CWE-22 · Path Traversal (page 15)
Page 15 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32522 | High | 8.6 | 2026-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-… |
CVE-2026-32496 | Medium | 6.8 | 2026-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NYSL Spam Protect for Contact Form 7 wp-contact-form-7-spam-blo… |
CVE-2026-31913 | High | 8.6 | 2026-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Whitebox-Studio Scape scape allows Path Traversal.This issue af… |
CVE-2026-27040 | High | 8.8 | 2026-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AA-Team WZone woozone allows Path Traversal.This issue affects… |
CVE-2026-25328 | Medium | 6.8 | 2026-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Product File Upload for WooCommerce products-file-u… |
CVE-2026-24970 | High | 7.7 | 2026-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Energox energox allows Path Traversal.This issue… |
CVE-2026-24969 | High | 7.7 | 2026-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Instant VA instantva allows Path Traversal.This… |
CVE-2026-22448 | High | 7.5 | 2026-03-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in flexcubed PitchPrint pitchprint allows Path Traversal.This issu… |
CVE-2026-28827 | Critical | 9.3 | 2026-03-25 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8… |
CVE-2026-28816 | Medium | 4.0 | 2026-03-25 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be… |
CVE-2026-20688 | Critical | 9.3 | 2026-03-25 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS… |
CVE-2026-33344 | High | 8.1 | 2026-03-24 | Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to C… |
CVE-2026-33329 | High | 8.1 | 2026-03-24 | FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js… |
CVE-2026-33497 | High | 7.5 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile… |
CVE-2026-33309 | Critical | 9.9 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (Exte… |
CVE-2026-4741 | | 2026-03-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TeamJCD JoyConDroid (app/src/main/java/com/rdapps/gamepad/util… | |
CVE-2026-22739 | High | 8.6 | 2026-03-24 | Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file syste… |
CVE-2026-33242 | High | 7.5 | 2026-03-24 | Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The v… |
CVE-2026-33211 | Critical | 9.6 | 2026-03-24 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1… |
CVE-2026-33195 | Critical | 9.8 | 2026-03-24 | Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskServi… |
CVE-2026-33046 | High | 8.8 | 2026-03-23 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabil… |
CVE-2025-60946 | High | 8.8 | 2026-03-23 | Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file directories. Fixed in 8.1.0 alpha. |
CVE-2026-23485 | Medium | 5.3 | 2026-03-23 | Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the filePath parameter accepts path traversal sequences, allowing enumeration of file… |
CVE-2026-23484 | Medium | 6.5 | 2026-03-23 | Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the fileName parameter is not filtered, allowing path traversal to write fi… |
CVE-2026-23483 | Medium | 5.3 | 2026-03-23 | Blinko is an AI-powered card note-taking project. In versions from 1.8.3 and prior, the plugin file server endpoint uses join() to concatenate paths but does n… |
CVE-2026-23482 | High | 7.5 | 2026-03-23 | Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform permission checks on the temp/ path and doe… |
CVE-2026-23481 | Medium | 6.5 | 2026-03-23 | Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an authenticated arbitrary file write vulnerability in saveAdditionalDevFile… |
CVE-2026-33681 | High | 7.2 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginRunDatabaseScript.json.php` endpoint accepts a `name` pa… |
CVE-2026-33513 | High | 8.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input… |
CVE-2026-33493 | High | 7.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/import.json.php` endpoint accepts a user-controlled `fileURI`… |
CVE-2026-33293 | High | 8.1 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly t… |
CVE-2026-33292 | High | 7.5 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that… |
CVE-2019-25610 | Medium | 6.5 | 2026-03-22 | NetNumber Titan Master 7.9.1 contains a path traversal vulnerability in the drp endpoint that allows authenticated users to download arbitrary files by injecti… |
