CWE-73: External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web Interface4.4 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreWindows MSHTML Platform Security Feature Bypass Vulnerability6.5 Medium
- bumsys project bumsys, unilogies unilogies/bumsys +1 moreExternal Control of File Name or Path in unilogies/bumsys7.2 High
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: tinymce loaders susceptible to arbitrary folder creation6.5 Medium
- oretnom23 student study center desk management system, student study center desk management system project study center desk management system +1 moreSourceCodester Student Study Center Desk Management System index.php file inclusion5.3 Medium
- posimyth the plus addons for elementor, posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerce +1 moreThe Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read6.5 Medium
- canonical jujuJuju controller - Arbitrary file reading vulnerability4.9 Medium
- flatpress, flatpressblog flatpressblog/flatpress +1 moreExternal Control of File Name or Path in flatpressblog/flatpress7.5 High
- nilsteampassnet nilsteampassnet/teampass, teampass +1 moreExternal Control of File Name or Path in nilsteampassnet/teampass7.1 High
- fortinet fortinacA external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5,...9.8 Critical
- microsoft visual studio 2017 version 15.9 (includes 15.0 - 15.8), visual studio 2019 version 16.11 (includes 16.0 - 16.10), visual studio 2022 version 17.0 +5 more +7 moreVisual Studio Elevation of Privilege Vulnerability7.8 High
- microsoft windows server 2008 service pack 2, windows server 2008 r2 service pack 1, windows server 2008 r2 service pack 1 (server core installation) +3 more +5 moreWindows Installer Elevation of Privilege Vulnerability7.8 High
- palo alto networks cortex xsoar, fedoraproject fedora +1 moreCortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR Server6.5 Medium
- siemens automation license manager v5, automation license manager v6, automation license manager +1 more +3 moreA vulnerability has been identified in Automation License Manager V5 (All versions), Automation...8.2 High
- sternenblog project sternenblogsternenseemann sternenblog main.c blog_index file inclusion5.0 Medium
- soshtolsus wing-tightsoshtolsus wing-tight index.php file inclusion6.3 Medium
- perfsonarperfSONAR before 4.4.6 inadvertently supports the parse option for a file:// URL.5.3 Medium
- nvidia cloud gaming, vgpu software (guest driver) - windows, nvidia cloud gaming (guest driver), virtual gpu +2 moreNVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an...8.8 High
github.com/fkie-cad/yapscanGoYapscan's report receiver server vulnerable to path traversal and log injection7.5 High- cortexproject cortexAlertmanager can expose local files content via specially crafted config6.5 Medium
- siemens syngo dynamics, syngo dynamics cardiovascular imaging and information system +1 moreA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics...7.5 High
- siemens syngo dynamics, syngo dynamics cardiovascular imaging and information system +1 moreA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics...7.5 High
- siemens syngo dynamics, syngo dynamics cardiovascular imaging and information system +1 moreA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics...7.5 High
- siemens syngo dynamics, syngo dynamics cardiovascular imaging and information system +1 moreA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics...7.5 High
- siemens syngo dynamics, syngo dynamics cardiovascular imaging and information system +1 moreA vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics...7.5 High
- connekthq ajax load more, dcooney ajax load more – infinite scroll, load more, & lazy load +1 moreWordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Read4.9 Medium
- codename065 download managerDownload Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion8.1 High
- atlasgondal export all urlsExport All URLs < 4.4 - Admin+ Arbitrary System File Removal6.5 Medium
- wwbn avideoAn information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of...6.5 Medium
- wwbn avideoAn information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6...6.5 Medium
- dompdf dompdf/dompdf, dompdf project dompdf +1 moreExternal Control of File Name or Path in dompdf/dompdf5.3 Medium
- schneider electric opc ua modicon communication module, x80 advanced rtu communication module, schneider-electric opc ua module for m580 firmware +1 more +3 moreA CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of...5.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen downloading files on Windows, the % character was not escaped, which could have lead to a...8.8 High
- piano led visualizer project led visualizer, onlaj piano-led-visualizer +1 moreAbsolute Path Traversal due to incorrect use of `send_file` call in Piano LED Visualizer9.9 Critical
- cisco unified communications managerCisco Unified Communications Products Arbitrary File Write Vulnerability4.9 Medium
- unknown iq block countryiQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip4.9 Medium
- hamid alinia login with phone numberLogin with phone number < 1.3.7 - Unauthenticated remote plugin deletion6.5 Medium
- bestwebsoft error log viewer, error log viewer by bestwebsoft +1 moreError Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File Clearing4.9 Medium
- thimpress learnpressLearnPress < 4.1.5 - Arbitrary Image Renaming4.3 Medium
- netristv netristv/ws-scrcpy, ws scrcpy project scrcpy +1 moreExternal Control of File Name or Path in netristv/ws-scrcpy7.5 High
- cisco firepower threat defense software, firepower management center virtual appliance, secure firewall threat defense +1 more +3 moreCisco Firepower Threat Defense Software CLI Arbitrary File Write Vulnerability4.4 Medium
- auvesy versiondogAUVESY Versiondog9.8 Critical
- canonical multipassWindows version of Multipass unauthenticated localhost tcp control socket can perform mounts8.8 High
- cisco identity services engine, prime infrastructure, identity services engine software +1 more +3 moreCisco ADE-OS Local File Inclusion Vulnerability4.4 Medium
- google bazel, google llc vscode-bazel +1 moreCode execution in VSCode-bazel via malicious Bazel config files8.2 High
- d-link dap-2020, dlink dap-2020 firmware +1 moreThis vulnerability allows network-adjacent attackers to disclose sensitive information on...6.5 Medium
- x-stream xstream, apache activemq, jmeter +12 more +14 moreXStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights5.3 Medium
- advantech webaccess\/scadaThe WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to...8.8 High
- qnap qtsImproper Limitation of a Pathname to a Restricted Directory in QTS9.1 Critical
- qnap qesAbsolute path traversal vulnerability in QES5.8 Medium
- Show moreLoading…