CWE-22 · Path Traversal (page 23)
Page 23 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-61666 | | 2025-10-02 | Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and non default installs between versions 5… | |
CVE-2025-59744 | High | 7.5 | 2025-10-02 | Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only within the web root using the “docurl” param… |
CVE-2025-54293 | Medium | 6.5 | 2025-10-02 | Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host s… |
CVE-2025-54292 | Medium | 4.6 | 2025-10-02 | Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended res… |
CVE-2025-11221 | High | 8.8 | 2025-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFl… |
CVE-2025-11182 | Medium | 6.5 | 2025-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allo… |
CVE-2025-11020 | High | 8.8 | 2025-10-02 | An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with… |
CVE-2025-58769 | Low | 3.3 | 2025-10-01 | auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with th… |
CVE-2025-11233 | | 2025-10-01 | Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard l… | |
CVE-2025-8559 | Medium | 6.5 | 2025-09-30 | The All in One Music Player plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.1 via the 'theme' parameter. This ma… |
CVE-2025-61586 | Medium | 5.3 | 2025-09-30 | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing at… |
CVE-2025-43813 | High | 8.2 | 2025-09-29 | Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and… |
CVE-2025-11139 | Medium | 6.3 | 2025-09-29 | A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioU… |
CVE-2025-11079 | Medium | 5.3 | 2025-09-27 | A security flaw has been discovered in Campcodes Farm Management System 1.0. Affected by this issue is some unknown functionality. The manipulation results in… |
CVE-2025-11034 | Medium | 4.3 | 2025-09-26 | A vulnerability was found in Dibo Data Decision Making System up to 2.7.0. The affected element is the function downloadImpTemplet of the file /common/dep/comm… |
CVE-2025-11031 | Medium | 5.3 | 2025-09-26 | A flaw has been found in DataTables up to 1.10.13. The affected element is an unknown function of the file /examples/resources/examples.php. This manipulation… |
CVE-2025-11018 | Medium | 5.3 | 2025-09-26 | A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/index.do/../../genera… |
CVE-2025-11016 | Medium | 4.3 | 2025-09-26 | A security vulnerability has been detected in kalcaddle kodbox up to 1.61.09. The affected element is the function fileOut of the file app/controller/explorer/… |
CVE-2025-59002 | High | 7.7 | 2025-09-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.Th… |
CVE-2025-10307 | Medium | 6.5 | 2025-09-26 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the… |
CVE-2025-10951 | High | 7.3 | 2025-09-25 | A vulnerability was identified in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this vulnerability is the function log_handler o… |
CVE-2025-10449 | High | 8.6 | 2025-09-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saysis Computer Systems Trade Ltd. Co. Saysis Web Portal allows… |
CVE-2025-59343 | | 2025-09-24 | tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination d… | |
CVE-2025-56816 | High | 8.8 | 2025-09-24 | Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to t… |
CVE-2025-56815 | High | 7.1 | 2025-09-24 | Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the… |
CVE-2025-59825 | | 2025-09-23 | astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside o… | |
CVE-2025-9963 | | 2025-09-23 | A path traversal vulnerability in Novakon P series allows to expose the root file system "/" and modify all files with root permissions. This way the system ca… | |
CVE-2025-57682 | Medium | 6.5 | 2025-09-22 | Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket through its CloudF… |
CVE-2025-10777 | Medium | 6.3 | 2025-09-22 | A flaw has been found in JSC R7 R7-Office Document Server up to 20250820. Impacted is an unknown function of the file /downloadas/. Executing manipulation of t… |
CVE-2025-10766 | Medium | 4.3 | 2025-09-21 | A weakness has been identified in SeriaWei ZKEACMS up to 4.3. This issue affects the function Download of the file EventViewerController.cs. Executing manipula… |
CVE-2025-9079 | High | 8.0 | 2025-09-19 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configur… |
CVE-2025-57644 | Critical | 9.1 | 2025-09-19 | Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbit… |
