CWE-73: External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- digitalzoomstudio zoomsounds, zoomit zoomsounds - wordpress wave audio player with playlist +1 moreZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File Download7.5 High
- wpminds simple wp eventsSimple WP Events <= 1.8.17 - Unauthenticated Arbitrary File Deletion9.1 Critical
- mozilla firefox, thunderbird +1 moreOpening local .url files could lead to another file being opened7.7 High
- legrand sms powerviewLegrand SMS PowerView file inclusion5.3 Medium
- webtoffee product import export for woocommerce – import export product csv suite, product import export for woocommerce +1 moreProduct Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function2.7 Low
- glpi-project glpi-inventory-pluginGLPI Inventory plugin has Improper Access Control Vulnerability8.2 High
- b&r industrial automation gmbh aprolPath traversal in APROL Web Portal8.4 High
- webtoffee export and import users and customers, import export wordpress users +1 moreExport and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function2.7 Low
- webtoffee order export & order import for woocommerce, order export \& order import for woocommerce +1 moreOrder Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function2.7 Low
- modelscope agentscope, modelscope/agentscope +1 moreDirectory Traversal in modelscope/agentscope7.5 High
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 moreArbitrary File Write in eosphoros-ai/db-gpt9.1 Critical
- aimhubio aimhubio/aim, aimstack aim +1 moreArbitrary File Overwrite through tarfile-extraction in aimhubio/aim9.1 Critical
- h2o, h2oai h2oai/h2o-3 +1 moreArbitrary File Overwrite in h2oai/h2o-38.2 High
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 moreArbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt9.1 Critical
- danny-avila danny-avila/librechat, librechat +1 moreArbitrary File Deletion via Path Traversal in danny-avila/librechat8.1 High
- invoke-ai invoke-ai/invokeaiArbitrary File Delete in invoke-ai/invokeai9.1 Critical
- dbgpt db-gpt, eosphoros-ai eosphoros-ai/db-gpt +1 moreArbitrary File Deletion in eosphoros-ai/DB-GPT8.2 High
- impressmodules imfaqimFAQ allows local file inclusion in seo.php6.9 Medium
- flowiseFlowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API10.0 Critical
- fortinet forticlient, forticlientmac +1 moreAn external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3...7.8 High
- flowiseFlowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint9.3 Critical
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +31 more +33 moreNTLM Hash Disclosure Spoofing Vulnerability6.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +30 more +32 moreNTLM Hash Disclosure Spoofing Vulnerability6.5 Medium
- mockoonMockoon has a Path Traversal and LFI in the static file serving endpoint7.5 High
- chimpstudio cs frameworkCS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read7.5 High
- esri arcgis serverLocal file inclusion (LFI) vulnerability in ArcGIS Server7.5 High
- specialk simple download counterSimple Download Counter <= 2.0 - Authenticated (Author+) Arbitrary File Read6.5 Medium
- syspassThe account file upload functionality in Syspass 3.2.x fails to properly handle special...6.5 Medium
- pebbletemplates pebble templatesPebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro6.1 Medium
- hkcmsHkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the...7.2 High
- dependencytrack dependency-trackDependency-Track vulnerable to local file inclusion via custom notification templates4.4 Medium
- ibm watson query on cloud pak for data, watson query with cloud pak for data +1 moreIBM Watson Query on Cloud Pak for Data information disclosure5.3 Medium
- ivanti connect secure, policy secure +1 moreExternal control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti...9.1 Critical
- synology active backup for business, active backup for business agent +1 moreImproper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in...6.5 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Authenticated File Read Vulnerability in the Management Web Interface7.1 High
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web Interface6.9 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 moreNTLM Hash Disclosure Spoofing Vulnerability6.5 Medium
- ivanti connect secure, policy secure +1 moreExternal control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti...6.8 Medium
- western telematic inc console server (dsm series), console server + pdu combo unit (cpm series), network power switch (nps series) +2 moreWestern Telematic Inc NPS Series, DSM Series, CPM Series External Control of File Name or Path6.0 Medium
- codedropz drag and drop multiple file upload - contact form 7, glenwpcoder drag and drop multiple file upload for contact form 7 +1 moreDrag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion5.3 Medium
- villatheme w2s, w2s – migrate woocommerce to shopify +1 moreW2S – Migrate WooCommerce to Shopify <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- aws deepjavalibraryPath traversal issue in Deep Java Library9.3 Critical
- palo alto networks expedition, cloud ngfw, pan-os +2 more +4 moreExpedition: Arbitrary File Deletion Vulnerability6.9 Medium
- iocharger firmware for ac modelsUsing the <redacted> action or <redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.7.2 High
- campcodes school faculty scheduling systemCampcodes School Faculty Scheduling System index.php file inclusion5.3 Medium
- tcs bancsTCS BaNCS REPORTS_SHOW_FILE.jsp file inclusion5.1 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download4.9 Medium
- smsaexpress smsa shipping (official)SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion8.8 High
- edgecross consortium basic software for developers, basic software for windows +1 moreExternal Control of File Name or Path vulnerability in Edgecross Basic Software for Windows...7.8 High
- plextracLocal File Inclusion8.6 High
- Show moreLoading…