CWE-22 · Path Traversal (page 6)
Page 6 of 100 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85606 | High | 7.5 | 2026-09-04 | firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments witho… |
CVE-2026-74236 | Medium | 6.5 | 2026-09-04 | GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function a… |
CVE-2026-74235 | Medium | 4.9 | 2026-09-04 | GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf_handle_downl… |
CVE-2026-85580 | Medium | 6.5 | 2026-09-04 | SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems… |
CVE-2026-79707 | | 2026-09-04 | A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenti… | |
CVE-2026-82193 | Medium | 5.5 | 2026-09-04 | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, al… |
CVE-2026-85409 | Medium | 6.3 | 2026-09-04 | A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component… |
CVE-2026-67397 | | 2026-09-04 | Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root. | |
CVE-2026-85456 | Medium | 5.5 | 2026-09-03 | MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the… |
CVE-2026-82521 | Medium | 5.3 | 2026-09-03 | parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of p… |
CVE-2026-85396 | High | 7.5 | 2026-09-03 | rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix compar… |
CVE-2026-75602 | Medium | 6.5 | 2026-09-03 | OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool… |
CVE-2026-85199 | | 2026-09-03 | Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, up… | |
CVE-2026-85124 | High | 7.5 | 2026-09-03 | @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured… |
CVE-2026-84852 | Medium | 4.4 | 2026-09-02 | A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of… |
CVE-2026-49833 | Medium | 5.5 | 2026-09-02 | DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to bef… |
CVE-2026-49831 | Medium | 5.5 | 2026-09-02 | DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Cu… |
CVE-2026-52832 | Medium | 4.9 | 2026-09-02 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without auth… |
CVE-2026-84671 | High | 8.8 | 2026-09-02 | Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler… |
CVE-2026-84669 | High | 8.8 | 2026-09-02 | A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Allure report result… |
CVE-2026-84667 | High | 7.1 | 2026-09-02 | Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect b… |
CVE-2026-78602 | Medium | 5.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Trav… |
CVE-2026-78599 | Medium | 6.5 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of in… |
CVE-2026-78591 | Medium | 6.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of re… |
CVE-2026-78590 | High | 7.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of pr… |
CVE-2026-18672 | High | 7.5 | 2026-09-02 | In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence w… |
CVE-2026-78657 | Critical | 9.8 | 2026-09-02 | The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_su… |
CVE-2026-84442 | Medium | 4.4 | 2026-09-02 | A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIn… |
CVE-2026-84441 | High | 7.3 | 2026-09-02 | A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Imag… |
CVE-2026-14982 | High | 8.1 | 2026-09-02 | The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versi… |
CVE-2026-84431 | Medium | 4.4 | 2026-09-02 | A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of t… |
CVE-2026-84702 | High | 7.5 | 2026-09-02 | facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can s… |
CVE-2026-84374 | High | 7.5 | 2026-09-01 | Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy… |
CVE-2026-84373 | Medium | 5.9 | 2026-09-01 | Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in pack… |
CVE-2026-75604 | Critical | 9.0 | 2026-09-01 | Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Rou… |
CVE-2026-84365 | Medium | 6.5 | 2026-09-01 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not c… |
CVE-2026-73765 | High | 7.2 | 2026-09-01 | Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arb… |
CVE-2026-73760 | Medium | 6.5 | 2026-09-01 | An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from t… |
CVE-2026-73752 | High | 8.8 | 2026-09-01 | An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to… |
CVE-2026-78592 | High | 7.3 | 2026-09-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources… |
CVE-2026-73737 | Medium | 4.8 | 2026-09-01 | An unauthenticated path traversal vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenti… |
CVE-2026-84201 | High | 7.1 | 2026-09-01 | appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files out… |
CVE-2026-61753 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-19952 | High | 7.5 | 2026-09-01 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders fun… |
CVE-2026-67395 | Medium | 5.9 | 2026-09-01 | A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveragi… |
CVE-2026-82954 | Critical | 9.9 | 2026-08-31 | A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/ap… |
CVE-2026-82393 | High | 7.5 | 2026-08-31 | pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm… |
CVE-2026-82392 | High | 7.1 | 2026-08-31 | pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys w… |
CVE-2026-79407 | High | 7.5 | 2026-08-31 | A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name()… |
CVE-2026-75594 | | 2026-08-31 | Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed… | |
