CWE-73: External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- sunnet technology co., ltd. corporate training management system, sun.net ehrd ctms +1 moreSUNNET Corporate Training Management System - External Control of File Name or Path10.0 Critical
- harnessHarness Affected by Arbitrary File Write in Gitness LFS server8.8 High
- qi'anxin tianqing management centerQi'anxin TianQing Management Center rptsvr Arbitrary File Upload10.0 Critical
- campcodes payroll management systemCampcodes Payroll Management System index.php include file inclusion6.9 Medium
- wptobe wptobe-membershipsWptobe-memberships <= 3.4.2 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
- donknap dpanelDpanel has an arbitrary file read vulnerability4.8 Medium
- directusDirectus allows unauthenticated file upload and file modification due to lacking input sanitization9.3 Critical
- cisco evolved programmable network manager (epnm), prime infrastructure, evolved programmable network manager +2 moreCisco Evolved Programmable Network Manager and Prime Infrastructure Arbitrary File Download Vulnerability6.5 Medium
- foxit software pdf readerFoxit PDF Reader < 4.3.1.0218 JavaScript File Write8.4 High
- microsoft windows security appWindows Security App Spoofing Vulnerability5.5 Medium
- tagfree x-free uploader: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows :...8.8 High
- cconard96 glpi-screenshot-pluginglpi-screenshot-plugin exposes local files in /ajax/screenshot.php7.7 High
- bearsthemes alone – charity multipurpose non-profit wordpress themeAlone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion9.1 Critical
- brainstormforce sureforms, sureforms – drag and drop form builder for wordpress +1 moreSureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion8.1 High
- go toolchain cmd/go, golang go +1 moreUnexpected command execution in untrusted VCS repositories in cmd/go8.6 High
- gitGit alllows arbitrary file writes via bundle-uri parameter injection8.6 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows Storage Spoofing Vulnerability3.5 Low
- linkwardenLinkwarden Local File Inclusion Vulnerability8.7 High
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion8.8 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM command execution9.1 Critical
- ricoh company, ltd. streamline nx v3 pc clientExternal control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3...6.9 Medium
- salt project saltCVE-2025-22241 salt advisory5.6 Medium
- ossec ossec-hids agentRemote code execution and local privilege escalation due to UNC access and NetNTLMv2 hash theft9.5 Critical
- wazuh, wazuh agent +1 moreRemote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft9.5 Critical
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 moreInternet Shortcut Files Remote Code Execution Vulnerability8.8 High
- microsoft windows security appWindows Security App Spoofing Vulnerability5.5 Medium
- octoprintOctoPrint vulnerable to possible file extraction via upload endpoints5.4 Medium
- haxtheweb issues, psu haxcms-php +1 moreHAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter6.5 Medium
- soar cloud system co., ltd. hrd human resource management system, scshr hr portal +1 moreSoar Cloud HRD Human Resource Management System - External Control of File Name or Path8.8 High
- soar cloud system co., ltd. hrd human resource management system, scshr hr portal +1 moreSoar Cloud HRD Human Resource Management System - External Control of File Name or Path8.7 High
- isc keaInsecure handling of file paths allows multiple local attacks6.1 Medium
- emagicone store manager for woocommerceeMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletion9.1 Critical
- emagicone store manager for woocommerceeMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Read5.9 Medium
- abb aspect-enterprise, matrix series, nexus series +2 morePredictable Filename7.0 High
- abb aspect-enterprise, matrix series, nexus series +2 moreAdmin Authorized System File corruption8.9 High
- quantumcloud wpbot pro wordpress chatbotWPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
- microsoft defender for endpoint, defender for endpoint for linux +1 moreMicrosoft Defender Elevation of Privilege Vulnerability6.7 Medium
- microsoft .net, build tools, .net 8.0 +7 more +9 more.NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability8.0 High
- themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 moreEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read7.5 High
- apache parquet, apache software foundation parquet java +1 moreApache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata7.1 High
- axis camera station proGee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a...6.1 Medium
- No product listedLabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve...9.8 Critical
- qianxin tianqing endpoint security management systemThe quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0...8.8 High
- lambertgroup clever - html5 radio player with history - shoutcast and icecast - elementor widget addonCLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon <= 2.4 - Unauthenticated Arbitrary File Read7.5 High
- torrahclef company website cmsSourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio"...9.8 Critical
- torrahclef company website cmsSourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create...9.8 Critical
- wallosapp wallosWallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows...9.8 Critical
- wallosapp wallosWallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows...9.8 Critical
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface5.1 Medium
- microsoft windows admin center, windows admin center in azure portal +1 moreWindows Admin Center in Azure Portal Information Disclosure Vulnerability6.2 Medium
- Show moreLoading…