CWE-22 · Path Traversal (page 29)
Page 29 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8581 | Critical | 9.1 | 2025-03-20 | A vulnerability in the `upload_app` function of parisneo/lollms-webui V12 (Strawberry) allows an attacker to delete any file or directory on the system. The fu… |
CVE-2024-8524 | High | 7.5 | 2025-03-20 | A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by se… |
CVE-2024-8438 | High | 7.5 | 2025-03-20 | A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter, a… |
CVE-2024-7776 | Critical | 9.1 | 2025-03-20 | A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to in… |
CVE-2024-6851 | High | 7.5 | 2025-03-20 | In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files… |
CVE-2024-5752 | Critical | 9.1 | 2025-03-20 | A path traversal vulnerability exists in stitionai/devika, specifically in the project creation functionality. In the affected version beacf6edaa205a5a53705254… |
CVE-2024-12866 | High | 7.5 | 2025-03-20 | A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the fi… |
CVE-2024-12217 | Medium | 5.3 | 2025-03-20 | A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path funct… |
CVE-2024-12065 | High | 7.5 | 2025-03-20 | A local file inclusion vulnerability exists in haotian-liu/llava at commit c121f04. This vulnerability allows an attacker to access any file on the system by s… |
CVE-2024-11037 | Medium | 6.5 | 2025-03-20 | A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read… |
CVE-2024-10948 | Medium | 6.5 | 2025-03-20 | A vulnerability in the upload function of binary-husky/gpt_academic allows any user to read arbitrary files on the system, including sensitive files such as `c… |
CVE-2024-10902 | Critical | 9.8 | 2025-03-20 | In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerabil… |
CVE-2024-10830 | High | 8.2 | 2025-03-20 | A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an att… |
CVE-2024-10707 | Medium | 6.5 | 2025-03-20 | gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a… |
CVE-2024-10513 | High | 7.2 | 2025-03-20 | A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. Thi… |
CVE-2024-10361 | Critical | 9.1 | 2025-03-20 | An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability ar… |
CVE-2025-2505 | Critical | 9.8 | 2025-03-20 | The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it… |
CVE-2025-1770 | High | 8.8 | 2025-03-20 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl… |
CVE-2025-27787 | High | 7.5 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to denial of service (DoS) in restart.py. `model_name` in train.py takes user… |
CVE-2025-27786 | Critical | 9.1 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file removal in core.py. `output_tts_path` in tts.py takes arbit… |
CVE-2025-27785 | High | 7.5 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_index` function. This issue may… |
CVE-2025-27783 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary… |
CVE-2025-27782 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbit… |
CVE-2024-7631 | Medium | 4.3 | 2025-03-19 | A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and n… |
CVE-2024-57170 | Medium | 6.5 | 2025-03-18 | SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" parameter allows authenticated attackers to spe… |
CVE-2025-2449 | High | 8.8 | 2025-03-18 | NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary f… |
CVE-2025-2493 | High | 7.5 | 2025-03-18 | Path Traversal vulnerability in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to manipulate the ‘id’ parameter of the ‘/softdial/… |
CVE-2025-0694 | Medium | 6.6 | 2025-03-18 | Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access. |
CVE-2024-8510 | Medium | 5.3 | 2025-03-17 | N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerab… |
CVE-2025-25685 | High | 7.5 | 2025-03-17 | An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0. Attackers are able to download arbitrary files from the device's file system via adding symbolic… |
CVE-2025-25684 | High | 7.5 | 2025-03-17 | A lack of validation in the path parameter (/download) of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file… |
CVE-2025-29787 | | 2025-03-17 | `zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the `zip` cra… | |
CVE-2025-2363 | Medium | 6.3 | 2025-03-17 | A vulnerability classified as critical has been found in lenve VBlog up to 1.0.0. Affected is the function uploadImg of the file blogserver/src/main/java/org/s… |
