CWE-22 · Path Traversal (page 3)
Page 3 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-62992 | | 2026-08-07 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line)… | |
CVE-2026-19264 | Critical | 9.8 | 2026-08-07 | Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory an… |
CVE-2026-66914 | | 2026-08-07 | Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated attacker could download files from bot… | |
CVE-2026-66493 | | 2026-08-07 | Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead… | |
CVE-2026-66492 | | 2026-08-07 | Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path… | |
CVE-2026-66491 | | 2026-08-07 | Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary… | |
CVE-2026-16263 | High | 8.8 | 2026-08-07 | The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path… |
CVE-2026-49163 | High | 8.8 | 2026-08-07 | Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privil… |
CVE-2026-71476 | | 2026-08-06 | Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts dow… | |
CVE-2026-64677 | | 2026-08-06 | Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media an… | |
CVE-2026-64653 | | 2026-08-06 | GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding… | |
CVE-2026-61632 | Medium | 5.3 | 2026-08-06 | PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to… |
CVE-2026-41861 | Medium | 4.2 | 2026-08-06 | Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a root-owned file with partially attacker-controlled body to a… |
CVE-2026-19059 | Low | 3.3 | 2026-08-06 | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulat… |
CVE-2026-19054 | Medium | 5.3 | 2026-08-06 | A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/wri… |
CVE-2026-19046 | Low | 3.3 | 2026-08-06 | A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvir… |
CVE-2026-18427 | High | 7.5 | 2026-08-06 | @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segm… |
CVE-2026-53976 | Critical | 9.1 | 2026-08-06 | OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticate… |
CVE-2026-28146 | Medium | 6.5 | 2026-08-06 | Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions. |
CVE-2026-19038 | Medium | 6.3 | 2026-08-06 | A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. This issue affects the function screenshotElement of the file src/index.t… |
CVE-2026-18991 | High | 7.3 | 2026-08-06 | A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/cor… |
CVE-2026-71313 | Medium | 6.9 | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in… |
CVE-2026-71309 | | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic doe… | |
CVE-2026-18959 | Medium | 5.4 | 2026-08-05 | A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the file innopacks/restapi… |
CVE-2026-18953 | High | 8.6 | 2026-08-05 | Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow… |
CVE-2026-17556 | Critical | 9.1 | 2026-08-05 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on… |
CVE-2026-8183 | High | 7.7 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could a… |
CVE-2026-7869 | Medium | 5.4 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occurs because user-sup… |
CVE-2026-7658 | Medium | 6.5 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containme… |
CVE-2026-70428 | Medium | 4.3 | 2026-08-05 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with… |
CVE-2026-7646 | Medium | 6.5 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signi… |
CVE-2026-9195 | Critical | 9.3 | 2026-08-05 | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authentic… |
CVE-2026-15979 | High | 8.1 | 2026-08-05 | The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up… |
CVE-2026-71283 | Medium | 4.9 | 2026-08-05 | Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uplo… |
CVE-2026-71279 | High | 8.0 | 2026-08-05 | Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/ex… |
CVE-2026-71269 | High | 7.2 | 2026-08-05 | Node-RED's local-filesystem library storage module (getLibraryEntry and saveLibraryEntry in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem… |
CVE-2026-71268 | Critical | 9.9 | 2026-08-05 | OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referen… |
CVE-2026-61891 | High | 7.5 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /f… |
CVE-2026-46581 | High | 7.5 | 2026-08-05 | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker… |
CVE-2026-60009 | High | 8.8 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The han… |
CVE-2026-12609 | High | 7.5 | 2026-08-05 | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, w… |
CVE-2026-71215 | High | 7.5 | 2026-08-05 | art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and extend template directives, resolves the t… |
CVE-2026-71209 | High | 7.5 | 2026-08-05 | audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a li… |
CVE-2026-55747 | Medium | 6.8 | 2026-08-05 | The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization o… |
CVE-2026-16940 | Critical | 10.0 | 2026-08-05 | The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary… |
CVE-2026-18903 | Medium | 4.3 | 2026-08-05 | A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/m… |
CVE-2026-18853 | Medium | 5.3 | 2026-08-05 | A security vulnerability has been detected in ZomboDroid Meme Generator App 4.6830 on Android. This issue affects the function t5.l.c of the component com.zomb… |
CVE-2026-70593 | Medium | 6.6 | 2026-08-04 | Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the upl… |