CVE-2025-56869 | Medium | 5.3 | 2025-09-19 | Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.sa… |
CVE-2025-10709 | Medium | 5.3 | 2025-09-19 | A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /hi… |
CVE-2025-10708 | Medium | 5.3 | 2025-09-19 | A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2025-10468 | High | 7.5 | 2025-09-19 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Beyaz Computer CityPlus allows Path Traversal. This issue affe… |
CVE-2025-59352 | Critical | 9.8 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests… |
CVE-2025-59414 | Low | 3.1 | 2025-09-17 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload rev… |
CVE-2025-59304 | Critical | 9.8 | 2025-09-17 | A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote Code Execution via a crafted HTTP requ… |
CVE-2025-35430 | Medium | 5.0 | 2025-09-17 | CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker coul… |
CVE-2025-9215 | Medium | 6.5 | 2025-09-17 | The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to Path Traversal… |
CVE-2025-10050 | Medium | 6.6 | 2025-09-17 | The Developer Loggers for Simple History plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.5 via the enabled_l… |
CVE-2025-34185 | High | 7.5 | 2025-09-16 | Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a pre-authentication file disclosure vulnerability via the 'db_log' POST parameter. Remote attackers can… |
CVE-2025-59336 | | 2025-09-16 | Luanox is a module host for Lua packages. Prior to 0.1.1, a file traversal vulnerability can cause potential denial of service by overwriting Phoenix runtime f… | |
CVE-2025-43314 | Medium | 5.5 | 2025-09-15 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, m… |
CVE-2025-43190 | Medium | 5.5 | 2025-09-15 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7… |
CVE-2025-59056 | High | 7.5 | 2025-09-15 | FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface… |
CVE-2025-10472 | Medium | 5.3 | 2025-09-15 | A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function download_video/stream_video of the file app/con… |
CVE-2025-49089 | Medium | 6.3 | 2025-09-15 | wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd. |
CVE-2025-10176 | High | 7.2 | 2025-09-12 | The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the prepare… |
CVE-2025-10273 | Low | 3.5 | 2025-09-12 | A vulnerability was identified in erjinzhi 10OA 1.0. Affected by this vulnerability is an unknown functionality of the file /view/file.aspx. Such manipulation… |
CVE-2025-58321 | Critical | 10.0 | 2025-09-11 | Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability. |
CVE-2025-58320 | High | 7.3 | 2025-09-11 | Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability. |
CVE-2025-9918 | | 2025-09-11 | A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server (versions 6.3.54.0, 6.3.53.2, and all prior versions) allows an… | |
CVE-2025-9693 | High | 8.0 | 2025-09-11 | The User Meta – User Profile Builder and User management plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path val… |
CVE-2025-10245 | Medium | 4.3 | 2025-09-11 | A security flaw has been discovered in Display Painéis TGA up to 7.1.41. Affected by this issue is some unknown functionality of the file /gallery/rename of th… |
CVE-2025-10236 | Medium | 4.3 | 2025-09-11 | A vulnerability has been found in binary-husky gpt_academic up to 3.91. Impacted is the function merge_tex_files_ of the file crazy_functions/latex_fns/latex_t… |
CVE-2025-10233 | Medium | 6.3 | 2025-09-10 | A security vulnerability has been detected in kalcaddle kodbox 1.61. This affects the function fileGet/fileSave of the file app/controller/explorer/editor.clas… |
CVE-2025-10232 | Medium | 5.4 | 2025-09-10 | A weakness has been identified in 299ko up to 2.0.0. Affected by this issue is the function getSentDir/delete of the file plugin/filemanager/controllers/FileMa… |
CVE-2025-59049 | High | 7.5 | 2025-09-10 | Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented… |
CVE-2025-29592 | Medium | 5.6 | 2025-09-10 | oasys v1.1 is vulnerable to Directory Traversal in ProcedureController. |
CVE-2025-41714 | High | 8.8 | 2025-09-10 | The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the se… |
CVE-2025-34176 | Medium | 4.3 | 2025-09-09 | In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This… |
CVE-2025-23343 | High | 7.6 | 2025-09-09 | The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to write files to restricted components. A successful exploit of this vulnerability ma… |
