CWE-22 · Path Traversal (page 5)
Page 5 of 100 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-82428 | High | 8.8 | 2026-09-14 | Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep--… |
CVE-2026-82427 | High | 7.8 | 2026-09-14 | Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to bu… |
CVE-2026-82426 | Medium | 6.5 | 2026-09-14 | Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and opened it directly, wi… |
CVE-2026-57129 | High | 7.5 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from… |
CVE-2026-78299 | Critical | 9.1 | 2026-09-14 | In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations o… |
CVE-2026-81565 | | 2026-09-14 | Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request paramete… | |
CVE-2026-81564 | | 2026-09-14 | Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9… | |
CVE-2026-90691 | High | 8.3 | 2026-09-14 | A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOpera… |
CVE-2026-90774 | High | 7.5 | 2026-09-13 | rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape… |
CVE-2026-90494 | Medium | 5.3 | 2026-09-13 | A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation caus… |
CVE-2026-85706 | Critical | 10.0 | 2026-09-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, an… |
CVE-2026-90445 | Medium | 6.5 | 2026-09-11 | An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain… |
CVE-2026-49846 | High | 7.5 | 2026-09-11 | libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose… |
CVE-2025-69904 | Medium | 4.9 | 2026-09-11 | Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path inp… |
CVE-2026-87910 | | 2026-09-11 | When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function i… | |
CVE-2026-87984 | | 2026-09-11 | An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspac… | |
CVE-2026-87983 | | 2026-09-11 | An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute pa… | |
CVE-2026-87727 | Medium | 6.5 | 2026-09-11 | a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the a… |
CVE-2026-19991 | High | 8.1 | 2026-09-11 | The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. T… |
CVE-2026-77807 | High | 7.5 | 2026-09-11 | The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all… |
CVE-2026-86087 | Medium | 4.3 | 2026-09-10 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the… |
CVE-2026-84889 | High | 8.8 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restr… |
CVE-2026-82100 | Critical | 9.6 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability. |
CVE-2026-81554 | High | 8.8 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulne… |
CVE-2026-81551 | High | 8.8 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path… |
CVE-2026-81540 | High | 8.5 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path tra… |
CVE-2026-80424 | Critical | 9.1 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extracti… |
CVE-2026-49836 | | 2026-09-10 | psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a pa… | |
CVE-2026-45767 | Medium | 4.4 | 2026-09-10 | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a mal… |
CVE-2025-57231 | High | 7.5 | 2026-09-10 | Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url. |
CVE-2026-76652 | | 2026-09-10 | An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insu… | |
CVE-2026-88046 | Medium | 5.3 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject pare… |
CVE-2026-88940 | Medium | 5.3 | 2026-09-10 | knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories… |
CVE-2026-88938 | Medium | 6.5 | 2026-09-10 | knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywher… |
CVE-2026-88937 | High | 8.8 | 2026-09-10 | knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitr… |
CVE-2026-88014 | Medium | 6.3 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend… |
CVE-2026-81789 | High | 8.6 | 2026-09-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce… |
CVE-2026-81275 | Medium | 6.5 | 2026-09-10 | Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions. |
CVE-2026-88790 | Medium | 4.8 | 2026-09-10 | A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/f… |
CVE-2026-64838 | High | 8.3 | 2026-09-10 | ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate… |
CVE-2026-64836 | High | 8.8 | 2026-09-10 | ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check… |
CVE-2026-9166 | High | 7.5 | 2026-09-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GIS Informatics GisLab Laboratory Management System allows Path… |
CVE-2026-78085 | | 2026-09-10 | Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked director… | |
CVE-2026-18386 | Medium | 4.9 | 2026-09-10 | The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backup_file' p… |
CVE-2026-15019 | High | 7.5 | 2026-09-10 | The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the (top-level inc… |
CVE-2026-88069 | | 2026-09-09 | Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlle… | |
CVE-2026-53956 | Medium | 5.4 | 2026-09-09 | Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to versi… |
CVE-2026-86775 | High | 8.6 | 2026-09-09 | knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normaliz… |
CVE-2026-86099 | High | 8.2 | 2026-09-09 | Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by… |
CVE-2026-78485 | High | 7.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to… |
