CWE-22 · Path Traversal (page 31)
Page 31 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13179 | High | 7.3 | 2025-01-14 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. |
CVE-2024-10811 | Critical | 9.8 | 2025-01-14 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at… |
CVE-2025-0461 | Medium | 4.3 | 2025-01-14 | A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as problematic. This vulnerability affects… |
CVE-2024-39787 | Critical | 9.1 | 2025-01-14 | Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP reques… |
CVE-2024-39786 | Critical | 9.1 | 2025-01-14 | Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP reques… |
CVE-2024-48884 | High | 7.5 | 2025-01-14 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1… |
CVE-2024-47566 | Medium | 5.1 | 2025-01-14 | A improper limitation of a pathname to a restricted directory ('path traversal') [CWE-23] in Fortinet FortiRecorder version 7.2.0 through 7.2.1 and before 7.0… |
CVE-2024-46664 | Medium | 5.5 | 2025-01-14 | A relative path traversal in Fortinet FortiRecorder [CWE-23] version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to read files from the u… |
CVE-2024-36512 | High | 7.2 | 2025-01-14 | An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer 7.4.0 through 7.4.3 and 7.2.0 through… |
CVE-2024-33502 | Medium | 6.5 | 2025-01-14 | An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 and 7.2… |
CVE-2024-32115 | Medium | 5.5 | 2025-01-14 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete… |
CVE-2024-12083 | Medium | 6.6 | 2025-01-14 | Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized… |
CVE-2023-42232 | High | 7.5 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Navigator/Index function. |
CVE-2023-42229 | Medium | 6.5 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal. Arbitrary files can be created on the system via authenticated SOAP re… |
CVE-2023-42227 | High | 7.5 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the WSCView/Save function. |
CVE-2023-42226 | High | 7.5 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment function. |
CVE-2023-42225 | High | 7.5 | 2025-01-13 | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Attachment/DownloadTempFile function. |
CVE-2025-0401 | Medium | 5.3 | 2025-01-13 | A vulnerability classified as critical has been found in 1902756969 reggie 1.0. Affected is the function download of the file src/main/java/com/itheima/reggie/… |
CVE-2025-22152 | Critical | 9.1 | 2025-01-10 | Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowin… |
CVE-2024-11642 | Critical | 9.8 | 2025-01-09 | The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder plugin for WordPr… |
CVE-2024-37372 | Low | 3.6 | 2025-01-09 | The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subt… |
CVE-2025-22130 | High | 8.8 | 2025-01-08 | Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over… |
CVE-2024-9939 | High | 7.5 | 2025-01-08 | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfu_file_downloader.php. This… |
CVE-2024-10585 | Medium | 5.3 | 2025-01-08 | The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the ~/… |
CVE-2023-52953 | Medium | 6.2 | 2025-01-08 | Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2024-12429 | Medium | 4.3 | 2025-01-07 | An attacker who successfully exploited these vulnerabilities could grant read access to files. A vulnerability exists in the AC500 V3 version mentioned. A succ… |
CVE-2025-21623 | High | 7.5 | 2025-01-07 | ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template director… |
CVE-2025-21622 | High | 7.5 | 2025-01-07 | ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any t… |
CVE-2024-12425 | Low | 3.3 | 2025-01-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traver… |
CVE-2024-56286 | High | 7.5 | 2025-01-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-a… |
CVE-2024-12152 | High | 7.5 | 2025-01-07 | The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download… |
CVE-2024-12849 | High | 7.5 | 2025-01-07 | The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_… |
CVE-2024-41765 | Medium | 6.5 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send… |
CVE-2024-56514 | | 2025-01-03 | Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1… | |
CVE-2024-56248 | Medium | 4.9 | 2025-01-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Path Traversa… |
CVE-2024-56198 | | 2024-12-31 | path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassed using .=%5c whic… | |
CVE-2024-12105 | Medium | 6.5 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an authenticated user can use a specially crafted HTTP request that can lead to information disclosure. |
CVE-2024-56213 | Medium | 6.5 | 2024-12-31 | Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.7. |
CVE-2024-11944 | High | 8.8 | 2024-12-30 | iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to exec… |
CVE-2024-54453 | High | 7.5 | 2024-12-27 | An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. A path traversal vulnerability in… |
CVE-2024-54452 | Medium | 4.9 | 2024-12-27 | An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35 and 7.10.x through 7.10.0.18. A Directory Traversal and Local File Inclusion vulnerability… |
CVE-2024-56509 | High | 8.6 | 2024-12-27 | changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper input validation in the… |
CVE-2024-12850 | Medium | 4.9 | 2024-12-24 | The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includi… |
CVE-2024-41887 | | 2024-12-24 | Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker can create an NVR log file in a directory… | |
CVE-2024-53961 | High | 8.1 | 2024-12-23 | ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilit… |
CVE-2024-55947 | High | 8.8 | 2024-12-23 | Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. T… |
CVE-2024-54148 | Critical | 9.8 | 2024-12-23 | Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the se… |
CVE-2024-12875 | Medium | 4.9 | 2024-12-21 | The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an… |
CVE-2024-56331 | Medium | 6.8 | 2024-12-20 | Uptime Kuma is an open source, self-hosted monitoring tool. An **Improper URL Handling Vulnerability** allows an attacker to access sensitive local files on th… |
CVE-2024-44195 | High | 7.5 | 2024-12-20 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to read arbitrary files. |
