CWE-22 · Path Traversal (page 20)
Page 20 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67160 | High | 7.5 | 2026-01-02 | An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal. |
CVE-2025-59384 | High | 7.5 | 2026-01-02 | A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected… |
CVE-2025-59381 | Medium | 4.9 | 2026-01-02 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2025-59380 | Medium | 4.9 | 2026-01-02 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2025-53594 | | 2026-01-02 | A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulner… | |
CVE-2025-15432 | Medium | 5.3 | 2026-01-02 | A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of… |
CVE-2022-50796 | Critical | 9.8 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal fl… |
CVE-2022-50792 | High | 7.5 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive… |
CVE-2025-61557 | High | 7.5 | 2025-12-30 | nixseparatedebuginfod before v0.4.1 is vulnerable to Directory Traversal. |
CVE-2025-15245 | Low | 3.5 | 2025-12-30 | A vulnerability was found in D-Link DCS-850L 1.02.09. Affected is the function uploadfirmware of the component Firmware Update Service. The manipulation of the… |
CVE-2024-25183 | High | 7.5 | 2025-12-29 | givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php. |
CVE-2025-67254 | High | 7.5 | 2025-12-29 | NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php. |
CVE-2025-14728 | Medium | 6.8 | 2025-12-29 | Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written ou… |
CVE-2025-15187 | Low | 3.8 | 2025-12-29 | A vulnerability was found in GreenCMS up to 2.3. This affects an unknown part of the file /DataController.class.php of the component File Handler. Performing a… |
CVE-2025-15227 | High | 7.5 | 2025-12-29 | BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Trav… |
CVE-2025-15225 | High | 7.5 | 2025-12-29 | WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitr… |
CVE-2025-15066 | Medium | 6.2 | 2025-12-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Missing Authorization vulnerability in Innorix WP allows Path Traversal.This is… |
CVE-2025-15138 | Medium | 4.7 | 2025-12-28 | A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This mani… |
CVE-2024-42718 | Medium | 6.5 | 2025-12-26 | A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter. |
CVE-2025-15076 | High | 7.3 | 2025-12-25 | A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lead to path traversal… |
CVE-2025-68916 | Critical | 9.1 | 2025-12-24 | Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution. |
CVE-2019-25258 | High | 7.5 | 2025-12-24 | LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverifi… |
CVE-2019-25256 | Medium | 6.5 | 2025-12-24 | VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers to access arbitrary system files… |
CVE-2019-25246 | High | 8.8 | 2025-12-24 | Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability that allows attackers to read arbitrary system files via the 'RE… |
CVE-2018-25144 | High | 8.4 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains an authentication bypass vulnerability in the hidden system-editor.sh script that allows authenticated attackers to read… |
CVE-2025-14420 | High | 7.8 | 2025-12-23 | pdfforge PDF Architect CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-14413 | High | 7.8 | 2025-12-23 | Soda PDF Desktop CBZ File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-13699 | High | 7.0 | 2025-12-23 | MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2025-13698 | Medium | 4.5 | 2025-12-23 | Deciso OPNsense diag_backup.php filename Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows network-adjacent attackers to cre… |
CVE-2025-65713 | Medium | 4.0 | 2025-12-23 | Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation… |
CVE-2025-68476 | | 2025-12-22 | KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in… | |
CVE-2023-53979 | High | 8.8 | 2025-12-22 | MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attacker… |
CVE-2023-53962 | High | 7.5 | 2025-12-22 | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated directory traversal vulnerability that allows remote attackers to write arbitrary files through… |
CVE-2025-11540 | High | 7.5 | 2025-12-22 | Path Traversal vulnerability in Sharp Display Solutions projectors allows a attacker may access and read any files within the projector. |