CVE-2026-19729 | Medium | 4.9 | 2026-09-09 | A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs b… |
CVE-2026-87030 | High | 8.5 | 2026-09-09 | Tanium addressed a path traversal vulnerability in Comply. |
CVE-2026-87023 | High | 8.5 | 2026-09-09 | Tanium addressed a path traversal vulnerability in Comply. |
CVE-2026-14505 | Medium | 6.6 | 2026-09-09 | Tanium addressed a path traversal vulnerability in Tanium Data Service. |
CVE-2026-53581 | Critical | 9.0 | 2026-09-08 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal v… |
CVE-2026-86995 | Medium | 4.3 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, b… |
CVE-2026-86079 | Medium | 6.5 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-co… |
CVE-2026-78624 | Medium | 4.9 | 2026-09-08 | The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents t… |
CVE-2026-77110 | High | 7.6 | 2026-09-08 | Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security f… |
CVE-2026-81377 | Medium | 6.5 | 2026-09-08 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over… |
CVE-2026-79904 | Medium | 5.0 | 2026-09-08 | Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security… |
CVE-2026-78461 | High | 7.4 | 2026-09-08 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security featu… |
CVE-2026-69807 | High | 8.0 | 2026-09-08 | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an authorized attacker to elevate privileges over a… |
CVE-2026-69445 | High | 7.8 | 2026-09-08 | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Compressed Folder allows an authorized attacker to elevate privileges… |
CVE-2026-62801 | Medium | 6.5 | 2026-09-08 | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypass a security featu… |
CVE-2026-74239 | High | 7.2 | 2026-09-08 | XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administ… |
CVE-2026-77104 | High | 7.5 | 2026-09-08 | CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe. |
CVE-2026-77091 | High | 7.8 | 2026-09-08 | DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Ex… |
CVE-2026-74859 | Medium | 6.8 | 2026-09-08 | The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can… |
CVE-2026-86542 | Critical | 9.1 | 2026-09-07 | knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Atta… |
CVE-2026-86541 | High | 8.3 | 2026-09-07 | knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files out… |
CVE-2026-86538 | High | 7.5 | 2026-09-07 | knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read… |
CVE-2026-86439 | High | 8.8 | 2026-09-07 | knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside t… |
CVE-2026-6377 | High | 7.5 | 2026-09-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Ma… |
CVE-2026-80131 | High | 7.4 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to… |
CVE-2026-80129 | Medium | 6.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to… |
CVE-2026-78043 | | 2026-09-07 | The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint a… | |
CVE-2026-86258 | Medium | 5.9 | 2026-09-06 | nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validat… |
CVE-2026-86253 | Medium | 5.9 | 2026-09-06 | h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized… |
CVE-2026-86251 | Medium | 5.9 | 2026-09-06 | h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-enc… |
CVE-2026-67281 | High | 7.5 | 2026-09-05 | RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principa… |
CVE-2026-84898 | Medium | 6.6 | 2026-09-05 | The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contr… |
CVE-2026-14975 | Medium | 6.5 | 2026-09-05 | The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This… |
CVE-2025-15693 | Low | 2.7 | 2026-09-05 | The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to wit… |
CVE-2026-81939 | Critical | 9.1 | 2026-09-04 | A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract… |
CVE-2026-53757 | | 2026-09-04 | Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() with… | |
CVE-2026-50553 | | 2026-09-04 | Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"… | |
CVE-2026-17622 | Medium | 6.5 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a… |
CVE-2026-17621 | Medium | 5.4 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL reque… |
CVE-2026-14470 | Medium | 6.5 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted U… |
CVE-2026-19306 | High | 7.7 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (s… |
CVE-2026-19303 | High | 8.1 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of… |
CVE-2026-19302 | Medium | 6.5 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links. |
CVE-2026-19299 | Medium | 6.5 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal. |
CVE-2026-9138 | Medium | 6.5 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in… |
CVE-2026-85690 | High | 7.8 | 2026-09-04 | Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project directory. Attackers… |
CVE-2026-85685 | High | 7.5 | 2026-09-04 | AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent work… |
CVE-2026-85665 | Medium | 6.5 | 2026-09-04 | Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directo… |
CVE-2026-85661 | Critical | 9.8 | 2026-09-04 | excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. At… |
CVE-2026-85618 | Medium | 6.5 | 2026-09-04 | ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files w… |