CWE-22 · Path Traversal (page 7)
Page 7 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11595 | Medium | 4.3 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help s… |
CVE-2026-58372 | High | 8.1 | 2026-06-30 | SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write… |
CVE-2026-58173 | Medium | 6.5 | 2026-06-30 | Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying… |
CVE-2026-58171 | Medium | 4.2 | 2026-06-30 | Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in ru… |
CVE-2026-58170 | High | 8.3 | 2026-06-30 | Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitizat… |
CVE-2026-58166 | Critical | 9.1 | 2026-06-30 | OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete… |
CVE-2026-48314 | Medium | 6.5 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |
CVE-2026-48313 | Critical | 9.3 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |
CVE-2026-48282 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |
CVE-2026-58015 | Medium | 5.9 | 2026-06-30 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context param… |
CVE-2026-57079 | Medium | 5.3 | 2026-06-30 | Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadata. Net::BitTorrent valida… |
CVE-2026-11367 | Medium | 6.5 | 2026-06-30 | The PixMagix – WordPress Image Editor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.2 via the move_image_… |
CVE-2026-58302 | High | 8.4 | 2026-06-30 | rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen() by u… |
CVE-2026-8023 | High | 7.5 | 2026-06-29 | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM is enabl… |
CVE-2026-43732 | Medium | 6.5 | 2026-06-29 | A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6… |
CVE-2026-36848 | High | 7.5 | 2026-06-29 | Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem. |
CVE-2026-11720 | Critical | 9.1 | 2026-06-29 | A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder subst… |
CVE-2026-13748 | Medium | 6.3 | 2026-06-29 | Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowfla… |
CVE-2026-57331 | Critical | 9.9 | 2026-06-29 | Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions. |
CVE-2026-55607 | High | 8.8 | 2026-06-29 | Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to… |
CVE-2026-40521 | High | 8.8 | 2026-06-29 | FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary… |
CVE-2026-57346 | High | 7.1 | 2026-06-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Epiphyt Embed Privacy allows Path Traversal. This issue affect… |
CVE-2026-57966 | Medium | 4.4 | 2026-06-29 | A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on t… |
CVE-2026-13528 | High | 7.3 | 2026-06-29 | A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.04-jdk8-SNAPSHOT. The impacted element is the function generateUploadPath of the fil… |
CVE-2026-13509 | Medium | 6.3 | 2026-06-28 | A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.upload_file/FileHandler.remove_file of the file src/ragapp/backend/c… |
CVE-2026-13503 | Medium | 5.3 | 2026-06-28 | A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/… |
CVE-2026-28701 | Critical | 9.8 | 2026-06-26 | Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate ar… |
CVE-2026-49984 | High | 7.7 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for… |
CVE-2026-45807 | High | 7.7 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client… |
CVE-2026-54352 | Critical | 9.6 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-upl… |
CVE-2026-49991 | High | 8.6 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploi… |
CVE-2026-29509 | Medium | 5.4 | 2026-06-26 | Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.1… |
CVE-2026-56876 | High | 8.1 | 2026-06-26 | extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like… |
CVE-2026-54557 | Medium | 5.5 | 2026-06-26 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw re… |
CVE-2026-55677 | High | 7.5 | 2026-06-26 | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the… |
CVE-2026-57321 | High | 7.1 | 2026-06-26 | Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions. |
CVE-2026-56066 | Medium | 5.8 | 2026-06-26 | Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions. |
CVE-2026-13426 | Medium | 5.4 | 2026-06-26 | The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths w… |
CVE-2025-64152 | Critical | 9.1 | 2026-06-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 befo… |
CVE-2025-55017 | Critical | 9.1 | 2026-06-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 befo… |
CVE-2026-57872 | High | 7.5 | 2026-06-26 | An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is cau… |
CVE-2026-40084 | Medium | 6.5 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file… |
CVE-2026-56445 | Critical | 9.1 | 2026-06-25 | The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowin… |
CVE-2026-55667 | High | 8.2 | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a sc… |
CVE-2026-54917 | Critical | 10.0 | 2026-06-25 | SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST cat… |
CVE-2026-54250 | Medium | 5.8 | 2026-06-25 | K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in… |
CVE-2026-54094 | High | 7.5 | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it d… |
CVE-2026-54093 | | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, fileb… | |
CVE-2026-53925 | High | 7.8 | 2026-06-25 | Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_popen() function in glances/secure.py interprets > (file re… |
CVE-2026-50548 | Critical | 9.8 | 2026-06-25 | Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write… |
CVE-2026-55700 | High | 7.1 | 2026-06-25 | pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A… |