CVE-2026-75592 | | 2026-08-31 | Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem co… | |
CVE-2026-61639 | | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() wit… | |
CVE-2026-53553 | High | 7.7 | 2026-08-31 | Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, spec… |
CVE-2026-79743 | | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… | |
CVE-2026-82217 | High | 8.8 | 2026-08-31 | In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replaceme… |
CVE-2026-70449 | Medium | 5.3 | 2026-08-31 | Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including fil… |
CVE-2026-82877 | Medium | 6.5 | 2026-08-31 | ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read se… |
CVE-2026-82665 | Low | 3.8 | 2026-08-31 | A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibr… |
CVE-2026-82673 | | 2026-08-31 | Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to… | |
CVE-2026-82603 | Medium | 5.4 | 2026-08-31 | A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Ca… |
CVE-2026-82599 | Medium | 5.4 | 2026-08-31 | A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the c… |
CVE-2026-56718 | High | 7.5 | 2026-08-30 | AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote… |
CVE-2026-82656 | Low | 2.6 | 2026-08-30 | Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include… |
CVE-2026-82635 | High | 8.8 | 2026-08-30 | Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filen… |
CVE-2026-19722 | Medium | 6.6 | 2026-08-30 | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during res… |
CVE-2026-82460 | Critical | 9.8 | 2026-08-29 | Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path… |
CVE-2026-18899 | High | 7.5 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal. |
CVE-2026-82286 | High | 8.6 | 2026-08-28 | gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary fil… |
CVE-2026-82275 | High | 7.5 | 2026-08-28 | Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers… |
CVE-2026-82264 | Medium | 6.8 | 2026-08-28 | Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. At… |
CVE-2026-55569 | Medium | 6.6 | 2026-08-28 | aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink… |
CVE-2026-55552 | High | 7.5 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normaliz… |
CVE-2026-82112 | Low | 3.5 | 2026-08-28 | A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component code_task_fi… |
CVE-2026-38093 | Low | 3.3 | 2026-08-28 | file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The op… |
CVE-2026-82253 | High | 7.5 | 2026-08-28 | gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate… |
CVE-2026-82251 | High | 7.5 | 2026-08-28 | gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attac… |
CVE-2026-82233 | Medium | 5.7 | 2026-08-28 | SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary… |
CVE-2026-82111 | Medium | 4.3 | 2026-08-28 | A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component… |
CVE-2026-61800 | Critical | 9.1 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a part… |
CVE-2026-81847 | Medium | 5.5 | 2026-08-28 | A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function save_pipeline/load_pipeline of the file pipeline_t… |
CVE-2026-81845 | Medium | 6.3 | 2026-08-28 | A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function import_session/export_session of the file mcp_sequent… |
CVE-2026-81837 | Medium | 6.3 | 2026-08-28 | A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the com… |
CVE-2026-75418 | High | 7.5 | 2026-08-28 | A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the serve… |
CVE-2026-75337 | Critical | 9.8 | 2026-08-28 | The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to t… |
CVE-2026-54083 | High | 8.1 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response scr… |
CVE-2026-81730 | High | 8.2 | 2026-08-27 | Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The… |
CVE-2026-76639 | High | 8.8 | 2026-08-27 | Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitra… |
CVE-2026-59294 | Medium | 5.9 | 2026-08-27 | ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and… |
CVE-2026-54732 | Medium | 6.5 | 2026-08-27 | libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileN… |
CVE-2026-54687 | Critical | 9.8 | 2026-08-27 | n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database f… |
CVE-2026-37068 | High | 8.1 | 2026-08-27 | Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role o… |
CVE-2026-37066 | Medium | 6.5 | 2026-08-27 | Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authentic… |
CVE-2026-37007 | Critical | 9.8 | 2026-08-27 | A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the… |
CVE-2026-81716 | Medium | 5.2 | 2026-08-27 | openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a… |
CVE-2026-79653 | | 2026-08-27 | In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.stor… | |
CVE-2026-59280 | Medium | 4.3 | 2026-08-27 | Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from un… |
CVE-2026-40526 | Medium | 6.5 | 2026-08-27 | Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute fi… |
CVE-2026-81743 | | 2026-08-27 | Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the in… | |
CVE-2026-81659 | | 2026-08-27 | Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local fil… | |
CVE-2026-81560 | Medium | 5.3 | 2026-08-27 | A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the compon… |