CWE-22 · Path Traversal (page 2)
Page 2 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-17071 | Low | 2.7 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal. |
CVE-2026-48099 | High | 7.1 | 2026-08-13 | WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory… |
CVE-2026-45774 | | 2026-08-13 | compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import m… | |
CVE-2026-17043 | Low | 3.8 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal. |
CVE-2026-16908 | High | 8.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability. |
CVE-2026-73653 | Critical | 9.4 | 2026-08-13 | Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreensh… |
CVE-2026-67613 | Medium | 4.9 | 2026-08-13 | CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by… |
CVE-2026-13048 | High | 8.2 | 2026-08-13 | Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolat… |
CVE-2026-73509 | High | 7.6 | 2026-08-13 | OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go author… |
CVE-2026-70460 | High | 8.1 | 2026-08-13 | rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the mod… |
CVE-2026-65582 | High | 7.7 | 2026-08-13 | Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions. |
CVE-2026-61980 | High | 7.5 | 2026-08-13 | Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions. |
CVE-2026-28189 | High | 7.4 | 2026-08-13 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions. |
CVE-2026-73620 | High | 8.1 | 2026-08-13 | GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via k… |
CVE-2026-73498 | High | 7.7 | 2026-08-12 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment passes its c… |
CVE-2026-66898 | Critical | 9.9 | 2026-08-12 | A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restori… |
CVE-2026-64826 | Medium | 6.5 | 2026-08-12 | rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory tr… |
CVE-2026-16033 | High | 8.5 | 2026-08-12 | A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata tem… |
CVE-2026-13622 | High | 8.8 | 2026-08-12 | A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the targe… |
CVE-2026-13105 | High | 8.8 | 2026-08-12 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration. |
CVE-2026-73407 | | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAu… | |
CVE-2026-17266 | Medium | 6.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restrict… |
CVE-2026-18106 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input. |
CVE-2026-17094 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerabi… |
CVE-2026-66384 | Medium | 5.3 | 2026-08-12 | An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. |
CVE-2026-65939 | Medium | 6.8 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS we… |
CVE-2026-73291 | High | 7.1 | 2026-08-12 | Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.t… |
CVE-2026-67286 | | 2026-08-12 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can cr… | |
CVE-2026-66382 | Medium | 4.3 | 2026-08-12 | An authenticated user may write files outside the intended Artifactory work directory under specific conditions. |
CVE-2026-66381 | Medium | 5.3 | 2026-08-12 | A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions. |
CVE-2026-67285 | | 2026-08-12 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform inc… | |
CVE-2026-19594 | High | 8.1 | 2026-08-12 | Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two re… |
CVE-2026-63134 | Medium | 5.4 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but crea… |
CVE-2026-73244 | Medium | 5.3 | 2026-08-11 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/jav… |
CVE-2026-73234 | High | 7.8 | 2026-08-11 | FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates… |
CVE-2026-73034 | Critical | 9.8 | 2026-08-11 | DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by i… |
CVE-2026-71475 | Medium | 5.0 | 2026-08-11 | A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This oc… |
CVE-2026-19091 | High | 8.1 | 2026-08-11 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insuffic… |
CVE-2026-73227 | High | 8.1 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write at… |
CVE-2026-73225 | High | 8.1 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to… |
CVE-2026-73223 | High | 8.1 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write a… |
CVE-2026-72713 | High | 7.5 | 2026-08-11 | XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files o… |
CVE-2026-48441 | High | 8.6 | 2026-08-11 | Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary f… |
CVE-2026-65768 | High | 8.8 | 2026-08-11 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code o… |
CVE-2026-48446 | Medium | 5.5 | 2026-08-11 | CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbit… |
CVE-2026-48442 | High | 7.1 | 2026-08-11 | CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a A… |
CVE-2026-32677 | | 2026-08-11 | Path traversal for some gaudi-container-runtime before version 1.24.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged softw… | |
CVE-2026-73079 | High | 8.5 | 2026-08-11 | Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys i… |
CVE-2026-18640 | High | 7.1 | 2026-08-11 | The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record out… |
CVE-2026-72783 | Medium | 6.2 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained functio… |
CVE-2026-72773 | | 2026-08-11 | n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern… | |
CVE-2026-72770 | | 2026-08-11 | n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to… | |