CVE-2025-47415 | | 2025-09-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CRESTRON TOUCHSCREENS x70 allows Relative Path Traversal.This i… | |
CVE-2025-34173 | Medium | 4.3 | 2025-09-09 | In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/string… |
CVE-2025-54261 | Critical | 10.0 | 2025-09-09 | ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vuln… |
CVE-2025-58755 | High | 8.8 | 2025-09-09 | MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. The extractall function `zip_file.extractall(output_dir)` is used directly to pro… |
CVE-2025-58751 | Medium | 5.3 | 2025-09-08 | Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public direc… |
CVE-2025-5993 | | 2025-09-08 | ITCube CRM in versions from 2023.2 through 2025.2 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit vulnerable parameter file… | |
CVE-2025-58438 | | 2025-09-06 | internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerabilit… | |
CVE-2025-9566 | High | 8.1 | 2025-09-05 | There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap… |
CVE-2025-48395 | Medium | 4.7 | 2025-09-05 | An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI… |
CVE-2025-48550 | Medium | 5.5 | 2025-09-04 | In testGrantSlicePermission of SliceManagerTest.java, there is a possible permanent denial of service due to a path traversal error. This could lead to local d… |
CVE-2025-41035 | Medium | 6.5 | 2025-09-04 | A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass th… |
CVE-2025-58355 | High | 7.7 | 2025-09-04 | Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled… |
CVE-2025-7039 | Low | 3.7 | 2025-09-03 | A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perfo… |
CVE-2025-7975 | High | 7.8 | 2025-09-02 | Anritsu ShockLine CHX File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2025-58162 | Medium | 6.5 | 2025-09-02 | MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary… |
CVE-2025-58161 | Medium | 4.3 | 2025-09-02 | MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, wh… |
CVE-2025-9801 | Medium | 5.4 | 2025-09-01 | A security vulnerability has been detected in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. This affects an unknown part. The manipulation of… |
CVE-2025-58158 | High | 8.8 | 2025-08-29 | Harness Open Source is an end-to-end developer platform with Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries… |
CVE-2025-52861 | | 2025-08-29 | A path traversal vulnerability has been reported to affect VioStor. If a remote attacker gains an administrator account, they can then exploit the vulnerabilit… | |
CVE-2025-33038 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33037 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33036 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33033 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-33032 | Medium | 4.9 | 2025-08-29 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they ca… |
CVE-2025-30271 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exp… |
CVE-2025-30270 | Medium | 6.5 | 2025-08-29 | A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exp… |
CVE-2025-9650 | Medium | 5.4 | 2025-08-29 | A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This affects the function removeFileByPath of the file src/m… |
CVE-2025-9217 | Medium | 6.5 | 2025-08-29 | The Slider Revolution plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.7.36 via the 'used_svg' and 'used_images' pa… |
CVE-2024-13986 | High | 8.8 | 2025-08-28 | Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config S… |
CVE-2025-54029 | High | 7.7 | 2025-08-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in extendons WooCommerce csv import export extendons-eo-wooimport-… |
CVE-2025-53588 | High | 7.7 | 2025-08-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator u… |
CVE-2025-58072 | High | 7.5 | 2025-08-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier… |
CVE-2025-54819 | Medium | 6.5 | 2025-08-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier… |
CVE-2025-9345 | Medium | 4.9 | 2025-08-28 | The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.8 via the… |
CVE-2024-13984 | | 2025-08-27 | QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability in the rptsvr component that allows unauthent… | |
CVE-2024-13982 | | 2025-08-27 | SPON IP Network Broadcast System, a digital audio transmission platform developed by SPON Communications, contains an arbitrary file read vulnerability in the… |