CWE-22 · Path Traversal (page 2)
Page 2 of 100 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-101888 | High | 7.2 | 2026-10-01 | The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary… |
CVE-2026-94620 | | 2026-10-01 | Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones… | |
CVE-2026-95588 | High | 8.6 | 2026-10-01 | Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions. |
CVE-2024-58388 | High | 7.5 | 2026-10-01 | Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arb… |
CVE-2026-103754 | Medium | 5.9 | 2026-10-01 | A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner tr… |
CVE-2026-103257 | High | 7.7 | 2026-10-01 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to vali… |
CVE-2026-103254 | Medium | 6.3 | 2026-10-01 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation fo… |
CVE-2026-78249 | | 2026-10-01 | A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier… | |
CVE-2025-41753 | Critical | 9.8 | 2026-10-01 | The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited… |
CVE-2026-76147 | | 2026-10-01 | A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allow… | |
CVE-2026-103533 | Medium | 4.1 | 2026-10-01 | A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/… |
CVE-2026-51864 | Critical | 9.1 | 2026-09-30 | DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote… |
CVE-2026-51862 | Critical | 9.1 | 2026-09-30 | DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use t… |
CVE-2026-51860 | High | 7.5 | 2026-09-30 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py. |
CVE-2026-51859 | Critical | 9.1 | 2026-09-30 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290). |
CVE-2026-51853 | High | 7.5 | 2026-09-30 | agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializ… |
CVE-2026-51852 | High | 7.5 | 2026-09-30 | agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method a… |
CVE-2026-51570 | High | 8.1 | 2026-09-30 | modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file. |
CVE-2026-51568 | High | 8.1 | 2026-09-30 | modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file. |
CVE-2026-102123 | High | 7.4 | 2026-09-30 | A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to wri… |
CVE-2026-102119 | High | 7.2 | 2026-09-30 | A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outsi… |
CVE-2026-102116 | High | 7.2 | 2026-09-30 | -A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the ap… |
CVE-2026-102099 | High | 7.2 | 2026-09-30 | Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative e… |
CVE-2026-102097 | High | 7.2 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated adm… |
CVE-2026-102089 | High | 7.2 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticate… |
CVE-2024-58387 | High | 7.5 | 2026-09-30 | Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attack… |
CVE-2023-54403 | High | 7.5 | 2026-09-30 | Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass auth… |
CVE-2026-102991 | Medium | 6.5 | 2026-09-30 | Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath… |
CVE-2026-101885 | High | 7.8 | 2026-09-30 | ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_pa… |
CVE-2026-55224 | | 2026-09-30 | MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal managem… | |
CVE-2026-101295 | High | 7.3 | 2026-09-30 | Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1)… |
CVE-2026-97242 | Medium | 6.8 | 2026-09-30 | Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions. |
CVE-2026-96824 | Medium | 6.8 | 2026-09-30 | Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions. |
CVE-2026-94123 | High | 7.5 | 2026-09-30 | Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions. |
CVE-2026-75098 | High | 7.5 | 2026-09-30 | The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter paramete… |
CVE-2026-102457 | Medium | 6.5 | 2026-09-30 | EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrar… |
CVE-2026-102843 | Medium | 4.7 | 2026-09-30 | A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the fi… |
CVE-2026-86136 | High | 8.1 | 2026-09-30 | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (includin… |
CVE-2026-86105 | High | 7.1 | 2026-09-30 | An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other… |
CVE-2026-13224 | | 2026-09-30 | A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local fil… | |
CVE-2026-103044 | Critical | 9.8 | 2026-09-29 | XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affect… |
CVE-2026-79534 | Medium | 5.9 | 2026-09-29 | mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystemserver/handler/helpe… |
CVE-2026-76737 | Low | 3.0 | 2026-09-29 | An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacke… |
CVE-2026-102875 | High | 7.8 | 2026-09-29 | VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Att… |
CVE-2026-102252 | | 2026-09-29 | A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who con… | |
CVE-2026-84842 | High | 8.1 | 2026-09-29 | IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacke… |
CVE-2026-84421 | High | 8.8 | 2026-09-29 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during ar… |
CVE-2026-102810 | High | 7.5 | 2026-09-29 | Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitr… |
CVE-2026-102242 | | 2026-09-29 | Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a r… | |
CVE-2026-90915 | Medium | 6.5 | 2026-09-29 | Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache… |
CVE-2026-102424 | High | 7.5 | 2026-09-29 | Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa For… |
