CWE-22 · Path Traversal (page 4)
Page 4 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-67247 | Medium | 6.5 | 2026-07-30 | A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently… |
CVE-2026-67246 | Medium | 6.5 | 2026-07-30 | A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not suffic… |
CVE-2026-67245 | High | 8.1 | 2026-07-30 | A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficie… |
CVE-2026-5492 | Medium | 6.5 | 2026-07-29 | DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected in… |
CVE-2026-5491 | High | 7.5 | 2026-07-29 | DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected in… |
CVE-2026-5489 | Medium | 5.3 | 2026-07-29 | DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected in… |
CVE-2026-5487 | High | 7.5 | 2026-07-29 | DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected in… |
CVE-2026-67429 | Critical | 10.0 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlle… |
CVE-2026-13723 | Medium | 6.5 | 2026-07-29 | A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a U… |
CVE-2026-50558 | Medium | 5.9 | 2026-07-29 | Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py… |
CVE-2026-65886 | High | 7.5 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary… |
CVE-2026-65889 | High | 7.5 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete director… |
CVE-2026-44943 | | 2026-07-29 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owne… | |
CVE-2026-11974 | High | 8.6 | 2026-07-29 | The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX action… |
CVE-2026-66063 | Medium | 6.5 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part… |
CVE-2026-54659 | | 2026-07-28 | Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and… | |
CVE-2026-54650 | High | 8.6 | 2026-07-28 | openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instea… |
CVE-2026-55390 | High | 7.5 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/par… |
CVE-2026-55389 | High | 7.5 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw J… |
CVE-2026-15280 | High | 7.5 | 2026-07-28 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the coll… |
CVE-2026-14973 | Critical | 9.3 | 2026-07-28 | IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination. |
CVE-2026-5114 | Medium | 4.9 | 2026-07-28 | The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mism… |
CVE-2026-48374 | High | 7.8 | 2026-07-28 | Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system… |
CVE-2026-67185 | High | 7.5 | 2026-07-28 | TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the… |
CVE-2026-54545 | High | 7.1 | 2026-07-28 | wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before wri… |
CVE-2026-7521 | Medium | 5.5 | 2026-07-28 | Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML… |
CVE-2026-16585 | High | 7.2 | 2026-07-28 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient… |
CVE-2026-14490 | High | 7.5 | 2026-07-28 | The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and incl… |
CVE-2026-17524 | High | 7.5 | 2026-07-28 | Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process… |
CVE-2026-64740 | Critical | 9.3 | 2026-07-27 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6… |
CVE-2026-64731 | Critical | 9.8 | 2026-07-27 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may be able to bre… |
CVE-2026-43772 | High | 8.2 | 2026-07-27 | A path traversal issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app… |
CVE-2026-43749 | High | 7.8 | 2026-07-27 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8… |
CVE-2026-43723 | High | 7.8 | 2026-07-27 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15… |
CVE-2026-65921 | High | 8.8 | 2026-07-27 | A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts loca… |
CVE-2026-45623 | High | 7.5 | 2026-07-27 | PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and pri… |
CVE-2026-66397 | | 2026-07-27 | phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delet… | |
CVE-2026-66476 | Medium | 4.9 | 2026-07-27 | Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions. |
CVE-2026-66050 | High | 7.5 | 2026-07-27 | NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same netw… |
CVE-2026-65436 | Medium | 6.8 | 2026-07-27 | Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions. |
CVE-2026-65878 | | 2026-07-27 | Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file dele… | |
CVE-2026-17514 | Medium | 5.3 | 2026-07-27 | A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This… |
CVE-2026-40000 | Low | 1.8 | 2026-07-27 | The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications ca… |
CVE-2026-65765 | | 2026-07-27 | Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to… | |
CVE-2026-14955 | Medium | 6.5 | 2026-07-25 | The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the '… |
CVE-2026-66007 | Medium | 6.5 | 2026-07-24 | Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is… |
CVE-2026-66004 | Medium | 5.3 | 2026-07-24 | BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files… |
CVE-2026-15420 | Medium | 4.3 | 2026-07-24 | The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and in… |
CVE-2026-16767 | Medium | 6.5 | 2026-07-23 | A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Hand… |
CVE-2026-65694 | High | 7.5 | 2026-07-23 | Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitr… |
