CWE-22 · Path Traversal (page 26)
Page 26 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6853 | Medium | 6.3 | 2025-06-29 | A vulnerability classified as critical has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This affects the function upload_temp_docs of the file… |
CVE-2025-6755 | High | 8.8 | 2025-06-28 | The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxDeleteTheme() fu… |
CVE-2025-6379 | High | 8.8 | 2025-06-28 | The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_live_fn() fu… |
CVE-2025-6776 | High | 7.3 | 2025-06-27 | A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/pl… |
CVE-2025-6774 | Medium | 6.3 | 2025-06-27 | A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been rated as critical. Affected by this issue is the function AddTemp of the file api/temp… |
CVE-2025-6773 | Medium | 5.3 | 2025-06-27 | A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir o… |
CVE-2025-6772 | High | 7.3 | 2025-06-27 | A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serv… |
CVE-2025-53298 | Medium | 4.9 | 2025-06-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gioni Plugin Inspector plugin-inspector allows Path Traversal.T… |
CVE-2025-49448 | High | 8.6 | 2025-06-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Food Menu allows Path Traversal. This issue aff… |
CVE-2025-24765 | High | 7.7 | 2025-06-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RobMarsh Image Shadow image-shadow allows Path Traversal.This i… |
CVE-2025-6731 | Medium | 6.3 | 2025-06-26 | A vulnerability was found in yzcheng90 X-SpringBoot up to 5.0 and classified as critical. Affected by this issue is the function uploadApk of the file /sys/oss… |
CVE-2025-50350 | Medium | 5.4 | 2025-06-26 | PHPGurukul Pre-School Enrollment System Project v1.0 is vulnerable to Directory Traversal in manage-classes.php. |
CVE-2025-34048 | | 2025-06-26 | A path traversal vulnerability exists in the web management interface of D-Link DSL-2730U, DSL-2750U, and DSL-2750E ADSL routers with firmware versions IN_1.02… | |
CVE-2025-34047 | | 2025-06-26 | A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the unde… | |
CVE-2025-34045 | High | 7.5 | 2025-06-26 | A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co… |
CVE-2025-3722 | Medium | 4.4 | 2025-06-26 | A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post… |
CVE-2025-6445 | High | 8.1 | 2025-06-25 | ServiceStack FindType Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2025-52569 | | 2025-06-25 | GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided value… | |
CVE-2025-49153 | | 2025-06-25 | The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code. | |
CVE-2025-50178 | | 2025-06-25 | GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 0.4.3 lack input validation for user provided values in certain functio… | |
CVE-2025-52574 | High | 7.5 | 2025-06-24 | SysmonElixir is a system monitor HTTP service in Elixir. Prior to version 1.0.1, the /read endpoint reads any file from the server's /etc/passwd by default. In… |
CVE-2025-34040 | | 2025-06-24 | An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are imprope… | |
CVE-2025-34031 | High | 7.5 | 2025-06-24 | A path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php. The script directly passes user… |
CVE-2025-52562 | Critical | 10.0 | 2025-06-23 | Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the Loca… |
CVE-2025-23092 | High | 7.2 | 2025-06-23 | Mitel OpenScape Accounting Management through V5 R1.1.0 could allow an authenticated attacker with administrative privileges to conduct a path traversal attack… |
CVE-2025-48026 | High | 7.5 | 2025-06-23 | A vulnerability in the WebApl component of Mitel OpenScape Xpressions through V7R1 FR5 HF43 P913 could allow an unauthenticated attacker to conduct a path trav… |
CVE-2025-50349 | High | 7.5 | 2025-06-23 | PHPGurukul Pre-School Enrollment System Project V1.0 is vulnerable to Directory Traversal in update-teacher-pic.php. |
CVE-2025-50348 | High | 7.5 | 2025-06-23 | PHPGurukul Pre-School Enrollment System Project V1.0 is vulnerable to Directory Traversal in update-class-pic.php. |
CVE-2025-6453 | Medium | 6.3 | 2025-06-22 | A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/action/template/ForumMa… |
CVE-2025-6218 | High | 7.8 | 2025-06-21 | RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected install… |
CVE-2025-34023 | | 2025-06-20 | A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user… | |
CVE-2025-34022 | | 2025-06-20 | A path traversal vulnerability exists in multiple models of Selea Targa IP OCR-ANPR cameras, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 T… | |