CVE-2024-12830 | High | 7.3 | 2024-12-20 | Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-38819 | High | 7.5 | 2024-12-19 | Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can c… |
CVE-2024-12793 | Medium | 4.3 | 2024-12-19 | A vulnerability, which was classified as problematic, has been found in PbootCMS up to 5.2.3. Affected by this issue is some unknown functionality of the file… |
CVE-2021-26102 | Critical | 9.8 | 2024-12-19 | A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete… |
CVE-2024-21547 | High | 7.5 | 2024-12-18 | Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check c… |
CVE-2024-56142 | Medium | 6.5 | 2024-12-17 | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. A vulnerability has been discovered that could allow… |
CVE-2024-55516 | Critical | 9.1 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 v3.90. The component affected by this issue is /upload_sysconfig.php on the web i… |
CVE-2024-55515 | Critical | 9.8 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_ipslib.php on the web inter… |
CVE-2024-55513 | Critical | 9.1 | 2024-12-17 | A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 3.90. The component affected by this issue is /upload_netaction.php on the web in… |
CVE-2024-54382 | Medium | 4.9 | 2024-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Path Trav… |
CVE-2024-54380 | High | 7.5 | 2024-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Filippo Bodei WP Cookies Enabler wp-cookies-enabler allows PHP… |
CVE-2024-54375 | High | 7.5 | 2024-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Woolook woolook allows PHP Local File Inclusion.This issu… |
CVE-2024-54374 | High | 7.5 | 2024-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sabri Sogrid sogrid allows PHP Local File Inclusion.This issue… |
CVE-2024-54373 | High | 7.5 | 2024-12-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chris Gardenberg EduAdmin Booking eduadmin-booking allows PHP L… |
CVE-2024-12362 | Medium | 4.3 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The… |
CVE-2024-55970 | High | 7.5 | 2024-12-15 | File Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue that is related to the request parameter, aka I644734. |
CVE-2024-54259 | Medium | 6.5 | 2024-12-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issu… |
CVE-2024-11834 | Critical | 9.1 | 2024-12-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTr… |
CVE-2024-11833 | Critical | 9.1 | 2024-12-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTr… |
CVE-2024-8647 | Medium | 5.4 | 2024-12-12 | An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it w… |
CVE-2024-55659 | Medium | 5.4 | 2024-12-12 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file writ… |
CVE-2024-55658 | High | 7.5 | 2024-12-12 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read vi… |
CVE-2024-55657 | High | 7.5 | 2024-12-12 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/render` endpo… |
CVE-2024-54489 | High | 7.8 | 2024-12-12 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. Running a m… |
CVE-2024-55587 | High | 8.8 | 2024-12-12 | python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract. |
CVE-2024-49082 | Medium | 6.8 | 2024-12-12 | Windows File Explorer Information Disclosure Vulnerability |
CVE-2024-12482 | Medium | 4.3 | 2024-12-12 | A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been rated as problematic. Affected by this issue is the function backup of the file wetech-cm… |
CVE-2024-55550 | Low | 2.7 | 2024-12-10 | Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sani… |
CVE-2024-55602 | High | 7.6 | 2024-12-10 | PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and downlo… |
CVE-2024-45709 | Medium | 5.3 | 2024-12-10 | SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on Linux and configured to… |
CVE-2024-10708 | Medium | 4.9 | 2024-12-10 | The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perfor… |
CVE-2023-6947 | High | 7.7 | 2024-12-10 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This mak… |
CVE-2024-21542 | High | 8.6 | 2024-12-10 | Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path valid… |
CVE-2024-50626 | High | 8.8 | 2024-12-09 | An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal vulnerability exists in WebFS. This allows an attacker on the local area n… |
CVE-2024-53790 | High | 7.5 | 2024-12-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows PH… |
CVE-2024-11010 | High | 7.2 | 2024-12-07 | The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and includi… |
CVE-2024-10516 | High | 8.1 | 2024-12-06 | The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' funct… |
CVE-2024-11585 | High | 7.5 | 2024-12-06 | The WP Hide & Security Enhancer plugin for WordPress is vulnerable to arbitrary file contents deletion due to a missing authorization and insufficient file pat… |
CVE-2024-53523 | High | 7.5 | 2024-12-05 | JSFinder commit d70ab9bc5221e016c08cffaf0d9ac79646c90645 is vulnerable to Directory Traversal in the find_by_file function. |
CVE-2024-10933 | Medium | 5.0 | 2024-12-05 | In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untru… |
CVE-2024-53490 | High | 7.5 | 2024-12-05 | Favorites-web 1.3.0 favorites-web has a directory traversal vulnerability in SecurityFilter.java. |
CVE-2024-51549 | Critical | 10.0 | 2024-12-05 | Absolute File Traversal vulnerabilities allows access and modification of un-intended resources. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXU… |
CVE-2024-54132 | | 2024-12-04 | The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unint… | |
CVE-2024-54154 | High | 8.0 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox |
CVE-2024-11952 | High | 7.5 | 2024-12-04 | The Classic Addons – WPBakery Page Builder plugin for WordPress is vulnerable to Limited Local PHP File Inclusion in all versions up to, and including, 3.0 via… |
CVE-2024-11398 | High | 8.1 | 2024-12-04 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router Manager (SRM) before… |
CVE-2024-49421 | Medium | 4.3 | 2024-12-03 | Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adjacent attackers to… |
CVE-2024-49411 | Medium | 4.3 | 2024-12-03 | Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege. |
CVE-2024-53566 | Medium | 5.5 | 2024-12-02 | An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal. |
CVE-2024-46909 | Critical | 9.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the se… |