CWE-27: Path Traversal: 'dir/../../filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
A kind of CWE-23 Relative Path Traversal.
From the CWE List. © The MITRE Corporation.
Newest
- moment moment vulnerable to Path Traversal via crafted non-string locale name 5.9 Medium
- splunk, splunk enterprise +1 more Path Traversal through the Search Dispatch REST API in Splunk Enterprise 7.7 High
- apache kyuubi Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases 8.1 High
- eclipse openmq, eclipse foundation glassfish +1 more An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files... 9.1 Critical
- cisco secure firewall management center (fmc), secure firewall threat defense (ftd) software +1 more Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal Vulnerability 5.9 Medium
- apache kyuubi Apache Kyuubi: Unauthorized directory access due to missing path normalization 8.8 High
- huawei harmonyos Denial of service (DoS) vulnerability in the office service. Successful exploitation of this... 3.3 Low
- yordam information technology consulting education and electrical systems industry trade inc. katalog Path Traversal in Yordam BT's Yordam Katalog 8.6 High
- tautulli Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy` 8.6 High
- sscms An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to... 6.5 Medium
- iocharger firmware for ac models Using the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal. 7.2 High
- cisco roomos software, roomos, telepresence collaboration endpoint +1 more +3 more Cisco TelePresence Collaboration Endpoint and RoomOS Software Privilege Escalation Vulnerability 6.7 Medium
- kanboard Arbitrary File Read and Delete in kanboard 9.1 Critical
- eladmin elunez eladmin Database Management/Deployment Management upload path traversal 5.1 Medium
- traccar Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type 8.5 High
- cisco nexus dashboard fabric controller, data center network manager +1 more A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard... 7.5 High
- erzhongxmu jeewms An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the... 9.8 Critical
- cmseasy cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php. 4.9 Medium
- node.js, nodejs node, nodejs +2 more The permission model protects itself against path traversal attacks by calling path.resolve() on... 7.9 High
- mate-desktop atril Remote Code Execution Vulnerability in Atril's EPUB ebook parsing 8.5 High
- jenkins, jenkins command line interface (cli) +1 more Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE 9.8 Critical
- deepin reader, linuxdeepin developer-center +1 more Deepin Reader RCE vulnerability due to a design flaw 9.3 Critical
- sonicwall analytics, gms, global management system +2 more Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read... 6.5 Medium
- cisco prime infrastructure, evolved programmable network manager +1 more Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities 6.5 Medium
- cisco prime infrastructure, evolved programmable network manager +1 more Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities 6.5 Medium
- cisco prime infrastructure, evolved programmable network manager +1 more Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities 6.5 Medium
- cisco prime infrastructure Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities 6.5 Medium
- hasura graphql engine, graphql-engine +1 more Unauthenticated path traversal vulnerability in Hasura GraphQL Engine 7.5 High
- moment, debian linux, fedoraproject fedora +2 more +4 more Path Traversal in Moment.js 7.5 High
- zyxel zywall vpn2s firmware A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12... 7.5 High