CWE-26: Path Traversal: '/dir/../filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory.
A kind of CWE-23 Relative Path Traversal.
From the CWE List. © The MITRE Corporation.
Newest
- givanz vvveb Vvveb: Path Traversal in nextRestore() and nextBackup() 8.7 High
- webrehab super forms – drag & drop form builder Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter 9.1 Critical
- splunk, splunk enterprise +1 more Path Traversal through the Lookup Configuration REST API in Splunk Enterprise 8.8 High
- siemens sinec ins A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected... 5.3 Medium
- codingjoe django-s3file django-s3file: Relative path traversal 9.9 Critical
- tum navigatum NavigaTUM has a Path Traversal Vulnerability in the propose_edits functionality 8.8 High
- mahara Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font... 6.5 Medium
- rommapp romm RomM vulnerable to Authenticated Path Traversal 8.3 High
- humansignal label-studio Label Studio has a Path Traversal Vulnerability via image Field 8.7 High
- huawei emui, harmonyos +1 more Vulnerability of serialisation/deserialisation mismatch in the iAware module. Impact: Successful... 6.8 Medium
- delinea centrify pas, privileged access service +1 more Arbitrary Directory Listing in Centrify PAS 5.0 Medium
- delinea centrify pas, privileged access service +1 more Arbitrary File Reading in Centrify PAS 7.7 High
- kiteworks totemomail Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId... 9.8 Critical
- lsgwr spring-boot-online-exam Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to... 8.8 High
- cmseasy Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105... 7.5 High
- cisco appdynamics controller, appdynamics +1 more A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an... 6.5 Medium
- react-native-documents document picker React Native Document Picker Directory Traversal vulnerability 7.8 High
- deepin deepin-compressor, linuxdeepin developer-center +1 more Zip Path Traversal in Deepin-Compressor 9.3 Critical
- hap-wi roxy-wi Roxy-WI has Path Traversal vulnerability 7.5 High
- siemens siveillance video dlna server, siveillance video management software 2019 r1, siveillance video management software 2019 r2 +3 more +5 more A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video... 7.5 High
- cisco firepower management center, firepower management center virtual appliance, secure firewall threat defense +1 more +3 more Cisco Firepower Management Center Software Authenticated Directory Traversal Vulnerability 8.1 High