CWE-73: External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- mayurik best house rental management systemSourceCodester Best House Rental Management System index.php file inclusion6.9 Medium
- progress whatsup goldWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability9.8 Critical
- red hat build of keycloak 24, build of keycloak 24.0.9, build of keycloak 26.0 +4 more +6 moreKeycloak-quarkus-server: keycloak path trasversal2.7 Low
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 moreNTLM Hash Disclosure Spoofing Vulnerability6.5 Medium
- themeisle multiple page generator plugin – mpg, multiple page generator +1 moreMultiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion2.7 Low
- bowo code explorerCode Explorer <= 1.4.5 - Authenticated (Admin+) External File Reading4.9 Medium
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreFile Overwrite Vulnerability in gaizhenbiao/chuanhuchatgpt6.5 Medium
- trendmicro vpn, trend micro, inc. micro vpn (consumer), trend micro inc vpn consumer +2 moreTrend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under...7.8 High
- rami.io gmbh pretix widget wordpress plugin, pretiix widget wordpress plugin +1 moreLocal File Inclusion in pretix-widget WordPress plugin8.5 High
- microsoft windows server 2022, 23h2 edition (server core installation), windows server 2022 23h2 +1 moreMicrosoft OpenSSH for Windows Remote Code Execution Vulnerability7.5 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +17 more +19 moreMicrosoft OpenSSH for Windows Remote Code Execution Vulnerability7.1 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +17 more +19 moreMicrosoft OpenSSH for Windows Remote Code Execution Vulnerability7.1 High
- esri portal for arcgis, liferay portal +1 moreBUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerability7.5 High
- jeanmarc77 123solarjeanmarc77 123solar admin_invt2.php file inclusion5.3 Medium
- olgu computer systems e-belediyeLocal File Inclusion (LFI) in Olgu Computer Systems' e-Belediye9.4 Critical
- proxmox virtual environment, libpve-common-perl (promox mail gateway 8), libpve-common-perl (promox ve 8) +5 more +7 moreProxmox Virtual Environment is an open-source server management platform for enterprise...8.2 High
- wpdelicious wp delicious – recipe plugin for food bloggers (formerly delicious recipes), wp delicious, wpdelicious +2 moreWP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read8.1 High
- spipSPIP Bigup Multipart File Upload OS Command Injection9.8 Critical
- progress ws ftp serverImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Progress WS_FTP Server6.5 Medium
- oretnom23 simple online bidding systemSourceCodester Simple Online Bidding System index.php file inclusion5.3 Medium
- microsoft outlook, 365 apps, 365 apps for enterprise +5 more +7 moreMicrosoft Outlook Remote Code Execution Vulnerability6.7 Medium
- microsoft windows 11 version 22h2, windows 11 version 22h3, windows 11 version 23h2 +2 more +4 moreWindows Compressed Folder Tampering Vulnerability6.5 Medium
- angeljudesuarez airline reservation systemitsourcecode Airline Reservation System index.php file inclusion5.3 Medium
- angeljudesuarez airline reservation systemitsourcecode Airline Reservation System index.php file inclusion5.3 Medium
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 morePath Traversal in gaizhenbiao/chuanhuchatgpt8.2 High
- canonical ubuntu desktop provisionAn issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local...8.8 High
- formtools form toolsformtools.org Form Tools Import Option List edit.php curl_exec file inclusion5.1 Medium
- reputeinfosystems bookingpress, appointment booking calendar plugin and scheduling plugin – bookingpress +1 moreBookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation8.8 High
- vnotex vnoteCode Execution Vulnerability via Local File Path Traversal in Vnote8.8 High
- gallagher controller 6000 and controller 7000, controller 6000 firmware, controller 7000 firmware +2 moreExternal Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows...6.3 Medium
- glpi-project glpiGLPI allows remote code execution through the plugin loader7.2 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +31 more +33 moreWindows Distributed Transaction Coordinator Remote Code Execution Vulnerability6.6 Medium
- weblateWeblate vulnerabler to improper sanitization of project backups4.4 Medium
- stitionai devika, stitionai/devika +1 moreLocal File Read in stitionai/devika7.5 High
- toshiba tec corporation tec e-studio multi-function peripheral (mfp)Local File Inclusion4.4 Medium
- trend micro, inc. micro vpn proxy one pro, trendmicro vpn proxy one +1 moreTrend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file...5.3 Medium
- aimeos aimeos-coreAimeos Core remote code execution in web server context7.2 High
- hawkiArbitrary File Overwrite6.5 Medium
- checkmkUnrestricted upload and download paths in check_sftp8.8 High
- cisco network services orchestratorA vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of...7.8 High
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The bulk import...7.2 High
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected...7.2 High
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected...7.2 High
- dell powerscale onefsDell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or...6.1 Medium
- campcodes online laundry management systemCampcodes Online Laundry Management System index.php file inclusion6.9 Medium
- nvidia triton inference serverCVE6.5 Medium
- nvidia triton inference serverCVE9.0 Critical
- logpoint, logpoint siem +1 moreAn issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion (LFI) when an...6.5 Medium
- veritas backup execAn issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec...7.7 High
- timber team & contributors timberWordPress Timber plugin <= 1.23.0 - Deserialization of untrusted data vulnerability8.0 High
- Show moreLoading…