CVE-2024-30143 | Medium | 4.3 | 2025-03-13 | HCL AppScan Traffic Recorder fails to adequately neutralize special characters within the filename, potentially allowing it to resolve to a location beyond the… |
CVE-2025-2264 | High | 7.5 | 2025-03-13 | A Path Traversal Information Disclosure vulnerability exists in "Sante PACS Server.exe". An unauthenticated remote attacker can exploit it to download arbitrar… |
CVE-2025-1785 | Medium | 5.4 | 2025-03-13 | The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_newfile' action. This… |
CVE-2025-2215 | Medium | 4.7 | 2025-03-12 | A vulnerability classified as critical was found in Doufox up to 0.2.0. Affected by this vulnerability is an unknown functionality of the file /?s=doudou&c=fil… |
CVE-2025-27101 | | 2025-03-11 | Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the… | |
CVE-2024-55597 | Medium | 5.5 | 2025-03-11 | A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute u… |
CVE-2025-2193 | Medium | 5.4 | 2025-03-11 | A vulnerability has been found in MRCMS 3.1.2 and classified as critical. This vulnerability affects the function delete of the file /admin/file/delete.do of t… |
CVE-2025-27397 | Low | 3.8 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit user controlled path… |
CVE-2025-27395 | High | 7.2 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit the scope of files a… |
CVE-2025-1661 | Critical | 9.8 | 2025-03-11 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6… |
CVE-2025-1322 | Medium | 4.3 | 2025-03-08 | The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.1… |
CVE-2025-27519 | | 2025-03-07 | Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. A path traversal issu… | |
CVE-2024-12035 | High | 8.8 | 2025-03-07 | The CS Framework plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cs_widget_file_delete() function… |
CVE-2024-10804 | High | 7.5 | 2025-03-07 | The Ultimate Video Player WordPress & WooCommerce Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 10.0 v… |
CVE-2025-2032 | Low | 3.5 | 2025-03-06 | A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The… |
CVE-2024-13894 | | 2025-03-06 | Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to path traversal. When an… | |
CVE-2024-13897 | Medium | 6.5 | 2025-03-06 | The Moving Media Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the generate_json_page funct… |
CVE-2025-24494 | High | 7.2 | 2025-03-05 | Path traversal may allow remote code execution using privileged account (requires device admin account, cannot be performed by a regular user). In combinatio… |
CVE-2025-23416 | Medium | 4.9 | 2025-03-05 | Path traversal may lead to arbitrary file deletion. The score without least privilege principle violation is as calculated below. In combination with other i… |
CVE-2025-21095 | Medium | 4.9 | 2025-03-05 | Path traversal may lead to arbitrary file download. The score without least privilege principle violation is as calculated below. In combination with other i… |
CVE-2024-13471 | High | 7.5 | 2025-03-05 | The DesignThemes Core Features plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dt_process_imported_f… |
CVE-2025-1915 | High | 8.1 | 2025-03-05 | Improper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on Windows prior to 134.0.6998.35 allowed an attacker who convinced a… |
CVE-2024-51966 | Medium | 4.9 | 2025-03-03 | There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with… |
CVE-2024-51958 | Medium | 4.9 | 2025-03-03 | There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with… |
CVE-2024-8262 | Critical | 9.8 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Proliz Software OBS allows Path Traversal. This issue affects… |
CVE-2025-27274 | Medium | 4.9 | 2025-03-03 | Path Traversal: '.../...//' vulnerability in axelkeller GPX Viewer gpx-viewer allows Path Traversal.This issue affects GPX Viewer: from n/a through <= 2.2.11. |
CVE-2025-26540 | High | 7.7 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This iss… |
CVE-2025-26534 | High | 8.6 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path Traversal.This iss… |
CVE-2025-25162 | High | 7.5 | 2025-03-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kutu62 Sports Rankings and Lists sports-rankings-lists allows A… |
CVE-2025-27590 | Critical | 9.0 | 2025-03-03 | In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is… |
CVE-2024-13910 | High | 7.2 | 2025-03-01 | The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path… |
