CWE-22 · Path Traversal (page 7)
Page 7 of 100 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78275 | Medium | 6.8 | 2026-08-27 | Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions. |
CVE-2026-47884 | Critical | 9.8 | 2026-08-27 | Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where… |
CVE-2026-81491 | High | 7.3 | 2026-08-27 | A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes/sync_notes/project_folder of the file… |
CVE-2026-81486 | Medium | 5.3 | 2026-08-27 | A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function read_context of the file src/index.ts of the comp… |
CVE-2026-81485 | Medium | 5.3 | 2026-08-27 | A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this vulnerability is the function fs.readFileSync of the file s… |
CVE-2026-47862 | Medium | 5.4 | 2026-08-27 | An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive… |
CVE-2026-75333 | High | 7.5 | 2026-08-26 | yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File() for file system operations withou… |
CVE-2026-75328 | High | 7.5 | 2026-08-26 | In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnerability: |
CVE-2026-61792 | High | 7.7 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read fil… |
CVE-2026-63179 | Medium | 4.9 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose… |
CVE-2026-36851 | High | 7.5 | 2026-08-26 | Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration. |
CVE-2026-81030 | Medium | 6.5 | 2026-08-26 | Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/BrowserItemResource… |
CVE-2026-81028 | Medium | 4.9 | 2026-08-26 | ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The c… |
CVE-2026-54550 | High | 7.4 | 2026-08-26 | IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpac… |
CVE-2026-73102 | Medium | 5.7 | 2026-08-26 | RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied… |
CVE-2026-15990 | High | 7.5 | 2026-08-26 | The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This… |
CVE-2026-77757 | Medium | 5.4 | 2026-08-26 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference befor… |
CVE-2026-75797 | High | 7.7 | 2026-08-26 | The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forw… |
CVE-2026-57171 | High | 7.7 | 2026-08-26 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 throug… |
CVE-2026-32637 | | 2026-08-25 | Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who co… | |
CVE-2026-80104 | Critical | 9.8 | 2026-08-25 | DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/… |
CVE-2026-65092 | High | 8.5 | 2026-08-25 | NVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause a path traversal bypass of L7 REST network policy. A successful explo… |
CVE-2026-55557 | | 2026-08-25 | browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched response body to join(sa… | |
CVE-2026-19912 | Critical | 9.8 | 2026-08-25 | The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanit… |
CVE-2026-79781 | Medium | 6.5 | 2026-08-25 | rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in… |
CVE-2026-79773 | Medium | 4.9 | 2026-08-25 | Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets… |
CVE-2026-79676 | Medium | 5.9 | 2026-08-25 | NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.paths… |
CVE-2026-55540 | High | 7.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the wo… |
CVE-2026-55527 | High | 7.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller su… |
CVE-2026-79622 | High | 7.3 | 2026-08-25 | A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-… |
CVE-2026-78886 | Low | 3.7 | 2026-08-25 | A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controll… |
CVE-2026-57863 | High | 8.8 | 2026-08-25 | Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files o… |
CVE-2026-77139 | | 2026-08-25 | The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An auth… | |
CVE-2026-68062 | High | 8.5 | 2026-08-25 | SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows sy… |
CVE-2026-78638 | Low | 3.3 | 2026-08-25 | A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Ext… |
CVE-2026-78677 | High | 7.5 | 2026-08-25 | GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clo… |
CVE-2026-72697 | Medium | 6.5 | 2026-08-25 | Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authent… |
CVE-2026-72695 | High | 8.1 | 2026-08-25 | Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions… |
CVE-2026-34968 | High | 8.1 | 2026-08-25 | Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions bef… |
CVE-2026-78435 | Low | 3.8 | 2026-08-24 | A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsControlle… |
CVE-2026-78284 | High | 8.6 | 2026-08-24 | Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions. |
CVE-2026-71932 | Medium | 4.9 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient vali… |
CVE-2026-77914 | Medium | 6.5 | 2026-08-24 | rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames… |
CVE-2026-71364 | High | 7.2 | 2026-08-24 | A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining… |
CVE-2026-78381 | | 2026-08-24 | RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates… | |
CVE-2026-76842 | High | 8.2 | 2026-08-24 | The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural i… |
CVE-2026-32477 | High | 8.6 | 2026-08-24 | Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions. |
CVE-2026-28171 | High | 8.6 | 2026-08-24 | Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions. |