CVE-2025-45890 | Critical | 9.8 | 2025-06-20 | Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter |
CVE-2025-6283 | Low | 3.5 | 2025-06-19 | A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/a… |
CVE-2025-6282 | Medium | 5.5 | 2025-06-19 | A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the funct… |
CVE-2025-6281 | Medium | 5.5 | 2025-06-19 | A vulnerability has been found in OpenBMB XAgent up to 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-6280 | Medium | 5.5 | 2025-06-19 | A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function download_attachment of the f… |
CVE-2025-6278 | Medium | 5.5 | 2025-06-19 | A vulnerability classified as critical was found in Upsonic up to 0.55.6. This vulnerability affects the function os.path.join of the file markdown/server.py… |
CVE-2025-4661 | Low | 2.3 | 2025-06-19 | A path transversal vulnerability in Brocade Fabric OS 9.1.0 through 9.2.2 could allow a local admin user to gain access to files outside the intended directo… |
CVE-2025-5981 | Medium | 6.5 | 2025-06-18 | Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container ima… |
CVE-2025-50202 | High | 7.5 | 2025-06-18 | Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, ngi… |
CVE-2025-49879 | High | 8.6 | 2025-06-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in themezaa Litho litho allows Path Traversal.This issue affects L… |
CVE-2025-49415 | High | 8.6 | 2025-06-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Path Traversal.This is… |
CVE-2025-34508 | Medium | 6.3 | 2025-06-17 | A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker… |
CVE-2025-6020 | High | 7.8 | 2025-06-17 | A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their p… |
CVE-2025-6167 | Medium | 5.5 | 2025-06-17 | A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/… |
CVE-2025-6166 | Low | 3.5 | 2025-06-17 | A vulnerability was found in frdel Agent-Zero up to 0.8.4. It has been rated as problematic. This issue affects the function image_get of the file /python/api/… |
CVE-2025-6152 | Medium | 6.3 | 2025-06-17 | A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3. This affects the function handleFileUpload of the file api/src/modul… |
CVE-2025-32799 | Critical | 9.8 | 2025-06-16 | Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal (Tar… |
CVE-2025-3594 | Critical | 9.8 | 2025-06-16 | Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through u… |
CVE-2025-4748 | | 2025-06-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, Fil… | |
CVE-2025-6109 | Medium | 4.3 | 2025-06-16 | A vulnerability was found in javahongxi whatsmars 2021.4.0. It has been rated as problematic. Affected by this issue is the function initialize of the file /wh… |
CVE-2025-6108 | Medium | 6.3 | 2025-06-16 | A vulnerability was found in hansonwang99 Spring-Boot-In-Action up to 807fd37643aa774b94fd004cc3adbd29ca17e9aa. It has been declared as critical. Affected by t… |
CVE-2025-5964 | Medium | 6.5 | 2025-06-15 | A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server. |
CVE-2025-6070 | Medium | 6.5 | 2025-06-14 | The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the output() function. This… |
CVE-2025-6065 | Critical | 9.1 | 2025-06-14 | The Image Resizer On The Fly plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' task in all… |
CVE-2025-4187 | Medium | 5.9 | 2025-06-14 | The UserPro - Community and User Profile WordPress Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.1.1… |
CVE-2025-28384 | Critical | 9.1 | 2025-06-13 | An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. |
CVE-2025-28382 | High | 7.5 | 2025-06-13 | An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. |
CVE-2025-46096 | Medium | 6.1 | 2025-06-13 | Directory Traversal vulnerability in solon v.3.1.2 allows a remote attacker to conduct XSS attacks via the solon-faas-luffy component |
CVE-2025-46783 | Critical | 9.8 | 2025-06-13 | Path traversal vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If this vulnerability is exploited, arbitrary code may be ex… |
CVE-2024-38824 | Critical | 9.6 | 2025-06-13 | Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory. |
CVE-2025-22241 | Medium | 5.6 | 2025-06-13 | File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory… |
CVE-2025-22240 | Medium | 6.3 | 2025-06-13 | Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from th… |
CVE-2025-22238 | Medium | 4.2 | 2025-06-13 | Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to… |
CVE-2025-4613 | High | 8.8 | 2025-06-12 | Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking… |
