CWE-22 · Path Traversal (page 16)
Page 16 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21000 | Medium | 5.5 | 2026-03-16 | Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege. |
CVE-2026-4092 | High | 8.8 | 2026-03-13 | Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project contain… |
CVE-2026-31886 | Critical | 9.1 | 2026-03-13 | Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is pass… |
CVE-2026-30915 | Medium | 4.3 | 2026-03-13 | SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group… |
CVE-2026-30914 | High | 8.1 | 2026-03-13 | SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handler… |
CVE-2026-30853 | Medium | 5.0 | 2026-03-13 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the Rock… |
CVE-2026-23942 | Medium | 5.4 | 2026-03-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vuln… |
CVE-2026-22199 | High | 7.5 | 2026-03-13 | Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated atta… |
CVE-2025-66249 | Medium | 6.3 | 2026-03-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy. This issue affects Apache Livy: from 0.3.0 before… |
CVE-2026-32274 | High | 7.5 | 2026-03-12 | Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is comp… |
CVE-2026-32232 | Critical | 9.8 | 2026-03-12 | ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypas… |
CVE-2026-32140 | High | 8.8 | 2026-03-12 | Dataease is an open source data visualization analysis tool. Prior to 2.10.20, By controlling the IniFile parameter, an attacker can force the JDBC driver to l… |
CVE-2026-32116 | High | 8.1 | 2026-03-12 | Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file (wor… |
CVE-2026-28793 | High | 8.4 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal… |
CVE-2026-28792 | Critical | 9.6 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin… |
CVE-2026-28791 | High | 7.4 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS development server's media upload handler. T… |
CVE-2026-24125 | Medium | 6.3 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths (r… |
CVE-2026-4044 | Low | 3.8 | 2026-03-12 | A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.php of the component Delete Handler. Pe… |
CVE-2026-3954 | Medium | 6.5 | 2026-03-11 | A weakness has been identified in OpenBMB XAgent 1.0.0. Affected by this vulnerability is the function workspace of the file XAgentServer/application/routers/w… |
CVE-2019-25480 | High | 7.5 | 2026-03-11 | ARMBot contains an unrestricted file upload vulnerability in upload.php that allows unauthenticated attackers to upload arbitrary files by manipulating the fil… |
CVE-2019-25471 | Critical | 9.8 | 2026-03-11 | FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php e… |
CVE-2026-30234 | Medium | 6.5 | 2026-03-11 | OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permissions can upload a… |
CVE-2026-27897 | Critical | 10.0 | 2026-03-11 | Vociferous provides cross-platform, offline speech-to-text with local AI refinement. Prior to 4.4.2, the vulnerability exists in src/api/system.py within the e… |
CVE-2026-3013 | | 2026-03-11 | Coppermine Photo Gallery in versions 1.6.09 through 1.6.27 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit a vulnerable end… | |
CVE-2026-32061 | Medium | 4.4 | 2026-03-11 | OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outs… |
CVE-2026-32060 | High | 8.8 | 2026-03-11 | OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configure… |
CVE-2026-21360 | Medium | 6.8 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Limitation of a Pathname to a… |
CVE-2026-31817 | High | 8.5 | 2026-03-10 | OliveTin gives access to predefined shell commands from a web interface. Prior to 3000.11.2, when the saveLogs feature is enabled, OliveTin persists execution… |
CVE-2026-28807 | High | 7.5 | 2026-03-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded… |
CVE-2026-30952 | High | 7.5 | 2026-03-10 | liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file… |
CVE-2026-27825 | Critical | 9.0 | 2026-03-10 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the `confluence_download_attachme… |
CVE-2026-30973 | Medium | 6.5 | 2026-03-10 | Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appium/support contains a… |
CVE-2026-30958 | High | 7.2 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName e… |
CVE-2026-30942 | Medium | 6.5 | 2026-03-10 | Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to 1.7.3, an authenticated path traversal vulnerabil… |
