CWE-22 · Path Traversal (page 24)
Page 24 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13981 | | 2025-08-27 | LiveBOS, an object-oriented business architecture middleware suite developed by Apex Software Co., Ltd., contains an arbitrary file upload vulnerability in its… | |
CVE-2023-7309 | | 2025-08-27 | A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management… | |
CVE-2025-20344 | Medium | 6.5 | 2025-08-27 | A vulnerability in the backup restore functionality of Cisco Nexus Dashboard could allow an authenticated, remote attacker to conduct a path traversal attack o… |
CVE-2025-50971 | High | 7.5 | 2025-08-26 | Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to gain access to sensitive system files via the template parame… |
CVE-2025-55526 | Critical | 9.1 | 2025-08-26 | n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py |
CVE-2025-53120 | Critical | 9.4 | 2025-08-25 | A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server’s configuration an… |
CVE-2025-29420 | High | 7.5 | 2025-08-25 | PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function. |
CVE-2025-9409 | Medium | 4.3 | 2025-08-25 | A security flaw has been discovered in lostvip-com ruoyi-go up to 2.1. Impacted is the function DownloadTmp/DownloadUpload of the file modules/system/controlle… |
CVE-2025-8562 | Medium | 6.5 | 2025-08-25 | The Custom Query Shortcode plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.4.0 via the 'lens' parameter. This make… |
CVE-2025-9118 | | 2025-08-25 | A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other custo… | |
CVE-2025-52450 | Medium | 6.5 | 2025-08-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (abdoc api - create… |
CVE-2025-53363 | | 2025-08-22 | dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from… | |
CVE-2024-56179 | High | 7.8 | 2025-08-22 | In MindManager Windows versions prior to 24.1.150, attackers could potentially write to unexpected directories in victims' machines via directory traversal if… |
CVE-2010-20109 | | 2025-08-21 | Barracuda products, confirmed in Spam & Virus Firewall, SSL VPN, and Web Application Firewall versions prior to October 2010, contain a path traversal vulnerab… | |
CVE-2025-55523 | Low | 3.5 | 2025-08-21 | An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory traversal. |
CVE-2025-6465 | Medium | 4.3 | 2025-08-21 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload pe… |
CVE-2025-57753 | | 2025-08-21 | vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerabil… | |
CVE-2025-8895 | Critical | 9.8 | 2025-08-21 | The WP Webhooks plugin for WordPress is vulnerable to arbitrary file copy due to missing validation of user-supplied input in all versions up to, and including… |
CVE-2025-8023 | Medium | 6.8 | 2025-08-21 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fails to sanitize path traversal sequences in template file destina… |
CVE-2025-36530 | Medium | 6.8 | 2025-08-21 | Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operation… |
CVE-2025-53505 | Medium | 5.3 | 2025-08-21 | Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability. If this vulnerability is exploited… |
CVE-2012-10061 | | 2025-08-20 | Sockso Music Host Server versions <= 1.5 are vulnerable to a path traversal flaw that allows unauthenticated remote attackers to read arbitrary files from the… | |
CVE-2025-36114 | Medium | 6.5 | 2025-08-20 | IBM QRadar SOAR Plugin App 1.0.0 through 5.6.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted… |
CVE-2025-54927 | Medium | 4.9 | 2025-08-20 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive f… |
CVE-2025-54926 | High | 7.2 | 2025-08-20 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an auth… |
CVE-2025-54021 | High | 7.5 | 2025-08-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path T… |
CVE-2025-48158 | High | 8.6 | 2025-08-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Alex Githatu BuddyPress XProfile Custom Image Field buddypress-… |
CVE-2025-47650 | Medium | 6.5 | 2025-08-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Infility Infility Global infility-global allows Path Traversal… |
CVE-2025-8141 | High | 8.8 | 2025-08-20 | The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associa… |
CVE-2024-44373 | Critical | 9.8 | 2025-08-19 | A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.06_06 allows an unauthenticated attacker to create a webshell and remote code execution v… |
CVE-2025-55295 | Medium | 6.5 | 2025-08-19 | qBit Manage is a tool that helps manage tedious tasks in qBittorrent and automate them. A path traversal vulnerability exists in qbit_manage's web API that all… |