CVE-2025-40592 | Medium | 6.1 | 2025-06-12 | A vulnerability has been identified in Mendix Studio Pro 10 (All versions < V10.23.0), Mendix Studio Pro 10.12 (All versions < V10.12.17), Mendix Studio Pro 10… |
CVE-2025-47176 | High | 7.8 | 2025-06-10 | '.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally. |
CVE-2024-57189 | Medium | 5.4 | 2025-06-10 | In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL… |
CVE-2024-57186 | Medium | 5.4 | 2025-06-10 | In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler. |
CVE-2025-37100 | High | 7.7 | 2025-06-10 | A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploit… |
CVE-2025-5741 | Medium | 4.9 | 2025-06-10 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file reads from the char… |
CVE-2025-5740 | High | 7.2 | 2025-06-10 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file writes when an auth… |
CVE-2025-42977 | High | 7.6 | 2025-06-10 | SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user… |
CVE-2025-49138 | Medium | 6.5 | 2025-06-09 | HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, an authenticated Local File Inclusion (LFI) vulnerabil… |
CVE-2025-48267 | High | 8.6 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP… |
CVE-2025-48130 | High | 7.5 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.Thi… |
CVE-2025-48124 | High | 7.5 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce an… |
CVE-2025-47511 | Medium | 6.8 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversa… |
CVE-2025-39473 | High | 8.1 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebGeniusLab Seofy Core seofy-core allows PHP Local File Inclus… |
CVE-2025-31635 | High | 7.5 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup CLEVER lbg-audio11-html5-shoutcast_history allows… |
CVE-2025-31050 | High | 7.5 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in appthaplugins Apptha Slider Gallery apptha-slider-gallery allow… |
CVE-2025-5880 | Medium | 4.3 | 2025-06-09 | A vulnerability has been found in Whistle 2.9.98 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/sessions/get-temp-… |
CVE-2025-3485 | High | 8.8 | 2025-06-06 | Allegra extractFileFromZip Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2025-33035 | Medium | 6.5 | 2025-06-06 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability… |
CVE-2025-5714 | Medium | 4.3 | 2025-06-06 | A vulnerability was found in SoluçõesCoop iSoluçõesWEB up to 20250516. It has been classified as problematic. This affects an unknown part of the file /sys/up… |
CVE-2025-3055 | High | 8.1 | 2025-06-05 | The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_avatar_ajax() fun… |
CVE-2025-20277 | Low | 3.4 | 2025-06-04 | A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary code on an affecte… |
CVE-2025-20259 | Medium | 5.3 | 2025-06-04 | Multiple vulnerabilities in the update process of Cisco ThousandEyes Endpoint Agent for Windows could allow an authenticated, local attacker to delete arbitrar… |
CVE-2025-5545 | Medium | 4.3 | 2025-06-04 | A vulnerability classified as problematic has been found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. This affects the function imag… |
CVE-2025-5544 | Medium | 4.3 | 2025-06-03 | A vulnerability was found in aaluoxiang oa_system up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. It has been rated as problematic. Affected by this issue is t… |
CVE-2025-5509 | Medium | 6.3 | 2025-06-03 | A vulnerability classified as critical has been found in quequnlong shiyi-blog up to 1.2.1. This affects an unknown part of the file /api/file/upload. The mani… |
CVE-2025-4517 | Critical | 9.4 | 2025-06-03 | Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the… |
CVE-2025-4330 | High | 7.5 | 2025-06-03 | Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. … |
CVE-2025-4138 | High | 7.5 | 2025-06-03 | Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. … |
CVE-2024-12718 | Medium | 5.3 | 2025-06-03 | Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction direc… |
CVE-2025-31359 | High | 8.8 | 2025-06-03 | A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability… |
CVE-2025-41428 | Medium | 5.3 | 2025-06-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in TimeWorks 10.0 to 10.3. If exploited, arbitrary JSON files on th… |
CVE-2025-48387 | | 2025-06-02 | tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified d… | |
CVE-2025-27956 | High | 7.5 | 2025-06-02 | Directory Traversal vulnerability in WebLaudos 24.2 (04) allows a remote attacker to obtain sensitive information via the id parameter. |