CVE-2025-14965 | Medium | 5.5 | 2025-12-19 | A vulnerability was found in 1541492390c yougou-mall up to 0a771fa817c924efe52c8fe0a9a6658eee675f9f. This impacts the function upload/delete of the file src/ma… |
CVE-2025-67442 | High | 7.6 | 2025-12-19 | EVE-NG 6.4.0-13-PRO is vulnerable to Directory Traversal. The /api/export interface allows authenticated users to export lab files. This interface lacks effect… |
CVE-2025-66905 | High | 7.5 | 2025-12-19 | The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attack… |
CVE-2025-14910 | Medium | 4.3 | 2025-12-19 | A vulnerability was detected in Edimax BR-6208AC 1.02. This impacts the function handle_retr of the component FTP Daemon Service. The manipulation results in p… |
CVE-2025-68398 | Critical | 9.1 | 2025-12-18 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavio… |
CVE-2025-68279 | High | 7.7 | 2025-12-18 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbol… |
CVE-2025-34452 | | 2025-12-18 | Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabiliti… | |
CVE-2025-67653 | Medium | 4.3 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files. |
CVE-2025-14850 | High | 8.1 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files. |
CVE-2023-53944 | Medium | 6.5 | 2025-12-18 | EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access files outside the document root by bypass… |
CVE-2025-64235 | Medium | 6.5 | 2025-12-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows Path Traversal.This issue affects Tutu… |
CVE-2025-40898 | High | 8.1 | 2025-12-18 | A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated u… |
CVE-2025-64230 | High | 7.7 | 2025-12-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Chill Filr filr-protection allows Path Traversal.This issue… |
CVE-2025-54748 | Medium | 6.5 | 2025-12-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RomanCode MapSVG mapsvg allows Path Traversal.This issue affect… |
CVE-2025-68145 | Critical | 9.1 | 2025-12-17 | In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it… |
CVE-2025-68143 | High | 8.8 | 2025-12-17 | Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25… |
CVE-2023-53907 | Medium | 6.5 | 2025-12-17 | Bludit versions before 3.13.1 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to access arbitrary files… |
CVE-2025-67174 | High | 7.5 | 2025-12-17 | A local file inclusion (LFI) vulnerability in RiteCMS v3.1.0 allows attackers to read arbitrary files on the host via a directory traversal in the admin_langua… |
CVE-2025-67171 | High | 7.5 | 2025-12-17 | Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via directory traversal. |
CVE-2025-14727 | High | 8.3 | 2025-12-17 | A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation. Note: Software versions which have reached End of Techn… |
CVE-2025-12496 | Medium | 4.9 | 2025-12-17 | The Zephyr Project Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.203 via the `file` parameter. Th… |
CVE-2025-68155 | High | 7.5 | 2025-12-16 | @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plug… |
CVE-2025-63414 | Critical | 10.0 | 2025-12-16 | A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By… |
CVE-2023-53902 | Medium | 6.5 | 2025-12-16 | WebsiteBaker 2.13.3 contains a directory traversal vulnerability that allows authenticated attackers to delete arbitrary files by manipulating directory path p… |
CVE-2025-65076 | Medium | 6.1 | 2025-12-16 | WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-pri… |
CVE-2025-65075 | Medium | 6.5 | 2025-12-16 | WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-pri… |
CVE-2025-65074 | High | 7.2 | 2025-12-16 | WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-pri… |
CVE-2025-66449 | High | 8.8 | 2025-12-16 | ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on th… |
CVE-2025-58173 | High | 8.8 | 2025-12-16 | FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it… |
CVE-2025-60786 | High | 8.8 | 2025-12-15 | A Zip Slip vulnerability in the import a Project component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via uploading a crafted Zip… |
CVE-2025-34181 | | 2025-12-15 | NetSupport Manager < 14.12.0001 contains an arbitrary file write vulnerability in its Connectivity Server/Gateway PUTFILE request handler. An attacker with a v… | |
CVE-2025-14704 | High | 7.3 | 2025-12-15 | A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulatio… |
CVE-2025-14702 | Medium | 4.4 | 2025-12-15 | A flaw has been found in Smartbit CommV Smartschool App up to 10.4.4. Impacted is an unknown function of the component be.smartschool.mobile.SplashActivity. Ex… |