CVE-2025-27413 | Medium | 6.5 | 2025-02-28 | PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into th… |
CVE-2025-27410 | Medium | 6.5 | 2025-02-28 | PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's… |
CVE-2025-0823 | Medium | 6.5 | 2025-02-28 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 and 12.0.0 through 12.0.4 could allow a remote attacker to traverse directories on the system. An attacker could… |
CVE-2024-38292 | Critical | 9.8 | 2025-02-27 | In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege escalation. |
CVE-2025-1743 | Medium | 5.3 | 2025-02-27 | A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The… |
CVE-2025-25759 | High | 7.5 | 2025-02-27 | An issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET requ… |
CVE-2024-54169 | Medium | 6.5 | 2025-02-27 | IBM EntireX 11.1 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing… |
CVE-2025-1282 | High | 8.8 | 2025-02-27 | The Car Dealer Automotive WordPress Theme – Responsive theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in… |
CVE-2025-25800 | Medium | 5.3 | 2025-02-26 | SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php. |
CVE-2022-25773 | Medium | 4.3 | 2025-02-26 | This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. * Improper Limitatio… |
CVE-2025-27142 | High | 8.8 | 2025-02-25 | LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network without needing an int… |
CVE-2025-26935 | High | 7.5 | 2025-02-25 | Path Traversal: '.../...//' vulnerability in wpjobportal WP Job Portal wp-job-portal allows PHP Local File Inclusion.This issue affects WP Job Portal: from n/a… |
CVE-2025-26905 | High | 7.5 | 2025-02-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This is… |
CVE-2025-26753 | High | 7.5 | 2025-02-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-i… |
CVE-2025-26752 | High | 8.6 | 2025-02-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-i… |
CVE-2025-25279 | Critical | 9.9 | 2025-02-24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which a… |
CVE-2025-20051 | Critical | 9.9 | 2025-02-24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a boar… |
CVE-2025-1599 | Medium | 5.4 | 2025-02-24 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been rated as problematic. Affected by this issue is some unknown funct… |
CVE-2025-1588 | Medium | 6.5 | 2025-02-23 | A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ad… |
CVE-2025-1543 | Medium | 4.3 | 2025-02-21 | A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown processing of the file /re… |
CVE-2025-27098 | Medium | 5.8 | 2025-02-20 | GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST… |
CVE-2024-55457 | Medium | 6.5 | 2025-02-20 | MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the fi… |
CVE-2024-49780 | Medium | 5.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to traverse directories on the system. An attacker with privileges to perform… |
CVE-2025-27092 | High | 7.5 | 2025-02-19 | GHOSTS is an open source user simulation framework for cyber experimentation, simulation, training, and exercise. A path traversal vulnerability was discovered… |
CVE-2025-24965 | | 2025-02-19 | crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping th… | |
CVE-2025-26616 | High | 7.5 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA appl… |
CVE-2025-26615 | Critical | 10.0 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA appl… |
CVE-2025-22663 | High | 8.6 | 2025-02-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allow… |
CVE-2025-25284 | | 2025-02-18 | The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's WPS (Web Processing Service) implementa… | |
CVE-2025-1035 | Medium | 5.7 | 2025-02-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input t… |
CVE-2024-13725 | Critical | 9.8 | 2025-02-18 | The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter… |
CVE-2024-13538 | Medium | 5.3 | 2025-02-18 | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.0. This… |
CVE-2024-13535 | Medium | 5.3 | 2025-02-18 | The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is due the composer-s… |
CVE-2025-25223 | Medium | 5.3 | 2025-02-18 | The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloader.php. If this vu… |
CVE-2025-26779 | Medium | 4.9 | 2025-02-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Path T… |
CVE-2025-1357 | Medium | 4.3 | 2025-02-16 | A vulnerability classified as problematic has been found in Seventh D-Guard up to 20250206. This affects an unknown part of the component HTTP GET Request Hand… |