CWE-35: Path Traversal: '.../...//'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
A kind of CWE-23 Relative Path Traversal.
From the CWE List. © The MITRE Corporation.
Newest
- whmpressWordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerability7.5 High
- siemens scalance lpe9403, scalance lpe9403 firmware +1 moreA vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions)....6.7 Medium
- ilmosys open close woocommerce storeWordPress Open Close WooCommerce Store plugin <= 4.9.9 - Local File Inclusion vulnerability8.8 High
- fernando briano list category postsWordPress List category posts plugin <= 0.91.0 - Local File Inclusion Vulnerability7.5 High
- jmix-framework jmix, haulmont jmix framework +1 moreio.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage6.5 Medium
- thimpress ivy schoolWordPress Ivy School theme <= 1.6.0 - Local File Inclusion Vulnerability8.1 High
- hitachi vantara pentaho data integration & analyticsHitachi Vantara Pentaho Data Integration & Analytics – Path Traversal6.8 Medium
- hitachi vantara pentaho data integration & analyticsHitachi Vantara Pentaho Data Integration & Analytics – Path Traversal6.8 Medium
- quý lê 91 administrator zWordPress Administrator Z plugin <= 2025.03.28 - Directory Traversal Vulnerability4.9 Medium
- notfound wpjobboardWordPress WPJobBoard plugin < 5.11.1 - Path Traversal vulnerability5.4 Medium
- trusty plugins shop products filterWordPress Shop Products Filter Plugin <= 1.2 - Local File Inclusion vulnerability7.5 High
- sap se capital yield tax managementDirectory Traversal vulnerability in SAP Capital Yield Tax Management7.7 High
- bit apps assistWordPress Bit Assist plugin <= 1.5.4 - Path Traversal vulnerability7.5 High
- boggibill getshop ecommerceWordPress GetShop ecommerce plugin <= 1.3 - Path Traversal vulnerability8.1 High
- notfound pie register premiumWordPress Pie Register Premium plugin <= 3.8.3.2 - Path Traversal to Non-Arbitrary File Deletion vulnerability6.3 Medium
- axelkeller gpx viewerWordPress GPX Viewer plugin <= 2.2.11 - Path Traversal vulnerability4.9 Medium
- hashshop wizshopWordPress WizShop Plugin <= 3.0.2 - Local File Inclusion vulnerability8.1 High
- wpjobportal wp job portalWordPress WP Job Portal plugin <= 2.2.8 - Local File Inclusion vulnerability7.5 High
- codemanas search with typesenseWordPress Search with Typesense Plugin <= 2.0.8 - Path Traversal vulnerability6.8 Medium
- q-free maxtimeA CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or...4.9 Medium
- q-free maxtimeA CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free...7.2 High
- q-free maxtimeA CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or...6.5 Medium
- q-free maxtimeA CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime...7.2 High
- q-free maxtimeA CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to...4.9 Medium
- q-free maxtimeA CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal...6.5 Medium
- q-free maxtimeA CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal...4.9 Medium
- clidey whodbPath traversal opening Sqlite3 database in WhoDB10.0 Critical
- hp, inc. certain poly devices, poly edge e +1 moreCertain Poly Devices – Path Traversal Vulnerability - Arbitrary File Access by Unauthorized User5.8 Medium
- admiror-design-studio admiror gallery, www.admiror-design-studio.com admiror gallery component for joomla +1 moreExtension - admiror-design-studio.com - Path traversal in the Admiror Gallery 4.x component for Joomla7.5 High
- bandido morkva ua shippingWordPress Morkva UA Shipping plugin <= 1.0.18 - Local File Inclusion vulnerability8.1 High
- element invader elementinvader addons for elementor, elementinvader addons for elementor +1 moreWordPress ElementInvader Addons for Elementor plugin <= 1.2.6 - Local File Inclusion vulnerability7.5 High
- samba rsync, almalinux, archlinux arch linux +24 more +26 moreRsync: --safe-links option bypass leads to path traversal6.5 Medium
- samba rsync, almalinux, archlinux arch linux +32 more +34 moreRsync: path traversal vulnerability in rsync6.5 Medium
- smsa express shippingWordPress SMSA Shipping plugin <= 2.3 - Arbitrary File Deletion vulnerability8.6 High
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerability9.3 Critical
- arraytics eventinWordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability6.5 Medium
- deluxethemes userproWordPress UserPro plugin <= 5.1.9 - Local File Inclusion vulnerability8.3 High
- huawei harmonyos ailife solution 8.0Some Huawei home music system products have a path traversal vulnerability. Successful...7.3 High
- huawei harmonyos ailife solution 8.0Huawei Home Music System has a path traversal vulnerability. Successful exploitation of this...8.0 High
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin < 1.9.9.5.2 - Subscriber+ Arbitrary File Deletion vulnerability8.5 High
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary Directory Deletion vulnerability8.5 High
- full services customer, full. full customer +1 moreWordPress FULL – Cliente plugin <= 3.1.25 - Local File Inclusion vulnerability6.5 Medium
- ltdrdata comfyui-impact-packComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of...9.2 Critical
- repute info systems arformsWordPress ARForms plugin < 7.0.2 - Path Traversal vulnerability7.7 High
- softpulse infotech sp blog designerWordPress SP Blog Designer plugin <= 1.0.0 - Local File Inclusion vulnerability7.5 High
- tychesoftwares product input fields for woocommerceProduct Input Fields for WooCommerce <= 1.9 - Authenticated (Contributor+) Arbitrary File Read6.5 Medium
- myscada mypro manager, mypro runtime +1 moremySCADA myPRO Path Traversal8.7 High
- corporate zen contact page with google mapWordPress Contact Page With Google Map plugin <= 1.6.1 - Arbitrary File Deletion vulnerability8.6 High
- greg ross cyan backupWordPress CYAN Backup plugin <= 2.5.3 - Arbitrary File Download vulnerability4.9 Medium
- cisco catalyst sd-wan managerCisco SD-WAN vManage Directory Traversal Vulnerability7.5 High
- Show moreLoading…