CWE-73: External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- tournamatch Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion 9.6 Critical
- unknown directorist: ai-powered business directory, listings & classified ads Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field 6.5 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.5 High
- chartbrew Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths 8.1 High
- kunchenguid lavish-axi Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server 8.1 High
-
github.com/canonical/lxdGo LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image 9.9 Critical -
github.com/canonical/lxdGo LXD has arbitrary file read+write on host via templates/ symlink in malicious image 9.9 Critical -
github.com/canonical/lxdGo LXD has arbitrary file write on host via `exec-output` symlink in crafted image 9.9 Critical - sensiolabs symfony Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File 8.2 High
- everaccounting ever accounting Ever Accounting < 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import 8.7 High
- kurrent-io kurrentdb KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF 6.9 Medium
- apache software foundation ofbiz Apache OFBiz: webtools xmldsdump exports any entity to any path 7.1 High
- apache software foundation ofbiz Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass No score
- sensiolabs symfony Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File 8.4 High
- nvm-sh nvm nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable 1.8 Low
- seppmail ag secure email gateway (seg) Forged LFT metadata permits arbitrary file read and deletion 9.2 Critical
- quest foglight for databases Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability 9.8 Critical
- quest foglight for databases Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability 6.5 Medium
- hewlett packard enterprise (hpe) virtual intranet access (via) Local Privilege Escalation in Virtual Intranet Access (VIA) Client for Linux 7.1 High
- mongodb database tools mongofiles may disclose GridFS content to standard output through a stored filename 5.9 Medium
- securepoint ssl vpn client v2 Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for Windows 6.9 Medium
- themekraft buddyforms BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion 3.7 Low
-
adminneo-org/adminneoPackagist AdminNeo SQLite Database-List Drop Arbitrary File Deletion 8.1 High - stirling-tools stirling-pdf Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read 6.8 Medium
- pgadmin.org pgadmin 4 pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory 7.2 High
- immich-app immich Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service 6.5 Medium
- schollz croc croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive 4.2 Medium
- socfortress copilot SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE) 10.0 Critical
- wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata 6.5 Medium
- mariadb-corporation mariadb-connector-j MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files 5.9 Medium
- @clerk nuxt Nuxt dev server arbitrary file read through client error reports 5.9 Medium
- ubiquiti inc wifiman desktop A malicious actor with local access and low privileges could exploit an External Control of File... 7.8 High
- progress software ws ftp server Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server 5.3 Medium
- drupal single content sync Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274 7.2 High
- watchguard fireware os Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root 7.2 High
- watchguard fireware os Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root 7.1 High
- yeswiki YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter 6.9 Medium
- gitroomhq postiz-app Arbitrary file read and backend crash through unrestricted provider method calls 9.9 Critical
- intranda goobi-viewer-core Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer 9.8 Critical
- devolutions server MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION 8.0 High
- rsyslog Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE 8.1 High
- ekkolearnai ekko-studio EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion 5.3 Medium
- bpampuch pdfmake pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images 6.9 Medium
- oretnom23 file-management-system-php oretnom23 file-management-system-php index.php include file inclusion 5.3 Medium
- apache software foundation brpc Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof 7.5 High
-
graphifyyPyPI Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo 6.8 Medium - docling-project docling-core docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef 5.3 Medium
- codexu notegen NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis 2.1 Low
- energizelab station-middleware EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read 9.9 Critical
- simplepie SimplePie through 1.9.0 Local File Read via file:// Redirect 8.2 High
- Show olderLoading…