CWE-31: Path Traversal: 'dir\..\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir\..\..\filename' (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory.
A kind of CWE-23 Relative Path Traversal.
From the CWE List. © The MITRE Corporation.
Newest
- dell powerprotect data domain virtual edition PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024... 7.2 High
- koozali sme server path traversal inKoozali - SME Server 7.7 High
- mitel mivoice office 400 Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability 8.4 High
- mitel mivoice office 400 Mitel MiVoice Office 400 System Logs Path Traversal Information Disclosure 5.5 Medium
- mitel mivoice office 400 Mitel MiVoice Office 400 view system files path traversal 8.4 High
- dzzoffice dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php. 8.8 High
- moderncampus omni cms A Directory Traversal vulnerability in Modern Campus - Omni CMS 2023.1 allows a remote,... 5.3 Medium
- homebrew jan Jan path traversal vulnerability 7.5 High
- zkteco zkbio cvsecurity ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord. 6.5 Medium
- zkteco zkbio cvsecurity ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions… 7.5 High
- ivanti avalanche A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote... 8.8 High
- denx u-boot, rad secflow-2v firmware +1 more RAD SecFlow-2 devices with Hardware 0202, Firmware 4.1.01.63, and U-Boot 2010.12 allow URIs... 7.5 High
- pgadmin 4, pgadmin.org pgadmin 4, fedoraproject fedora +2 more Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 9.9 Critical
- langchain LangChain directory traversal vulnerability 8.1 High
- webtrees Webtrees Path Traversal vulnerability 4.9 Medium
- prestaworld account manager, prestasalesmanager +1 more In the module "Account Manager | Sales Representative & Dealers | CRM" (prestasalesmanager) up to... 7.5 High