CVE-2026-72604 | Medium | 6.5 | 2026-08-11 | A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the adm… |
CVE-2026-72602 | High | 7.5 | 2026-08-11 | A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arb… |
CVE-2026-33922 | Medium | 6.0 | 2026-08-11 | A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input param… |
CVE-2026-66777 | Medium | 5.9 | 2026-08-11 | SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required co… |
CVE-2026-44763 | High | 7.6 | 2026-08-11 | SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially c… |
CVE-2026-73033 | Medium | 6.5 | 2026-08-10 | Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php… |
CVE-2026-73030 | High | 8.1 | 2026-08-10 | unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths befo… |
CVE-2026-72903 | High | 8.1 | 2026-08-10 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename throu… |
CVE-2026-69112 | High | 7.1 | 2026-08-10 | Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail… |
CVE-2026-12339 | | 2026-08-10 | A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An… | |
CVE-2026-47754 | Critical | 9.3 | 2026-08-10 | Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unau… |
CVE-2026-15059 | Medium | 5.5 | 2026-08-10 | Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation. |
CVE-2026-72572 | High | 7.5 | 2026-08-10 | A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. T… |
CVE-2026-72571 | High | 7.5 | 2026-08-10 | A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server… |
CVE-2026-72569 | Critical | 9.1 | 2026-08-10 | A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the inten… |
CVE-2026-72567 | Critical | 9.8 | 2026-08-10 | An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arb… |
CVE-2026-66484 | | 2026-08-10 | GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absol… | |
CVE-2026-13170 | High | 7.2 | 2026-08-10 | The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with edi… |
CVE-2026-19372 | Medium | 5.3 | 2026-08-09 | A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the… |
CVE-2026-19371 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component c… |
CVE-2026-19370 | Medium | 5.3 | 2026-08-09 | A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts… |
CVE-2026-19368 | Low | 3.3 | 2026-08-09 | A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the… |
CVE-2026-19366 | Medium | 5.3 | 2026-08-09 | A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component… |
CVE-2026-19365 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in Ichigo3766 image-gen-mcp 0.1.0. The impacted element is an unknown function of the file src/index.ts of the component upscale… |
CVE-2026-19338 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in automateyournetwork MCPyATS up to 0.1.4. The affected element is the function processGenerateRequest of the file mcp_servers/… |
CVE-2026-19336 | Medium | 5.3 | 2026-08-09 | A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approv… |
CVE-2026-19335 | Medium | 5.3 | 2026-08-09 | A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc… |
CVE-2026-18465 | Medium | 6.5 | 2026-08-09 | The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users… |
CVE-2026-19331 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasServic… |
CVE-2026-19330 | Medium | 5.3 | 2026-08-09 | A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function create_system_json/create_library to get_system… |
CVE-2026-19328 | Medium | 5.3 | 2026-08-09 | A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill o… |
CVE-2026-19327 | Medium | 5.3 | 2026-08-09 | A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. E… |
CVE-2026-19326 | Medium | 4.4 | 2026-08-09 | A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagemen… |
CVE-2026-19325 | Medium | 5.3 | 2026-08-09 | A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. This affects t… |
CVE-2026-19324 | Low | 3.3 | 2026-08-09 | A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.re… |
CVE-2026-19323 | Medium | 5.3 | 2026-08-09 | A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function g… |
CVE-2026-19288 | Medium | 5.3 | 2026-08-08 | A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file pac… |
CVE-2026-19287 | Medium | 5.3 | 2026-08-08 | A flaw has been found in abrinsmead mindpilot-mcp 0.5.0. Affected by this issue is some unknown functionality of the component HistoryService. This manipulatio… |
CVE-2026-19285 | Medium | 5.3 | 2026-08-08 | A vulnerability was detected in aaronsb memory-graph up to 5cfd2382778837b9f6399080956eee670d00452c. Affected by this vulnerability is the function JsonMemoryS… |
CVE-2026-19270 | Medium | 5.3 | 2026-08-08 | A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of th… |
CVE-2026-16955 | Medium | 5.0 | 2026-08-08 | The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service… |
CVE-2026-47243 | | 2026-08-07 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3… | |
CVE-2026-50540 | Critical | 9.6 | 2026-08-07 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to ve… |
CVE-2026-47661 | | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pa… | |
CVE-2026-47659 | | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pa… | |
CVE-2026-19016 | Medium | 4.2 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submit… |
CVE-2026-71557 | Medium | 6.3 | 2026-08-07 | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used t… |
CVE-2026-62996 | | 2026-08-07 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: re… |