CVE-2026-47669 | | 2026-07-23 | DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27)… | |
CVE-2026-15687 | Low | 2.4 | 2026-07-23 | A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the cli… |
CVE-2026-65920 | Medium | 4.3 | 2026-07-23 | Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to… |
CVE-2026-65919 | High | 7.5 | 2026-07-23 | Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pas… |
CVE-2026-65702 | High | 8.6 | 2026-07-23 | Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attac… |
CVE-2026-65701 | Critical | 9.1 | 2026-07-23 | SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticat… |
CVE-2026-65700 | Critical | 9.8 | 2026-07-23 | h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, an… |
CVE-2026-65698 | Medium | 5.3 | 2026-07-23 | Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host fil… |
CVE-2026-65695 | Medium | 6.8 | 2026-07-23 | Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argume… |
CVE-2026-65690 | High | 8.8 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authen… |
CVE-2026-65689 | Critical | 9.8 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauth… |
CVE-2026-65688 | Critical | 9.8 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthen… |
CVE-2026-65687 | Critical | 9.8 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthent… |
CVE-2026-65607 | Medium | 6.5 | 2026-07-23 | SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unl… |
CVE-2026-59555 | Critical | 10.0 | 2026-07-23 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions. |
CVE-2026-59542 | High | 7.7 | 2026-07-23 | Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions. |
CVE-2026-57716 | Medium | 5.3 | 2026-07-23 | Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions. |
CVE-2026-57696 | High | 7.1 | 2026-07-23 | Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions. |
CVE-2026-65754 | High | 7.5 | 2026-07-23 | Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site direct… |
CVE-2026-65713 | Medium | 6.5 | 2026-07-23 | Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories. |
CVE-2026-65712 | Medium | 6.2 | 2026-07-23 | Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory… |
CVE-2026-65431 | Critical | 9.8 | 2026-07-23 | Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading… |
CVE-2026-64872 | Medium | 6.5 | 2026-07-23 | Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory. |
CVE-2026-16078 | Medium | 6.5 | 2026-07-23 | The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 vi… |
CVE-2026-15786 | Medium | 4.4 | 2026-07-23 | The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all… |
CVE-2026-15074 | High | 7.5 | 2026-07-23 | @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypas… |
CVE-2026-16653 | Medium | 5.3 | 2026-07-23 | A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the compo… |
CVE-2026-14985 | High | 7.8 | 2026-07-22 | The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper… |
CVE-2026-13186 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the… |
CVE-2026-65600 | Medium | 5.3 | 2026-07-22 | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middlew… |
CVE-2026-44192 | Medium | 6.6 | 2026-07-22 | A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traversal, allows an attacker to manipulate a… |
CVE-2026-56844 | | 2026-07-22 | A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level ac… | |
CVE-2026-47731 | Critical | 9.1 | 2026-07-21 | The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surface and Space (BLISS)) is a Python-based software suite developed to handle Gro… |
CVE-2026-30633 | High | 7.5 | 2026-07-21 | Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools. |
CVE-2026-50757 | High | 7.8 | 2026-07-21 | Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server |
CVE-2026-30632 | High | 7.5 | 2026-07-21 | Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool. |
CVE-2026-63454 | High | 7.2 | 2026-07-21 | An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a u… |
CVE-2026-47425 | | 2026-07-21 | Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types… | |
CVE-2026-47397 | | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to… | |
CVE-2026-15791 | High | 7.5 | 2026-07-21 | A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete… |
CVE-2026-15789 | High | 7.5 | 2026-07-21 | A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs… |
CVE-2026-15724 | High | 8.7 | 2026-07-21 | In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerabil… |
CVE-2026-64825 | Critical | 9.3 | 2026-07-21 | Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on… |
CVE-2026-64824 | High | 8.4 | 2026-07-21 | Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary ab… |
CVE-2026-47394 | | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory descrip… | |
CVE-2026-47121 | Medium | 6.1 | 2026-07-21 | Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObjec… |
CVE-2026-13693 | Medium | 5.9 | 2026-07-21 | The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification… |
CVE-2026-47144 | Medium | 5.5 | 2026-07-20 | Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `s… |
CVE-2026-56623 | High | 7.1 | 2026-07-20 | Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server impl… |
CVE-2026-56452 | High | 7.5 | 2026-07-20 | Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of… |