CWE-36: Absolute Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
A kind of CWE-22 Path traversal.
From the CWE List. © The MITRE Corporation.
Newest
- lektor Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths 5.9 Medium
- aws aws-serverless-mcp-server Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server 6.9 Medium
- giuspen cherrytree CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path 5.6 Medium
- microsoft skype for business server 2015 cu13, skype for business server 2019 cu8, skype for business server subscription edition cu1 +2 more Skype for Business Elevation of Privilege Vulnerability 8.1 High
- microsoft skype for business server 2015 cu13, skype for business server 2019 cu8, skype for business server subscription edition cu1 +2 more Skype for Business Remote Code Execution Vulnerability 8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Windows Encrypting File System (EFS) Information Disclosure Vulnerability 6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability 8.8 High
- zettlab d6 ultra Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the... 3.5 Low
- wavlink wn535m1, wavlink technology wn535m3 +1 more WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server 8.8 High
- ibm datastage on cloud pak for data DataStage on Cloud Pak for Data has several vulnerabilities due to open source software 8.8 High
- plesk Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated... 9.9 Critical
- geovision inc. gv-lpc2011/lpc2211 GV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadLink.cgi Symlink Creation 6.5 Medium
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +8 more +10 more Microsoft Windows Search Component Elevation of Privilege Vulnerability 7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Windows Error Reporting Elevation of Privilege Vulnerability 7.8 High
- nvidia triton inference server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause... 5.5 Medium
- nvidia triton inference server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause... 6.5 Medium
- cli uniget: Path Traversal in Hook Files - Directory Escape Vulnerability 8.4 High
- tobit laboratories ag teamdavid TeamDavid: Path Traversal in the archive creation functionality 8.5 High
- eclipse theia, the eclipse foundation eclipse theia +1 more In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes... 7.5 High
- pip maintainers pip pip absolute path traversal during download from malicious package indexes 5.6 Medium
- progress telerik ui for asp.net ajax SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX 7.5 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: UNC SSRF affecting the management UI on Windows 6.5 Medium
- reputeinfosystems armember – membership plugin, content restriction, member levels, user profile & user signup ARMember <= 4.0.27 - Directory Traversal via X-FILENAME 5.3 Medium
- microsoft edge chromium, edge (chromium-based) +1 more Microsoft Edge for Android Information Disclosure Vulnerability 6.2 Medium
- byrongamatos slopsmith Slopsmith has path traversal in archive extractors that allows arbitrary file write → potential RCE 7.6 High
- silverpeas Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set 6.5 Medium
- interinfo dreammaker Interinfo｜DreamMaker - Path Traversal 6.9 Medium
- usagi-org ai-goofish-monitor ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/ 8.2 High
- oscal-compass compliance-trestle compliance-trestle - jinja has an Arbitrary File Write via Path Traversal 8.4 High
- veeam backup and replication A vulnerability allowing an authenticated user with the Backup Administrator role to write... 8.6 High
- kata-containers Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs 9.2 Critical
- themefusion avada (fusion) builder Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter 6.5 Medium
- microsoft .net, .net 10.0, .net 8.0 +6 more +8 more .NET Core Tampering Vulnerability 4.3 Medium
- pyload, pyload-ng project pyload-ng +1 more pyLoad: Path Traversal via Package Folder Name in set_package_data 8.1 High
- papercut ng/mf, mf, ng +2 more PaperCut NG/MF: Path Traversal in Shared Account Synchronization 4.6 Medium
- nixos nix An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix... 5.3 Medium
- deepractice promptx Deepractice PromptX Document File index.ts read_pdf absolute path traversal 6.9 Medium
- freedom securedrop-client SecureDrop Client has path injection in read_gzip_header_filename() 7.5 High
- aio-libs aiohttp AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows 6.6 Medium
- jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field 7.5 High
- nltk, nltk nltk/nltk, red hat lightspeed core +5 more +7 more Arbitrary File Read via Absolute Path Input in nltk.util.filestring() 8.6 High
- navtor navbox, navbox firmware +1 more An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP... 7.5 High
- gradio-app gradio Gradio has Absolute Path Traversal on Windows with Python 3.13+ 7.5 High
- rikyoz bit7z bit7z has a path traversal vulnerability 5.5 Medium
- hyland alfresco community (transform core), alfresco transformation service (enterprise), alfresco transform core +1 more +3 more Hyland Alfresco Transformation Service Absolute Path Traversal Arbitrary File Read and SSRF 8.8 High
- hamastar technology meetinghub, hamastar meetinghub paperless meetings +1 more HAMASTAR Technology｜MeetingHub - Arbitrary File Read 8.7 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +29 more +31 more Windows Spoofing Vulnerability 4.6 Medium
- mindsdb MindsDB has improper sanitation of filepath that leads to information disclosure and DOS 8.1 High
- quanta computer qoca aim ai medical cloud platform, quantatw qoca aim +1 more Quanta Computer｜QOCA aim AI Medical Cloud Platform - Path Traversal 5.3 Medium
- quanta computer qoca aim ai medical cloud platform, quantatw qoca aim +1 more Quanta Computer｜QOCA aim AI Medical Cloud Platform - Path Traversal 5.3 Medium
- Show olderLoading…