CWE-73: External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- easyimages2.0 project easyimages2.0An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6...9.1 Critical
- zoom roomsZoom Rooms for macOS - External Control of File Name or Path5.0 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +17 more +19 moreWindows Storage VSP Driver Elevation of Privilege Vulnerability7.8 High
- usememos memosmemos lacks file name validation or verification4.3 Medium
- request serious play llc serious play media playerReQuest Serious Play F3 Media Player <= 3.0.0 Directory Traversal File Disclosure8.7 High
- stylemix cost calculator builderCost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File Deletion8.8 High
- better-authbetter-auth before 1.4.2 basePath Modification DoS9.3 Critical
- red hat openstack platform 13 (queens), openstack platform 16.2, openstack platform 17.1 +2 morePython-mistralclient: mistral-dashboard: local file inclusion through the 'create workbook' feature6.5 Medium
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Deletion (patch_contents.php)9.2 Critical
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 moreUnauthenticated Arbitrary File Deletion (upgrade_contents.php)7.8 High
- liquidthemes ai engine for wordpress: chatgpt, gpt content generatorAI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read6.5 Medium
- wazuhWazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities7.7 High
- zhengdon 简数采集器简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Read4.9 Medium
- husainali52 wp audio galleryWP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' Parameter8.1 High
- privatebinPrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal5.8 Medium
- zoom communications inc. clients, zoom meeting software development kit, rooms +3 more +5 moreZoom Clients - External Control of File Name or Path4.3 Medium
- zoom communications inc. workplace for macos, zoom meeting software development kit, workplace desktop +2 moreZoom Workplace for macOS - External Control of File Name or Path5.0 Medium
- tec-it datenverarbeitung gmbh, austria tbarcodeTEC-IT TBarCode SDK 11.15 Remote File Create6.9 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +17 more +19 moreWindows WLAN Service Elevation of Privilege Vulnerability7.8 High
- intel computing improvement programExternal control of file name or path for some Intel(R) CIP software before version WIN_DCA_2.4.0...5.6 Medium
- axis communications ab osIt was possible to upload files with a specific name to a temporary directory, which may result...3.1 Low
- miunosoft auto amazon links – amazon associates affiliate pluginAuto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.3 - Unauthenticated Arbitrary File Read7.5 High
- 70mai x200, x200 firmware +1 more70mai X200 Init Script file inclusion7.1 High
- kovidgoyal calibrecalibre is vulnerable to arbitrary code execution when opening FB2 files9.3 Critical
- jcollings import wp – export and import csv and xml files to wordpressImport WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read4.9 Medium
- nagios xiNagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script8.5 High
- aio-libs aiomysqlaiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server8.2 High
- opentext flipperExternal Control of File vulnerability has been discovered in opentext Flipper.5.3 Medium
- opentext flipperExternal Control of File path vulnerability has been discovered on Openext Flipper.5.3 Medium
- david lingren media library assistantMedia Library Assistant <= 3.29 - Unauthenticated Limited File Read5.3 Medium
- blakeblackshear frigateFrigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameter7.7 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP Configuration utility and tmsh vulnerability8.5 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreNTLM Hash Disclosure Spoofing Vulnerability6.5 Medium
- microsoft azure compute galleryAzure Compute Gallery Elevation of Privilege Vulnerability8.2 High
- microsoft azure compute galleryConfidential Azure Container Instances Elevation of Privilege Vulnerability8.2 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +25 more +27 moreData Sharing Service Spoofing Vulnerability7.7 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +28 more +30 moreNTLM Hash Disclosure Spoofing Vulnerability6.5 Medium
- newforma project centerNewforma Info Exchange (NIX) arbitrary file read and delete6.1 Medium
- stylemix motors – car dealership & classified listings pluginMotors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
- backupbolt backup boltBackup Bolt <= 1.4.1 - Authenticated (Admin+) Arbitrary File Download3.8 Low
- auth0 laravel-auth0auth0-PHP: Improper File Type Handling in Bulk User Import3.3 Low
- invoke-ai invoke-ai/invokeaiPath Traversal and Arbitrary File Deletion in invoke-ai/invokeai9.8 Critical
- smackcoders wp ultimate csv importer – import csv, xml & excel into wordpressWP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
- flowiseFlowise - Arbitrary File Access via Missing Chat Flow ID Validation9.3 Critical
- flowiseFlowise - Arbitrary File Read via chatId Parameter8.7 High
- fassionstorage propovoice: all-in-one client management systemPropovoice <= 1.7.6.7 - Unauthenticated Arbitrary File Read7.5 High
- tautulliTautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent9.1 Critical
- microsoft azure connected machine agentAzure Connected Machine Agent Elevation of Privilege Vulnerability7.8 High
- bearsthemes goza - nonprofit charity wordpress themeGoza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Deletion9.1 Critical
- campcodes recruitment management system, online recruitment management system +1 moreCampcodes Recruitment Management System index.php include file inclusion5.1 Medium
- Show moreLoading…