CVE-2025-55282 | Critical | 9.1 | 2025-08-18 | aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows a user to elevate to superuser… |
CVE-2025-55214 | | 2025-08-18 | Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe templa… | |
CVE-2025-55201 | | 2025-08-18 | Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes… | |
CVE-2025-41242 | Medium | 5.9 | 2025-08-18 | Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can… |
CVE-2025-3671 | High | 8.8 | 2025-08-16 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the 'pa… |
CVE-2025-7641 | High | 7.5 | 2025-08-15 | The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/n… |
CVE-2025-54715 | Medium | 4.9 | 2025-08-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventor… |
CVE-2025-34154 | | 2025-08-13 | UnForm Server Manager versions prior to 10.1.12 expose an unauthenticated file read vulnerability via its log file analysis interface. The flaw resides in the… | |
CVE-2012-10054 | Critical | 9.8 | 2025-08-13 | Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRS… |
CVE-2011-10010 | | 2025-08-13 | QuickShare File Server 1.2.1 contains a path traversal vulnerability in its FTP service due to improper sanitation of user-supplied file paths. Authenticated u… | |
CVE-2011-10009 | | 2025-08-13 | S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse… | |
CVE-2025-23304 | High | 7.8 | 2025-08-13 | NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection by loading .nemo fi… |
CVE-2025-8941 | High | 7.8 | 2025-08-13 | A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race c… |
CVE-2025-8912 | High | 7.5 | 2025-08-13 | Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Absolute P… |
CVE-2025-8909 | Medium | 6.5 | 2025-08-13 | Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Ab… |
CVE-2025-0818 | Medium | 6.5 | 2025-08-13 | Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauth… |
CVE-2025-55169 | Medium | 6.5 | 2025-08-12 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability… |
CVE-2024-52964 | Medium | 5.5 | 2025-08-12 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1… |
CVE-2025-53793 | High | 7.5 | 2025-08-12 | Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network. |
CVE-2025-49559 | Medium | 5.3 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Limitation of a Pathname to a… |
CVE-2025-55011 | Medium | 6.4 | 2025-08-12 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the API does not validate… |
CVE-2025-8081 | Medium | 4.9 | 2025-08-12 | The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function d… |
CVE-2025-5391 | High | 8.1 | 2025-08-12 | The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() fun… |
CVE-2025-42946 | Medium | 6.9 | 2025-08-12 | Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction… |
CVE-2025-25231 | High | 7.5 | 2025-08-11 | Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by s… |
CVE-2025-8815 | High | 7.3 | 2025-08-10 | A vulnerability was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. It has been classified as critical. Affected is an unknown function of… |
CVE-2025-8753 | Medium | 5.4 | 2025-08-09 | A vulnerability, which was classified as critical, has been found in linlinjava litemall up to 1.8.0. Affected by this issue is the function delete of the file… |
CVE-2025-55149 | | 2025-08-09 | Tiny-Scientist is a lightweight framework for automating the entire lifecycle of scientific research—from ideation to implementation, writing, and review. In v… | |
CVE-2012-10048 | | 2025-08-08 | Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen() call in Ze… | |
CVE-2025-52913 | Critical | 9.8 | 2025-08-08 | A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduc… |
CVE-2025-8356 | Critical | 9.8 | 2025-08-08 | In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remot… |
CVE-2025-8729 | Medium | 6.3 | 2025-08-08 | A vulnerability has been found in MigoXLab LMeterX 1.2.0 and classified as critical. Affected by this vulnerability is the function process_cert_files of the f… |
CVE-2025-8749 | Medium | 6.5 | 2025-08-08 | Path Traversal vulnerability in API Endpoint in Mobile Industrial Robots (MiR) Software Versions prior to 3.0.0 on MiR Robots allows authenticated users to ext… |
CVE-2025-54959 | Medium | 4.3 | 2025-08-08 | Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this vulnerability is exploited, an arbitrary file in the affected… |
CVE-2024-55401 | Medium | 6.5 | 2025-08-07 | An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal. |
CVE-2025-29865 | | 2025-08-07 | : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TAGFREE X-Free Uploader XFU allows Path Traversal.This issue… | |