CVE-2026-70592 | Medium | 5.5 | 2026-08-04 | Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem th… |
CVE-2026-47682 | | 2026-08-04 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cl… | |
CVE-2026-47764 | | 2026-08-04 | pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_… | |
CVE-2026-47612 | High | 7.5 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker may cause improper limitation of a pathname to a restricted d… |
CVE-2026-47487 | Medium | 4.4 | 2026-08-04 | NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modifi… |
CVE-2026-58072 | | 2026-08-04 | A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution. | |
CVE-2026-69110 | Critical | 9.1 | 2026-08-04 | OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the te… |
CVE-2026-67200 | High | 7.5 | 2026-08-04 | Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by in… |
CVE-2026-14194 | Medium | 6.5 | 2026-08-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digita… |
CVE-2026-14818 | High | 7.2 | 2026-08-04 | A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, U… |
CVE-2026-17614 | Medium | 4.4 | 2026-08-04 | A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-… |
CVE-2026-56845 | High | 7.5 | 2026-08-04 | An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequ… |
CVE-2026-18648 | Medium | 5.3 | 2026-08-03 | A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of… |
CVE-2026-18646 | Medium | 5.3 | 2026-08-03 | A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name… |
CVE-2026-18645 | Medium | 5.4 | 2026-08-03 | A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_content of the file /system/admin/admin.php of the component Ad… |
CVE-2026-18644 | Medium | 5.4 | 2026-08-03 | A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delet… |
CVE-2026-69153 | Medium | 5.3 | 2026-08-03 | PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from i… |
CVE-2026-61372 | High | 7.5 | 2026-08-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: thr… |
CVE-2026-69095 | High | 7.5 | 2026-08-03 | OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows un… |
CVE-2026-69089 | High | 7.5 | 2026-08-03 | Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\Resour… |
CVE-2026-69086 | High | 7.7 | 2026-08-03 | SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traver… |
CVE-2025-15673 | Medium | 4.9 | 2026-08-03 | The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowin… |
CVE-2026-9856 | High | 7.1 | 2026-08-02 | A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in… |
CVE-2026-9335 | Medium | 6.5 | 2026-08-02 | A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The… |
CVE-2026-18352 | High | 7.5 | 2026-08-02 | The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter p… |
CVE-2026-13339 | High | 7.5 | 2026-08-02 | The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' fu… |
CVE-2026-67309 | | 2026-08-01 | Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated… | |
CVE-2026-67295 | Medium | 6.3 | 2026-08-01 | FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside th… |
CVE-2026-15601 | Medium | 4.9 | 2026-08-01 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and incl… |
CVE-2026-15450 | High | 8.1 | 2026-08-01 | The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including… |
CVE-2026-15932 | Medium | 5.3 | 2026-08-01 | The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attack… |
CVE-2026-15244 | High | 7.2 | 2026-08-01 | The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion pat… |
CVE-2026-15006 | High | 7.5 | 2026-08-01 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all ve… |
CVE-2026-54785 | Medium | 6.2 | 2026-07-31 | gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in i… |
CVE-2026-62999 | High | 7.5 | 2026-07-31 | Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separator… |
CVE-2026-55825 | Low | 3.1 | 2026-07-31 | Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier contai… |
CVE-2026-53502 | | 2026-07-31 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary valid… | |
CVE-2026-62391 | High | 8.1 | 2026-07-31 | The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side confi… |
CVE-2026-44615 | Medium | 6.5 | 2026-07-31 | Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or acce… |
CVE-2026-63222 | High | 7.5 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without… |
CVE-2026-56673 | High | 7.5 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_ann… |
CVE-2026-56671 | High | 7.5 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unr… |
CVE-2026-55495 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a… |
CVE-2026-66755 | High | 7.5 | 2026-07-30 | Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can p… |
CVE-2026-12942 | High | 7.5 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL reque… |
CVE-2026-62663 | High | 7.5 | 2026-07-30 | Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters (image, audio, video, document) in… |
CVE-2026-52680 | Critical | 9.8 | 2026-07-30 | Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker w… |
CVE-2026-6540 | High | 7.5 | 2026-07-30 | Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP… |
CVE-2026-15435 | Critical | 9.8 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An a… |
CVE-2026-14519 | High | 7.5 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path trave… |
CVE-2026-59310 | Critical | 9.8 | 2026-07-30 | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to ex… |
CVE-2026-16531 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary… |