CVE-2026-2741 | Medium | 6.8 | 2026-03-10 | Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 thr… |
CVE-2026-23907 | Medium | 5.3 | 2026-03-10 | This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example… |
CVE-2025-54659 | Medium | 5.8 | 2026-03-10 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability in Fortinet FortiSOAR Agent Communicatio… |
CVE-2026-3585 | High | 7.5 | 2026-03-10 | The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' functio… |
CVE-2026-30869 | Critical | 9.3 | 2026-03-10 | SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary… |
CVE-2026-31802 | Medium | 5.5 | 2026-03-10 | node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction direc… |
CVE-2026-1776 | Medium | 6.5 | 2026-03-10 | Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implementation that allows… |
CVE-2026-30240 | Critical | 9.6 | 2026-03-09 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Pro… |
CVE-2025-70028 | High | 7.5 | 2026-03-09 | An issue pertaining to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') was discovered in Sunbird-Ed SunbirdEd-portal v1… |
CVE-2026-0846 | High | 7.5 | 2026-03-09 | A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input p… |
CVE-2026-3089 | Medium | 6.5 | 2026-03-09 | Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user… |
CVE-2025-41758 | High | 8.8 | 2026-03-09 | A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this can lead to overwri… |
CVE-2025-41757 | High | 8.8 | 2026-03-09 | A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs with elevated privileges and does not validate the… |
CVE-2025-41755 | Medium | 6.5 | 2026-03-09 | A low-privileged remote attacker can exploit the ubr-logread method in wwwubr.cgi to read arbitrary files on the system. The endpoint accepts a parameter speci… |
CVE-2026-3795 | Medium | 6.3 | 2026-03-09 | A security flaw has been discovered in doramart DoraCMS 3.0.x. Impacted is the function createFileBypath of the file /DoraCMS/server/app/router/api/v1.js. Perf… |
CVE-2026-3719 | Medium | 5.3 | 2026-03-08 | A vulnerability was identified in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). This issue affects some unknown processing of the file /Syste… |
CVE-2026-3695 | Medium | 6.5 | 2026-03-08 | A vulnerability has been found in SourceCodester Modern Image Gallery App 1.0. Impacted is an unknown function of the file /delete.php. Such manipulation of th… |
CVE-2026-30848 | Low | 3.7 | 2026-03-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.8 and 9.5.0-alpha.8, the PagesRou… |
CVE-2026-29786 | Medium | 6.3 | 2026-03-07 | node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory… |
CVE-2026-29780 | Medium | 5.5 | 2026-03-07 | eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to vers… |
CVE-2026-29190 | Medium | 4.1 | 2026-03-07 | Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, there is a Path Traversal vulnerability in the backup read… |
CVE-2026-29185 | Low | 2.7 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations a… |
CVE-2025-14675 | High | 7.2 | 2026-03-07 | The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file' function in all v… |
CVE-2026-30828 | High | 7.5 | 2026-03-07 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. Th… |
CVE-2026-27139 | Low | 2.5 | 2026-03-06 | On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root… |
CVE-2026-29790 | Medium | 5.3 | 2026-03-06 | dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exi… |
CVE-2026-29064 | High | 8.2 | 2026-03-06 | Zarf is an Airgap Native Packager Manager for Kubernetes. From version 0.54.0 to before version 0.73.1, a path traversal vulnerability in archive extraction al… |
CVE-2018-25194 | High | 8.2 | 2026-03-06 | Nominas 0.27 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2018-25184 | Medium | 6.2 | 2026-03-06 | Surreal ToDo 0.6.1.2 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the content pa… |
CVE-2018-25181 | High | 7.5 | 2026-03-06 | Musicco 2.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary directories by manipulating the parent parame… |
CVE-2018-25178 | High | 7.5 | 2026-03-06 | Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file par… |
CVE-2026-29059 | High | 7.5 | 2026-03-06 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path tr… |
CVE-2026-29065 | Critical | 9.1 | 2026-03-06 | changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerability in the backup restore functionality… |
