relative Path Traversal8.8 High
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +8 more +10 moreWindows Hyper-V Remote Code Execution Vulnerability8.8 High
- freelancelot oceanicOceanic allows unsanitized user input to lead to path traversal in URLs6.5 Medium
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 moreRelative Path Traversal in mintplex-labs/anything-llm8.1 High
- zauberzeug niceguiLocal File Inclusion in NiceGUI leaflet component8.2 High
- acquia mauticRelative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder)8.1 High
- mintplex-labs mintplex-labs/anything-llm, mintplex-labs\/anything-llm, mintplexlabs anythingllm +2 morePath Traversal in mintplex-labs/anything-llm9.9 Critical
- abb symphony plus s+ analyst, symphony plus s+ engineering, symphony plus s+ operations +3 more +5 moreMalformed Packet Handling7.5 High
- cisco emergency responderA vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to...4.9 Medium
- cisco ios xe software, unified communications manager im and presence service +1 moreA vulnerability in the web-based interface of Cisco Unified Communications Manager IM & Presence...6.1 Medium
- dell openmanage enterpriseDell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. An...5.7 Medium
- jens-maus raspberrymaticRaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload10.0 Critical
- unitronics unilogic, unistream unilogic +1 moreUnitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-23: Relative Path Traversal8.8 High
- Show moreLoading…