CVE-2026-4542 | Medium | 5.4 | 2026-03-22 | A vulnerability has been found in SSCMS 4.7.0. The affected element is an unknown function of the file LayerImageController.Submit.cs of the component layerIma… |
CVE-2019-25579 | High | 7.5 | 2026-03-21 | phpTransformer 2016.9 contains a directory traversal vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the path par… |
CVE-2019-25577 | Medium | 5.5 | 2026-03-21 | SeoToaster Ecommerce 3.0.0 contains a local file inclusion vulnerability that allows authenticated attackers to read arbitrary files by manipulating path param… |
CVE-2019-25574 | Medium | 6.5 | 2026-03-21 | Green CMS 2.x contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files and directories by injecting directory tr… |
CVE-2026-32055 | High | 7.6 | 2026-03-21 | OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that allows attackers to write files outside the w… |
CVE-2026-3474 | Medium | 4.9 | 2026-03-21 | The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and in… |
CVE-2026-3339 | Low | 2.7 | 2026-03-21 | The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJ… |
CVE-2026-33238 | Medium | 4.3 | 2026-03-21 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly t… |
CVE-2026-3864 | Medium | 6.5 | 2026-03-20 | A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers wi… |
CVE-2026-33476 | High | 7.5 | 2026-03-20 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance… |
CVE-2026-33236 | High | 8.1 | 2026-03-20 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Proc… |
CVE-2026-33194 | Medium | 6.8 | 2026-03-20 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, the `IsSensitivePath()` function in `kernel/util/path.go` uses a denylist approach th… |
CVE-2026-32733 | Medium | 6.5 | 2026-03-20 | Halloy is an IRC application written in Rust. Prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, the DCC receive flow did not sanitize filenames from in… |
CVE-2026-33171 | Medium | 4.3 | 2026-03-20 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, authenticated Control Panel users could read arbitr… |
CVE-2026-33166 | High | 8.6 | 2026-03-20 | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. The Allure report generator prior to version 2.38.0 is vulnerable to… |
CVE-2026-23536 | High | 7.5 | 2026-03-20 | A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated remote attacker to read any file accessi… |
CVE-2025-55988 | High | 7.2 | 2026-03-20 | An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI… |
CVE-2026-32310 | Medium | 4.1 | 2026-03-20 | Cryptomator encrypts data being stored on cloud infrastructure. From version 1.6.0 to before version 1.19.1, vault configuration is parsed before its integrity… |
CVE-2026-30580 | Medium | 4.3 | 2026-03-20 | File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" functionality of the application to read ar… |
CVE-2026-2421 | Medium | 6.5 | 2026-03-20 | The ilGhera Carta Docente for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the 'cert' param… |
CVE-2026-27625 | High | 8.1 | 2026-03-20 | Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf en… |
CVE-2026-33054 | Critical | 10.0 | 2026-03-20 | Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows a… |
CVE-2026-32938 | Critical | 9.9 | 2026-03-20 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file… |
CVE-2026-32808 | High | 8.1 | 2026-03-20 | pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verificatio… |
CVE-2026-32711 | High | 7.8 | 2026-03-20 | pydicom is a pure Python package for working with DICOM files. Versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted… |
CVE-2026-32771 | Critical | 9.8 | 2026-03-20 | The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). In versio… |
CVE-2026-32758 | Medium | 6.5 | 2026-03-20 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.2 and be… |
CVE-2026-22737 | Medium | 5.9 | 2026-03-20 | Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from… |
CVE-2026-32750 | Medium | 6.8 | 2026-03-19 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importStdMd passes the localPath parameter directly to model.Im… |
CVE-2026-32036 | Medium | 6.5 | 2026-03-19 | OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks b… |
CVE-2026-32033 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validati… |
CVE-2026-32030 | High | 7.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that accepts arbitrary absolute paths when iMessa… |
CVE-2026-32026 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbox media handling that allows absolute paths under the host temp… |