CVE-2025-14699 | Medium | 5.3 | 2025-12-15 | A security vulnerability has been detected in Municorn FAX App 3.27.0 on Android. This vulnerability affects unknown code of the component biz.faxapp.app. Such… |
CVE-2025-14698 | Medium | 4.4 | 2025-12-15 | A weakness has been identified in atlaszz AI Photo Team Galleryit App 1.3.8.2 on Android. This affects an unknown part of the component gallery.photogallery.pi… |
CVE-2025-14617 | Medium | 5.3 | 2025-12-13 | A vulnerability has been found in Jehovahs Witnesses JW Library App up to 15.5.1 on Android. Affected is an unknown function of the component org.jw.jwlibrary… |
CVE-2025-43465 | Medium | 5.5 | 2025-12-12 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.1. An app may be able to… |
CVE-2025-43463 | Medium | 5.5 | 2025-12-12 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8… |
CVE-2025-67819 | Medium | 4.9 | 2025-12-12 | An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the Ge… |
CVE-2025-67818 | High | 7.2 | 2025-12-12 | An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (… |
CVE-2025-12960 | Medium | 6.5 | 2025-12-12 | The Simple CSV Table plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.1 via the `href` parameter in the `[cs… |
CVE-2025-13891 | Medium | 6.5 | 2025-12-12 | The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due t… |
CVE-2025-14344 | Critical | 9.8 | 2025-12-12 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_aj… |
CVE-2025-13972 | Medium | 4.9 | 2025-12-12 | The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and includ… |
CVE-2025-12824 | High | 8.8 | 2025-12-12 | The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.2 via the 'player_leaderboard' shor… |
CVE-2024-58312 | High | 7.5 | 2025-12-11 | xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. A… |
CVE-2024-58310 | | 2025-12-11 | APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating UR… | |
CVE-2025-66429 | High | 8.8 | 2025-12-11 | An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. T… |
CVE-2025-14293 | Medium | 6.5 | 2025-12-11 | The WP Job Portal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.4.0 via the 'downloadCustomUploadedFile' fu… |
CVE-2025-67742 | Low | 3.8 | 2025-12-11 | In JetBrains TeamCity before 2025.11 path traversal was possible via file upload |
CVE-2025-14521 | Medium | 4.3 | 2025-12-11 | A security vulnerability has been detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The affected element is an unknown function of the fi… |
CVE-2025-14520 | Medium | 5.4 | 2025-12-11 | A weakness has been identified in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. Impacted is an unknown function of the file /admin/index.php/data… |
CVE-2025-67720 | Medium | 6.5 | 2025-12-11 | Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the… |
CVE-2020-36898 | Critical | 9.1 | 2025-12-10 | QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete f… |
CVE-2020-36893 | High | 7.5 | 2025-12-10 | Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside th… |
CVE-2020-36883 | High | 8.1 | 2025-12-10 | SpinetiX Fusion Digital Signage 3.4.8 and lower contains an authenticated path traversal vulnerability that allows attackers to manipulate file backup and dele… |
CVE-2025-56431 | High | 7.5 | 2025-12-10 | Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.ph… |
CVE-2025-56430 | High | 7.5 | 2025-12-10 | Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.ph… |
CVE-2025-67643 | Medium | 4.3 | 2025-12-10 | Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory whi… |
CVE-2025-65815 | Medium | 6.5 | 2025-12-10 | A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a directory traversal. |
CVE-2025-65814 | Medium | 6.5 | 2025-12-10 | A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a directory traversal. |
CVE-2025-65792 | Critical | 9.1 | 2025-12-10 | DataGear v5.5.0 is vulnerable to Arbitrary File Deletion. |
CVE-2025-34395 | High | 7.5 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service in which an unauthenticated attack… |
CVE-2025-8110 | High | 8.8 | 2025-12-10 | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. |
CVE-2025-13339 | High | 7.5 | 2025-12-10 | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirec… |
CVE-2025-13677 | Medium | 4.9 | 2025-12-10 | The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.2.2. This is due to insufficient path… |