CVE-2026-28167 | High | 7.5 | 2026-08-24 | Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions. |
CVE-2026-66897 | Critical | 9.9 | 2026-08-24 | A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image… |
CVE-2026-78196 | Medium | 4.4 | 2026-08-24 | A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of… |
CVE-2026-10053 | High | 8.5 | 2026-08-23 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-18027 | Medium | 6.5 | 2026-08-23 | The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versio… |
CVE-2026-76606 | | 2026-08-22 | Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2. | |
CVE-2026-76598 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the ele… | |
CVE-2026-63312 | High | 7.5 | 2026-08-22 | NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() direc… |
CVE-2026-62384 | High | 7.5 | 2026-08-22 | NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus… |
CVE-2026-62383 | Medium | 5.5 | 2026-08-22 | nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirel… |
CVE-2026-71514 | Low | 2.5 | 2026-08-22 | NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the colu… |
CVE-2026-60084 | High | 8.7 | 2026-08-22 | SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path para… |
CVE-2026-48105 | | 2026-08-21 | Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`internal/cluster/raft/fsm.go:applyRegister… | |
CVE-2026-47735 | | 2026-08-21 | Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`)… | |
CVE-2026-64679 | High | 8.1 | 2026-08-21 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consisten… |
CVE-2026-45099 | | 2026-08-21 | Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts pat… | |
CVE-2026-44517 | Medium | 6.3 | 2026-08-21 | Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git rep… |
CVE-2026-71493 | | 2026-08-21 | Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths templa… | |
CVE-2026-62677 | High | 8.8 | 2026-08-21 | Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scop… |
CVE-2026-49114 | High | 7.1 | 2026-08-21 | In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writ… |
CVE-2026-77814 | High | 7.5 | 2026-08-21 | is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a… |
CVE-2026-76611 | | 2026-08-21 | Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66. | |
CVE-2026-75115 | | 2026-08-21 | Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerabl… | |
CVE-2026-77763 | Medium | 6.5 | 2026-08-21 | The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from path(key)… |
CVE-2026-77086 | Critical | 9.1 | 2026-08-21 | SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform pa… |
CVE-2026-77751 | | 2026-08-21 | A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are pas… | |
CVE-2026-69400 | Critical | 9.6 | 2026-08-20 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2026-49244 | Medium | 5.9 | 2026-08-20 | SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable shar… |
CVE-2026-17424 | Medium | 4.8 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security restrictions due to improper limitation of a pathname to a restr… |
CVE-2026-73040 | High | 8.8 | 2026-08-20 | Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, i… |
CVE-2026-64777 | Medium | 4.3 | 2026-08-20 | A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when i… |
CVE-2026-53584 | Medium | 4.3 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-73255 | Medium | 6.5 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences… |
CVE-2026-71492 | | 2026-08-20 | Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/director… | |
CVE-2026-61625 | Medium | 6.8 | 2026-08-20 | VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate back… |
CVE-2026-18274 | High | 7.2 | 2026-08-20 | Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2026-63490 | High | 7.5 | 2026-08-20 | Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader reso… |
CVE-2026-70383 | | 2026-08-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client. T… | |
CVE-2026-64967 | | 2026-08-20 | A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended lo… | |
CVE-2026-64966 | | 2026-08-20 | ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a special… | |
CVE-2026-64963 | | 2026-08-20 | A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE configuration op… | |
CVE-2026-77068 | High | 8.8 | 2026-08-20 | n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema l… |
CVE-2026-76832 | High | 8.8 | 2026-08-19 | Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files b… |
CVE-2026-76369 | Low | 2.7 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulner… |
CVE-2026-76359 | Medium | 6.5 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction… |
CVE-2026-76358 | Medium | 6.5 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended te… |
CVE-2026-76357 | High | 7.6 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer (REST)… |
CVE-2026-76337 | Medium | 5.3 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static direc… |
CVE-2026-76576 | Medium | 4.3 | 2026-08-19 | A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java… |
CVE-2026-18849 | Medium | 6.8 | 2026-08-19 | IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level a… |
CVE-2026-75593 | | 2026-08-19 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can pro… | |
CVE-2026-63188 | | 2026-08-19 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from pack… |