CWE-36: Absolute Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
A kind of CWE-22 Path traversal.
From the CWE List. © The MITRE Corporation.
Newest
- welltend bpmflowwebkitWELLTEND TECHNOLOGY｜ BPMFlowWebkit - Arbitrary File Read8.7 High
- advantech webaccess/scada, webaccess\/scada +1 moreAdvantech WebAccess/SCADA Absolute Path Traversal5.3 Medium
- mjmlMJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-128274.5 Medium
- barracuda rmmBarracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE10.0 Critical
- galaxy software services vitals esp, gss vitalsesp +1 moreGalaxy Software Services｜Vitals ESP - Arbitrary File Read6.9 Medium
- ibm planning analytics local, planning analytics workspace +1 moreIBM Planning Analytics Local Directory Traversal8.0 High
- cht tenderdoctransferChunghwa Telecom｜TenderDocTransfer - Arbitrary File Copy and Paste7.0 High
- cht tenderdoctransferChunghwa Telecom｜TenderDocTransfer - Arbitrary File Delete7.0 High
- vanquish wordpress user extra fieldsWordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function8.8 High
uptime-kumanpmUptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read6.5 Medium- aurelienlws lws cleanerLWS Cleaner <= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file'7.2 High
- docjojo atec debugatec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Read4.9 Medium
- docjojo atec debugatec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletion7.2 High
- uniong webitrUniong｜WebITR - Arbitrary File Reading through Path Traversal7.1 High
- uniong webitrUniong｜WebITR - Arbitrary File Reading through Path Traversal7.1 High
- uniong webitrUniong｜WebITR - Arbitrary File Reading through Path Traversal7.1 High
- uniong webitrUniong｜WebITR - Arbitrary File Reading through Path Traversal7.1 High
- commvault commcell, commvault +1 morePath Traversal Vulnerability8.7 High
- wellchoose organization portal systemWellChoose｜Organization Portal System - Arbitrary File Reading through Path Traversal8.7 High
- wellchoose organization portal systemWellChoose｜Organization Portal System - Arbitrary File Reading through Path Traversal7.1 High
- nintechnet ninjascanner – virus & malware scanNinjaScanner – Virus & Malware scan <= 3.2.5 - Authenticated (Administrator+) Arbitrary File Deletion7.2 High
- samsung electronics data management server, samsung data management server firmware +1 moreAbsolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker ...4.9 Medium
- cleverplugins security ninja – wordpress security plugin & firewallSecurity Ninja – Secure Firewall & Secure Malware Scanner - 5.201 - 5.242 - Authenticated (Administrator+) Arbitrary File Read4.9 Medium
- jenkins html publisher, jenkins project html publisher plugin +1 moreJenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs6.3 Medium
- beeteam368 extensions, vidmov +1 moreBeeTeam368 Extensions <= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion8.8 High
- netgate pfsenseIn Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading...5.0 Medium
- wpeverest everest forms, everest forms pro +1 moreEverest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion7.5 High
- gamerz wp-downloadmanagerWP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Deletion7.2 High
- dell wyse management suiteDell Wyse Management Suite, versions prior to WMS 5.2, contain an Absolute Path Traversal...8.2 High
- abb aspect-enterprise, matrix series, nexus series +2 moreStored Absolute Path Traversal8.4 High
- abb aspect-enterprise, matrix series, nexus series +2 moreAdmin Authorized Port (iptables) manipulation (open/close/disable ports)8.9 High
- abb aspect-enterprise, matrix series, nexus series +2 moreAuthenticated Absolute Path Traversal7.5 High
- osamataher java-springboot-codebaseUnauthenticated Arbitrary File Read via Absolute Path7.7 High
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 moreArbitrary File Write in eosphoros-ai/db-gpt9.1 Critical
- automatic1111 automatic1111/stable-diffusion-webui, stable-diffusion-webui +1 moreLocal File Inclusion in automatic1111/stable-diffusion-webui6.5 Medium
- h2o, h2oai h2oai/h2o-3 +1 moreArbitrary File Overwrite in h2oai/h2o-37.1 High
- parisneo parisneo/lollms-webui, lollms web ui +1 moreDirectory Listing Vulnerability in parisneo/lollms-webui5.3 Medium
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 moreArbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt9.1 Critical
- modelscope agentscope, modelscope/agentscope +1 moreArbitrary File Download in modelscope/agentscope7.5 High
- nakivo backup & replication director, backup and replication, backup \& replication director +2 moreNAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files...8.6 High
- abacus research ag abacusauthenticated arbitrary file read vulnerability6.5 Medium
- progress software corporation progress® telerik® reporting, progress telerik reporting +1 moreAbsolute Path Traversal Vulnerability5.3 Medium
- kde arklibarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.5.0 Medium
- aws deepjavalibraryPath traversal issue in Deep Java Library9.3 Critical
- ivanti endpoint manager, endpoint manager (epm) +1 moreAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6...9.8 Critical
- ivanti endpoint manager, endpoint manager (epm) +1 moreAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6...9.8 Critical
- ivanti endpoint manager, endpoint manager (epm) +1 moreAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6...9.8 Critical
- ivanti endpoint managerAbsolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6...9.8 Critical
- gocdGoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access3.8 Low
- chunghwa telecom topm-clientChunghwa Telecom topm-client - Arbitrary File Delete8.1 High
- Show moreLoading…