CWE-29: Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
A kind of CWE-23 Relative Path Traversal.
From the CWE List. © The MITRE Corporation.
Newest
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreLocal File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow9.3 Critical
- lfprojects mlflow, mlflow mlflow/mlflow +1 morePath Traversal: '\..\filename'10.0 Critical
- lfprojects mlflow, mlflow mlflow/mlflow +1 morePath Traversal: '\..\filename'9.8 Critical
- lfprojects mlflow, mlflow mlflow/mlflow +1 morePath Traversal: '\..\filename' in mlflow/mlflow7.5 High
- lfprojects mlflow, mlflow mlflow/mlflow +1 morePath Traversal: '\..\filename' in mlflow/mlflow8.1 High
- ray project ray, ray-project ray-project/ray +1 moreRay Log File Local File Include7.5 High
- h2o, h2oai h2oai/h2o-3 +1 moreLocal File Inclusion in h2oai/h2o-39.3 Critical
- vertaai modeldb, vertaai/modeldb +1 moreModelDB Local File Include8.6 High
- salesagility salesagility/suitecrm, suitecrm +1 morePath Traversal: '\..\filename' in salesagility/suitecrm7.5 High
- pimcore, pimcore pimcore/pimcore +1 morePath Traversal: '\..\filename' in pimcore/pimcore6.3 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 morePath Traversal: '\..\filename' in mlflow/mlflow9.8 Critical
- lfprojects mlflow, mlflow mlflow/mlflow +1 morePath Traversal: '\..\filename' in mlflow/mlflow9.3 Critical
- salesagility salesagility/suitecrm, suitecrm +1 morePath Traversal: '\..\filename' in salesagility/suitecrm4.3 Medium
- weintek easybuilder pro, easybuilder pro cmt +1 moreThe listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by...9.3 Critical
- froxlor, froxlor froxlor/froxlor +1 morePath Traversal: '\..\filename' in froxlor/froxlor6.8 Medium
- emerson electric proficy machine edition, emerson electric\'s proficy +1 moreEmerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path...3.9 Low
- alibabagroup one-java-agentArbitrary File Write via Archive Extraction (Zip Slip)6.9 Medium
- zip-local project zip-localArbitrary File Write via Archive Extraction (Zip Slip)9.8 Critical
- calipso project calipsoArbitrary File Write via Archive Extraction (Zip Slip)7.3 High
- archiver project archiverPath Traversal in MHolt Archiver5.5 Medium