CVE-2026-28800 | Medium | 6.4 | 2026-03-06 | Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Discord Remote Control set up in a non-priva… |
CVE-2026-28795 | Critical | 9.8 | 2026-03-06 | OpenChatBI is an intelligent chat-based BI tool powered by large language models, designed to help users query, analyze, and visualize data through natural lan… |
CVE-2026-28679 | High | 8.6 | 2026-03-06 | Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. Prior to version 1.21.0, when a user requests a download, the a… |
CVE-2026-28676 | High | 8.8 | 2026-03-06 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers… |
CVE-2026-28429 | High | 7.5 | 2026-03-06 | Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871, a Path Traversal vulnerability was identified in the gameName parameter. While the app… |
CVE-2026-26124 | Medium | 6.7 | 2026-03-05 | '.../...//' in Azure Compute Gallery allows an authorized attacker to elevate privileges locally. |
CVE-2026-28486 | Medium | 6.1 | 2026-03-05 | OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrar… |
CVE-2026-28482 | High | 7.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory c… |
CVE-2026-28462 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download f… |
CVE-2026-28457 | Medium | 6.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mirroring (must be enabled) that uses the skill frontmatter name p… |
CVE-2026-28453 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the i… |
CVE-2026-28447 | High | 8.1 | 2026-03-05 | OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names t… |
CVE-2026-28393 | High | 7.7 | 2026-03-05 | OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execu… |
CVE-2026-24457 | Critical | 9.1 | 2026-03-05 | An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A… |
CVE-2025-70231 | Critical | 9.8 | 2026-03-05 | D-Link DIR-513 version 1.10 contains a critical-level vulnerability. When processing POST requests related to verification codes in /goform/formLogin, it enter… |
CVE-2025-45691 | High | 7.5 | 2026-03-05 | An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from impr… |
CVE-2026-28538 | Medium | 5.9 | 2026-03-05 | Path traversal vulnerability in the certificate management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-2743 | Critical | 9.8 | 2026-03-05 | Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT)… |
CVE-2026-28078 | Medium | 4.9 | 2026-03-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Stylemix uListing ulisting allows Path Traversal.This issue aff… |
CVE-2026-22460 | High | 8.6 | 2026-03-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpWax FormGent formgent allows Path Traversal.This issue affect… |
CVE-2025-69411 | High | 7.5 | 2026-03-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus… |
CVE-2026-28427 | High | 7.5 | 2026-03-04 | OpenDeck is Linux software for your Elgato Stream Deck. Prior to 2.8.1, the service listening on port 57118 serves static files for installed plugins but does… |
CVE-2026-0847 | High | 7.5 | 2026-03-04 | A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCo… |
CVE-2026-27442 | High | 7.5 | 2026-03-04 | The GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted emails, allowing a… |
CVE-2026-28769 | Medium | 6.5 | 2026-03-04 | A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite… |
CVE-2026-24848 | Critical | 9.9 | 2026-03-03 | OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument() method in… |
CVE-2026-2606 | Medium | 6.5 | 2026-03-03 | IBM webMethods API Gateway (on-prem) 10.11 through 10.11_Fix3210.15 to 10.15_Fix2711.1 to 11.1_Fix7 IBM webMethods API Management (on-prem) fails to properly v… |
CVE-2026-28518 | High | 7.8 | 2026-03-03 | OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to wr… |
CVE-2026-2448 | High | 8.8 | 2026-03-03 | The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via the locate_template(… |
CVE-2025-48636 | High | 8.4 | 2026-03-02 | In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to lo… |
CVE-2025-48567 | High | 7.8 | 2026-03-02 | In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normaliza… |
CVE-2026-0655 | High | 8.0 | 2026-03-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjac… |
CVE-2026-3405 | Low | 3.1 | 2026-03-02 | A vulnerability has been found in thinkgem JeeSite up to 5.15.1. The affected element is an unknown function of the component Connection Handler. The manipulat… |