CVE-2025-48394 | Medium | 4.7 | 2025-08-06 | An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI… |
CVE-2024-52885 | Medium | 5.0 | 2025-08-06 | The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to a… |
CVE-2025-21015 | Medium | 4.0 | 2025-08-06 | Path Traversal in Document scanner prior to SMR Aug-2025 Release 1 allows local attackers to delete file with Document scanner's privilege. |
CVE-2025-54653 | High | 8.4 | 2025-08-06 | Path traversal vulnerability in the virtualization file module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualizat… |
CVE-2025-54652 | High | 8.4 | 2025-08-06 | Path traversal vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualizat… |
CVE-2012-10034 | High | 7.5 | 2025-08-05 | ClanSphere 2011.3 is vulnerable to a local file inclusion (LFI) flaw due to improper handling of the cs_lang cookie parameter. The application fails to sanitiz… |
CVE-2012-10024 | | 2025-08-05 | XBMC version 11.0 contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Authentication, the server fails to properl… | |
CVE-2025-54802 | Critical | 9.8 | 2025-08-05 | pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in… |
CVE-2025-54794 | Critical | 9.1 | 2025-08-05 | Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it p… |
CVE-2025-54387 | Critical | 9.8 | 2025-08-05 | IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check wh… |
CVE-2025-8522 | Medium | 5.0 | 2025-08-04 | A vulnerability, which was classified as critical, was found in givanz Vvvebjs up to 2.0.4. Affected is an unknown function of the file /save.php of the compon… |
CVE-2025-8516 | Medium | 5.3 | 2025-08-04 | A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFile… |
CVE-2025-7694 | Medium | 6.8 | 2025-08-02 | The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() fu… |
CVE-2025-54386 | Critical | 9.8 | 2025-08-02 | Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discov… |
CVE-2013-10063 | | 2025-08-01 | A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can… | |
CVE-2013-10062 | | 2025-08-01 | A directory traversal vulnerability exists in Linksys router's web interface (tested on the E1500 model firmware versions 1.0.00, 1.0.04, and 1.0.05), specific… | |
CVE-2013-10046 | | 2025-08-01 | A local privilege escalation vulnerability exists in Agnitum Outpost Internet Security 8.1 that allows an unprivileged user to execute arbitrary code with SYST… | |
CVE-2025-8480 | High | 8.0 | 2025-08-01 | Alpine iLX-507 Command Injection Remote Code Execution. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installation… |
CVE-2025-8433 | Medium | 5.4 | 2025-08-01 | A vulnerability was found in code-projects Document Management System 1.0 and classified as critical. This issue affects the function unlink of the file /dell… |
CVE-2025-8426 | Critical | 9.4 | 2025-07-31 | Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability. This vulnerability allows remote a… |
CVE-2014-125125 | | 2025-07-31 | A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of t… | |
CVE-2025-8151 | Medium | 4.3 | 2025-07-31 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'save_bloc… |
CVE-2025-46359 | High | 7.2 | 2025-07-31 | A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a… |
CVE-2025-41396 | Medium | 5.4 | 2025-07-31 | A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user. |
CVE-2025-8343 | Medium | 4.3 | 2025-07-31 | A vulnerability was found in openviglet shio up to 0.3.8. It has been rated as critical. This issue affects the function shStaticFilePreUpload of the file shio… |
CVE-2025-54433 | | 2025-07-30 | Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3, ingestion pat… | |
CVE-2025-43250 | Medium | 4.0 | 2025-07-30 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may… |
CVE-2025-43206 | Medium | 4.0 | 2025-07-30 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7… |
CVE-2025-43196 | High | 7.8 | 2025-07-30 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may… |
CVE-2025-43191 | Medium | 6.2 | 2025-07-30 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may… |
CVE-2025-44137 | High | 8.2 | 2025-07-29 | MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are s… |
CVE-2025-53081 | Medium | 6.4 | 2025-07-29 | An 'Arbitrary File Creation' in Samsung DMS(Data Management Server) allows attackers to create arbitrary files in unintended locations on the filesystem. Explo… |
CVE-2025-53080 | High | 7.1 | 2025-07-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Samsung DMS(Data Management Server) allows authenticated attackers to create… |