CWE-73: External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- mbs double-a profibus, double-a x-link, double-x can +16 more +18 moreArbitrary file delete vulnerability in method ugw-restore7.2 High
- mbs double-a profibus, double-a x-link, double-x can +16 more +18 moreArbitrary file delete vulnerability in method ugw-logstop7.2 High
- mbs double-a profibus, double-a x-link, double-x can +16 more +18 moreArbitrary file delete vulnerability in method ugw-delete-file7.2 High
- mbs double-a profibus, double-a x-link, double-x can +16 more +18 moreArbitrary file delete vulnerability in method bac-scanresult7.2 High
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System index.php include file inclusion6.9 Medium
- alfio-event alf.ioalf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script4.9 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System index.php file inclusion5.3 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System index.php file inclusion5.3 Medium
- conda py-rattler, rattler, rattler-build +1 more +3 moreRattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)6.9 Medium
mautic/corePackagistMautic vulnerable to Path Traversal via Campaign Import9.9 Critical- oscal-compass compliance-trestlecompliance-trestle - jinja has an Arbitrary File Write via Path Traversal8.4 High
- oscal-compass compliance-trestlecompliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal7.1 High
- microsoft ufoMicrosoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory8.1 High
- jenkins email extension, jenkins project email extension plugin +1 moreJenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem8.8 High
- wpxpro xpro elementor addons - proXpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG6.5 Medium
- oalders http::daemon, red hat enterprise linux 10, enterprise linux 7 +2 more +4 moreHTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()9.1 Critical
- triliumnext triliumTrilium Notes has Local File Inclusion via upload modified file API endpoint6.8 Medium
- tenable terrascanTerrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL...9.3 Critical
- tenable terrascanTerrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the...9.3 Critical
- ci4-cms-erp ci4msCI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations6.5 Medium
- hsclabs mailinspectorHSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper...7.5 High
- microsoft apmMicrosoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`5.5 Medium
- squinky86 stigqterSTIGQter: Arbitrary File Write leading to Local Code Execution via Export HTML8.4 High
- stylemix motors – car dealership & classified listings pluginMotors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter8.1 High
- palo alto networks wildfire wf-500 and wf-500-b, paloaltonetworks pan-os +1 moreWildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B)5.0 Medium
- zoom communications workplace vdi plugin, zoom workplace virtual desktop infrastructure +1 moreExternal Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal...7.8 High
- microsoft sql server 2016 service pack 3 (gdr), sql server 2016 service pack 3 azure connect feature pack, sql server 2017 (cu 31) +12 more +14 moreSQL Server Remote Code Execution Vulnerability8.8 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability7.4 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 moreWindows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability7.8 High
- microsoft office, word, 365 apps +6 more +8 moreMicrosoft Word Information Disclosure Vulnerability4.3 Medium
- microsoft azure monitor, azure monitor agent +1 moreAzure Monitor Agent Elevation of Privilege Vulnerability7.8 High
- dragonmonk111 junoclawJunoClaw: upload_wasm accepted arbitrary filesystem paths without validation8.5 High
- hahwul dalfoxDalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode8.2 High
- hahwul dalfoxDalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode7.5 High
- ivanti xtractionExternal control of a file name in Ivanti Xtraction before version 2026.2 allows a remote...9.6 Critical
- alfredredbird tookie-osintTookie: Arbitrary file write via path traversal in -u username / -U userfile output filename6.7 Medium
- seppmail ag secure email gatewayLocal File Inclusion (LFI) and Arbitrary File Deletion8.8 High
- streamlinkStreamlink: Arbitrary local file read via file:// URI in HLS and DASH6.5 Medium
- microsoft apmMicrosoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install7.1 High
- gotenbergGotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme5.9 Medium
- gotenbergGotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes5.3 Medium
- getgrav grav-plugin-formGrav: Anonymous Page Content Overwrite via Form File Upload filename Override7.7 High
- thorsten phpmyfaqphpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter7.0 High
- dgtlmoon changedetection.io, webtechnologies changedetection +1 morechangedetection.io: Arbitrary Local File Read via crafted backup restore7.5 High
@evomap/evolvernpm@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)8.8 High- gotenbergGotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move8.2 High
- totolink n300rhTotolink N300RH cstecgi.cgi setUploadSetting file inclusion6.9 Medium
- wazuhWazuh cluster sync path traversal in decompress_files() enables arbitrary file write and code execution from authenticated cluster peer9.0 Critical
- squidexSquidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction5.5 Medium
- i18next i18next-fs-backendi18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite8.2 High
- Show moreLoading…