CVE-2026-55699 | Medium | 6.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin object keys such as "", ".", and ".." passed pnpm's bin-name guard. When a malicious packa… |
CVE-2026-50015 | High | 7.3 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package) performs no path validation on file paths extra… |
CVE-2026-9083 | Medium | 4.9 | 2026-06-25 | A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a… |
CVE-2026-55439 | Medium | 5.5 | 2026-06-25 | Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrato… |
CVE-2026-55092 | High | 7.5 | 2026-06-25 | Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact man… |
CVE-2026-45233 | High | 8.1 | 2026-06-25 | HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying dir… |
CVE-2026-48944 | Medium | 6.5 | 2026-06-25 | The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::copy()`. `JP… |
CVE-2026-56122 | High | 7.5 | 2026-06-25 | Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GE… |
CVE-2026-56054 | High | 7.7 | 2026-06-25 | Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions. |
CVE-2026-49506 | High | 7.2 | 2026-06-25 | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabil… |
CVE-2026-8662 | Low | 3.3 | 2026-06-25 | Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to uni… |
CVE-2026-9154 | High | 7.1 | 2026-06-25 | Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrar… |
CVE-2026-9153 | Medium | 6.5 | 2026-06-25 | Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read arbitrary files via the expression parame… |
CVE-2026-39938 | Critical | 9.8 | 2026-06-24 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC seri… |
CVE-2026-39899 | Medium | 5.3 | 2026-06-24 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal via filename parameter in packag… |
CVE-2026-9778 | High | 7.2 | 2026-06-24 | ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-9777 | High | 7.2 | 2026-06-24 | ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-9776 | High | 7.5 | 2026-06-24 | ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sen… |
CVE-2026-9775 | Medium | 6.5 | 2026-06-24 | ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affect… |
CVE-2026-9774 | Medium | 6.5 | 2026-06-24 | ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on af… |
CVE-2026-54066 | High | 7.5 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitize… |
CVE-2026-53766 | Medium | 6.1 | 2026-06-24 | Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpContext.validate… |
CVE-2026-52811 | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only on the leaf of the upload target (osx.I… | |
CVE-2026-52797 | High | 8.5 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.0, as an authorized user, an intruder can dictate the value which is passed to the git diff comma… |
CVE-2026-31978 | Medium | 6.5 | 2026-06-24 | motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion detection. Versions prior to 0.44.0 are vulnerab… |
CVE-2026-49247 | High | 8.8 | 2026-06-24 | Jellyfin is an open source self hosted media server. From 10.9.0 until 10.11.10, the POST /ClientLog/Document endpoint accepts the Authorization header's Clien… |
CVE-2026-49246 | | 2026-06-24 | Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forged filename tags can be leveraged to exp… | |
CVE-2026-48789 | Medium | 4.3 | 2026-06-24 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, on Windows, the do… |
CVE-2026-44022 | Medium | 5.5 | 2026-06-24 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.73.0 until 2.91.0, he LaT… |
CVE-2026-44017 | High | 7.5 | 2026-06-24 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.91.0, the EasyOCR mod… |
CVE-2026-55488 | | 2026-06-24 | motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Versions prior to… | |
CVE-2026-57296 | High | 8.8 | 2026-06-24 | Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate… |
CVE-2026-47385 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source poi… | |
CVE-2026-48020 | Critical | 10.0 | 2026-06-23 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middle… |
CVE-2026-54319 | Medium | 4.2 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume reference (volumeI… |
CVE-2026-54014 | Medium | 4.3 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, a path traversal vulnerability exists in ope… |
CVE-2026-52844 | High | 7.5 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private… |
CVE-2026-49406 | Medium | 5.5 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: "manual"), the module resolver did… |
CVE-2026-49465 | High | 7.7 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows… |
CVE-2026-42867 | Medium | 6.5 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases… |
CVE-2026-11940 | | 2026-06-23 | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name tha… | |
CVE-2026-56258 | High | 8.1 | 2026-06-23 | Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files o… |
CVE-2026-55443 | Medium | 5.1 | 2026-06-22 | LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand… |
CVE-2026-54293 | High | 7.5 | 2026-06-22 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Proc… |
CVE-2026-53779 | High | 7.5 | 2026-06-22 | WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG… |
CVE-2026-54286 | Medium | 5.9 | 2026-06-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the req… |
CVE-2026-53571 | High | 7.5 | 2026-06-22 | Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be retur… |
CVE-2026-49356 | Low | 3.2 | 2026-06-22 | Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingU… |
CVE-2026-12479 | Medium | 6.1 | 2026-06-22 | A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method within the Keras 3 model saving and loa… |