CWE-35: Path Traversal: '.../...//'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
A kind of CWE-23 Relative Path Traversal.
From the CWE List. © The MITRE Corporation.
Newest
- saad iqbal wp easypay WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability 7.5 High
- sophos sg utm A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code... 9.2 Critical
- siemens industrial edge device kit - arm64 v1.10, industrial edge device kit - arm64 v1.11, industrial edge device kit - arm64 v1.12 +95 more +97 more Affected systems do not properly restrict access to internal APIs and paths for authenticated... 8.9 High
- siemens industrial edge cloud device (iecd), industrial edge device kit - arm64 v1.10, industrial edge device kit - arm64 v1.11 +60 more +62 more A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge... 6.9 Medium
- satel iberia sennet datalogger serie 200 Path Traversal in Satel Iberia SenNet Datalogger Serie 200 7.1 High
- tryghost ghost Ghost: Path Traversal Vulnerability in Ghost ImageSize Service 3.8 Low
- tryghost ghost Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize 5.1 Medium
- hitachi industrial equipment systems coding software suite Path traversal may allow arbitrary files to be viewed, created, modified, or deleted 9.3 Critical
- wpfunnels creator lms WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability 7.5 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 more Path Traversal in /index.php/view_uploaded_iodd_file 7.5 High
- gitlab, gitlab community edition and enterprise edition +1 more Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab 10.0 Critical
- adrian tobey groundhogg WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability 6.5 Medium
- samsung android, samsung mobile devices +1 more Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to... 6.8 Medium
- samsung android, samsung mobile devices +1 more Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create... 8.8 High
- mediatek, inc. mediatek chipset In Audio HAL, there is a possible information disclosure due to improper input validation. This... 4.4 Medium
- dell objectscale Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low... 3.3 Low
- dell objectscale Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low... 7.1 High
- lasso analytics, inc. do lasso WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability 7.5 High
- siemens license server (sls) A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The... 8.7 High
- arcadia technology, llc crafty controller Path Traversal: '.../...//' in Crafty Controller 9.1 Critical
- microsoft entra provisioning service Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability 9.9 Critical
- boldgrid w3 total cache WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability 6.5 Medium
- ericsson packet core controller (pcc) Path traversal Vulnerability 4.8 Medium
- No product listed An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal. 7.8 High
- addify tax exempt for woocommerce WordPress Tax Exempt for WooCommerce plugin < 1.9.5 - Path Traversal vulnerability 6.5 Medium
-
motioneyePyPI motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal 10.0 Critical - mikado-themes kastell WordPress Kastell theme <= 2.0 - Local File Inclusion vulnerability 8.1 High
- ninja team fastdup WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerability 9.6 Critical
- tammersoft shared files WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability 7.5 High
- aguilatechnologies wp customer area WordPress WP Customer Area plugin <= 8.3.4 - Path Traversal vulnerability 8.8 High
- sap se netweaver application server java (web container) Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container) 9.0 Critical
- sap se fiori (launchpad) Path Traversal Vulnerability in SAP Fiori (launchpad) 4.2 Medium
- dokploy Dokploy: Remote Code Execution through Path Traversal 9.9 Critical
- suse opensuse, linux enterprise +1 more Path Traversal in Plugin Loading in libzypp 8.5 High
- microsoft edge (chromium-based), edge chromium +1 more Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 8.8 High
- lmsys sglang CVE-2026-7302 9.1 Critical
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 more Appliance mode iControl REST vulnerability 8.5 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 more Appliance mode iControl REST vulnerability 6.9 Medium
- axis os An ACAP configuration file lacked sufficient input validation, which could allow a path traversal... 6.7 Medium
- suse rancher Rancher Extensions have arbitrary file access via path traversal 8.4 High
- cisco unity connection Cisco Unity Connection Remote Code Execution Vulnerability 8.8 High
- sonicwall sonicos A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with... 6.8 Medium
- dadrus heimdall Heimdall: Authorization bypass via path normalization mismatch 7.8 High
- intrado 911 emergency gateway Path traversal: '.../...//' in Intrado 911 Emergency Gateway (EGW) 9.3 Critical
- dell powerstore, powerstore 1000t, powerstore 1200t +11 more +13 more PowerStore, contains a Path Traversal vulnerability in the Service user. A low privileged... 4.4 Medium
- snowray software file uploader for woocommerce WordPress File Uploader for WooCommerce plugin <= 1.0.4 - Path Traversal vulnerability 7.5 High
- bogdan bendziukov squeeze WordPress Squeeze plugin <= 1.7.7 - Directory Traversal vulnerability 5.0 Medium
- microsoft aci confidential containers Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability 6.7 Medium
- primersoftware primer mydata for woocommerce WordPress Primer MyData for Woocommerce plugin <= 4.2.8 - Path Traversal vulnerability 5.3 Medium
- rocketsoftware trufusion enterprise Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services... 9.4 Critical
- Show olderLoading…