CVE-2026-32020 | Low | 3.3 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file r… |
CVE-2026-32007 | Medium | 6.8 | 2026-03-19 | OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to m… |
CVE-2026-32749 | High | 7.6 | 2026-03-19 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploaded archiv… |
CVE-2026-32747 | Medium | 6.8 | 2026-03-19 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the globalCopyFiles API eads source files using filepath.Abs() with no workspac… |
CVE-2026-25928 | Medium | 6.5 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a… |
CVE-2025-67115 | Medium | 6.5 | 2026-03-19 | A path traversal vulnerability in /ftl/web/setup.cgi in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote aut… |
CVE-2026-30403 | High | 7.5 | 2026-03-19 | There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, which can be used to… |
CVE-2026-3029 | High | 7.5 | 2026-03-19 | A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5. |
CVE-2026-22557 | Critical | 10.0 | 2026-03-19 | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underly… |
CVE-2026-32805 | High | 7.5 | 2026-03-18 | Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub… |
CVE-2026-32731 | Critical | 9.9 | 2026-03-18 | ApostropheCMS is an open-source content management framework. Prior to version 3.5.3 of `@apostrophecms/import-export`, The `extract()` function in `gzip.js` c… |
CVE-2025-15031 | Critical | 9.1 | 2026-03-18 | A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use o… |
CVE-2026-3479 | | 2026-03-18 | DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation… | |
CVE-2026-33001 | High | 8.8 | 2026-03-18 | Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted a… |
CVE-2026-27523 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.24 contain a sandbox bind validation vulnerability allowing attackers to bypass allowed-root and blocked-path checks via syml… |
CVE-2026-27522 | Medium | 6.5 | 2026-03-18 | OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is uns… |
CVE-2026-22171 | High | 8.2 | 2026-03-18 | OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated direc… |
CVE-2026-32981 | High | 7.5 | 2026-03-17 | A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization… |
CVE-2026-25770 | Critical | 9.1 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privileg… |
CVE-2026-4307 | Medium | 4.3 | 2026-03-17 | A security flaw has been discovered in frdel/agent0ai agent-zero 0.9.7-10. The impacted element is the function get_abs_path of the file python/helpers/files.p… |
CVE-2026-4285 | Low | 2.7 | 2026-03-17 | A vulnerability was identified in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. Impacted is the function recognizeMarkdown of the file… |
CVE-2026-21991 | Medium | 5.5 | 2026-03-16 | A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names. |
CVE-2026-29522 | | 2026-03-16 | ZwickRoell Test Data Management versions prior to 3.0.8 contain a local file inclusion (LFI) vulnerability in the /server/node_upgrade_srv.js endpoint. An unau… | |
CVE-2026-32262 | Medium | 4.3 | 2026-03-16 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the Assets… |
CVE-2025-66687 | High | 7.5 | 2026-03-16 | Doom Launcher 3.8.1.0 is vulnerable to Directory Traversal due to missing file path validation during the extraction of game files |
CVE-2026-4233 | Medium | 4.3 | 2026-03-16 | A vulnerability was identified in ThingsGateway 12. This affects an unknown part of the file /api/file/download. The manipulation of the argument fileName lead… |
CVE-2026-4222 | Low | 3.8 | 2026-03-16 | A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file /api/admin/plugins/install/… |
CVE-2026-3839 | High | 7.3 | 2026-03-16 | Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affect… |
CVE-2026-3838 | High | 8.8 | 2026-03-16 | Unraid Update Request Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected inst… |
CVE-2026-32719 | Medium | 4.2 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, The Imported… |
CVE-2026-32709 | Medium | 5.4 | 2026-03-16 | PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, An unauthenticated path traversal vulnerability in the PX4 Autopilot MAVLink FTP im… |
CVE-2026-2493 | High | 7.5 | 2026-03-16 | IceWarp collaboration Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on… |
CVE-2026-21005 | Medium | 6.5 | 2026-03-16 | Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files with Smart Switch privilege. |
CVE-2026-21001 | Medium | 5.5 | 2026-03-16 | Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege. |