CVE-2026-101126 | Medium | 6.5 | 2026-09-29 | Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checki… |
CVE-2026-19743 | High | 7.8 | 2026-09-29 | Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authent… |
CVE-2026-96419 | Medium | 5.5 | 2026-09-29 | Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution |
CVE-2026-96440 | | 2026-09-29 | Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 ve… | |
CVE-2026-91012 | Critical | 9.8 | 2026-09-29 | org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the fil… |
CVE-2026-102332 | Medium | 6.1 | 2026-09-28 | Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can la… |
CVE-2024-58386 | Medium | 6.5 | 2026-09-28 | ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The… |
CVE-2026-101142 | Medium | 6.3 | 2026-09-28 | A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown functionality of the file Scorecard.jsp of the… |
CVE-2026-101132 | Low | 3.1 | 2026-09-28 | A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/a… |
CVE-2026-55156 | Medium | 5.3 | 2026-09-28 | Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to vers… |
CVE-2026-54708 | | 2026-09-28 | FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated… | |
CVE-2026-54675 | | 2026-09-28 | FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionali… | |
CVE-2026-101894 | Critical | 9.1 | 2026-09-28 | The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment check… |
CVE-2026-101082 | Medium | 5.3 | 2026-09-28 | A weakness has been identified in PMWeb 7.x/8.x/2025.x. This issue affects some unknown processing of the file downloader.aspx. This manipulation of the argume… |
CVE-2026-101080 | Medium | 4.8 | 2026-09-28 | A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.p… |
CVE-2026-90925 | High | 7.1 | 2026-09-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd… |
CVE-2026-86334 | Medium | 4.2 | 2026-09-28 | Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allow… |
CVE-2026-85526 | Critical | 9.9 | 2026-09-28 | Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or… |
CVE-2026-85185 | Critical | 9.6 | 2026-09-28 | Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticate… |
CVE-2026-73642 | | 2026-09-28 | Dayforce Payroll is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set… | |
CVE-2026-15953 | Medium | 5.0 | 2026-09-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600). This issue af… |
CVE-2026-101070 | Medium | 5.3 | 2026-09-28 | A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers… |
CVE-2026-101069 | Medium | 6.5 | 2026-09-28 | A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/src/controllers/databaseConnections.js o… |
CVE-2026-101068 | Medium | 6.5 | 2026-09-28 | A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js… |
CVE-2026-101067 | High | 7.3 | 2026-09-28 | A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile of the file files.js of the component… |
CVE-2026-101066 | High | 7.3 | 2026-09-28 | A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of th… |
CVE-2026-19444 | Medium | 6.5 | 2026-09-28 | A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl ru… |
CVE-2026-101036 | Medium | 5.3 | 2026-09-28 | A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createPars… |
CVE-2026-82915 | Medium | 6.5 | 2026-09-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workf… |
CVE-2026-101051 | Low | 3.1 | 2026-09-27 | Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected… |
CVE-2026-101044 | High | 7.1 | 2026-09-27 | pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/n… |
CVE-2026-97164 | | 2026-09-27 | Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using the `images` paramete… | |
CVE-2026-84069 | Medium | 5.3 | 2026-09-27 | The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it t… |
CVE-2026-97163 | | 2026-09-26 | Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | |
CVE-2026-97161 | | 2026-09-26 | Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | |
CVE-2026-100707 | High | 7.7 | 2026-09-26 | Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation… |
CVE-2026-100689 | Medium | 5.9 | 2026-09-26 | GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-… |
CVE-2026-100682 | High | 8.8 | 2026-09-26 | Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without p… |
CVE-2026-100636 | High | 7.6 | 2026-09-26 | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitr… |
CVE-2026-100549 | Medium | 5.4 | 2026-09-26 | OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded… |
CVE-2026-100536 | Medium | 6.5 | 2026-09-26 | OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behin… |
CVE-2026-100533 | Medium | 5.3 | 2026-09-26 | OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize va… |
CVE-2026-100520 | High | 8.8 | 2026-09-26 | Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write ar… |
CVE-2026-100372 | High | 7.2 | 2026-09-25 | ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP… |
CVE-2026-63006 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the imag… | |
CVE-2026-48482 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scen… | |
CVE-2026-47679 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation… | |
CVE-2026-61525 | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. In 7.0.2 and 7.1.0, zammad's session management for websocket and long-polling connections… | |
CVE-2026-50547 | High | 7.5 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() met… |