CWE-23 · Relative Path Traversal (page 2)
Page 2 of 6 — CVEs classified under CWE-23, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8650 | Medium | 4.5 | 2026-07-08 | Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0… |
CVE-2026-59996 | Medium | 4.2 | 2026-07-08 | scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations. |
CVE-2026-59995 | Medium | 4.2 | 2026-07-08 | sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server. |
CVE-2026-14476 | High | 8.0 | 2026-07-07 | A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LD… |
CVE-2026-57871 | | 2026-07-07 | Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects… | |
CVE-2025-53829 | High | 8.0 | 2026-07-06 | ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with administrative privileges can e… |
CVE-2026-58522 | Medium | 6.8 | 2026-07-03 | Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally. |
CVE-2026-57988 | High | 7.1 | 2026-07-03 | Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-44941 | High | 8.4 | 2026-07-02 | A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious reposito… |
CVE-2026-8387 | Low | 2.4 | 2026-07-01 | A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting `.zip` archives using the `ZipFile… |
CVE-2026-44948 | Medium | 4.9 | 2026-06-30 | A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0… |
CVE-2026-8023 | High | 7.5 | 2026-06-29 | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM is enabl… |
CVE-2026-25707 | High | 8.8 | 2026-06-29 | A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories t… |
CVE-2026-50016 | High | 8.8 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segm… |
CVE-2026-45188 | | 2026-06-25 | Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommended to upgrade to ve… | |
CVE-2026-54066 | High | 7.5 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitize… |
CVE-2026-52813 | Critical | 10.0 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and reposit… |
CVE-2026-41046 | High | 7.3 | 2026-06-22 | A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious config files for snapper… |
CVE-2026-49290 | | 2026-06-19 | Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal… | |
CVE-2026-10720 | | 2026-06-19 | Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster… | |
CVE-2026-8100 | | 2026-06-18 | Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific conditions. This issue… | |
CVE-2026-34026 | | 2026-06-15 | Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservi… | |
CVE-2026-48569 | High | 7.1 | 2026-06-09 | Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-47287 | Medium | 6.5 | 2026-06-09 | Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-48681 | Medium | 5.9 | 2026-06-04 | OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image. |
CVE-2026-5422 | High | 8.1 | 2026-06-02 | A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within… |
CVE-2026-10074 | Medium | 4.9 | 2026-05-29 | DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing privileged local attackers to exploit Relative Path Traversal to download… |
CVE-2026-10073 | High | 7.5 | 2026-05-29 | DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing unauthenticated local attackers to exploit Relative Path Traversal to down… |
CVE-2026-8326 | | 2026-05-29 | Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing arbitrary files in all directories as root. Th… | |
CVE-2025-41280 | High | 7.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers w… |
CVE-2025-41271 | High | 7.5 | 2026-05-29 | Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that… |
CVE-2025-41268 | Critical | 9.1 | 2026-05-29 | Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R250217104… |
CVE-2025-48977 | Medium | 6.5 | 2026-05-28 | Relative Path Traversal vulnerability in Apache Ignite REST API. Authenticated REST API users can read any file on the server with "cmd=log" command and a log… |
CVE-2026-8361 | High | 7.5 | 2026-05-27 | A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome |
CVE-2026-48126 | High | 8.2 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --dom… |
CVE-2026-8134 | High | 7.2 | 2026-05-21 | Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type compose… |
CVE-2026-34926 | Medium | 6.7 | 2026-05-21 | A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to i… |
CVE-2026-23734 | | 2026-05-20 | XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs… | |
CVE-2026-8073 | High | 7.5 | 2026-05-19 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path val… |
CVE-2026-41948 | Critical | 9.4 | 2026-05-18 | Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's in… |
CVE-2026-41612 | Medium | 5.5 | 2026-05-12 | Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally. |
CVE-2026-41551 | Critical | 9.1 | 2026-05-12 | A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properl… |
CVE-2026-8209 | | 2026-05-09 | Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed… | |
CVE-2026-29201 | High | 8.6 | 2026-05-08 | Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is p… |
CVE-2026-43533 | High | 8.6 | 2026-05-05 | OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the int… |
CVE-2026-43616 | High | 7.1 | 2026-05-04 | Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by crafting malicious arc… |
CVE-2026-42085 | Medium | 4.3 | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3… |
CVE-2026-22070 | High | 7.1 | 2026-04-30 | ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal. |
CVE-2026-7404 | High | 7.3 | 2026-04-29 | A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0. Affected is the function delete_shared_prompt of the file src/mcpo_simple_serve… |
CVE-2026-33733 | High | 7.2 | 2026-04-22 | EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-control… |
CVE-2026-5966 | High | 8.1 | 2026-04-20 | ThreatSonar Anti-Ransomware developed by TeamT5 has an Arbitrary File Deletion vulnerability. Authenticated remote attackers with web access can exploit Path T… |
CVE-2026-31927 | Medium | 4.9 | 2026-04-17 | Anviz CX7 Firmware is vulnerable to an authenticated CSV upload which allows path traversal to overwrite arbitrary files (e.g., /etc/shadow), enabling unauthor… |
CVE-2026-33435 | High | 8.0 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to… |
CVE-2026-20081 | Medium | 6.5 | 2026-04-15 | Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To e… |
CVE-2026-20078 | Medium | 6.5 | 2026-04-15 | Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To e… |
CVE-2026-39814 | Medium | 6.7 | 2026-04-14 | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.12, FortiWeb 7.2.7 t… |
CVE-2025-24819 | Medium | 5.7 | 2026-04-07 | Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system in Software Manager… |
CVE-2026-27489 | High | 7.5 | 2026-04-01 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via syml… |
CVE-2026-32725 | High | 8.3 | 2026-03-31 | SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypa… |
CVE-2026-31831 | High | 7.5 | 2026-03-30 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable… |
CVE-2026-4415 | High | 8.1 | 2026-03-30 | Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is enabled, unauthenticated remote attackers… |
CVE-2026-33206 | Medium | 6.3 | 2026-03-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a path traversal vulnerability exi… |
CVE-2026-33494 | Critical | 10.0 | 2026-03-26 | ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior… |
CVE-2026-27625 | High | 8.1 | 2026-03-20 | Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf en… |
CVE-2026-29101 | Medium | 4.9 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a Denial-of-Servi… |
CVE-2026-29098 | Medium | 4.9 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `action_expor… |
CVE-2026-30345 | High | 7.5 | 2026-03-18 | A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the intended directori… |
CVE-2026-29778 | High | 7.1 | 2026-03-07 | pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insuff… |
CVE-2026-21659 | Critical | 9.8 | 2026-02-27 | Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD … |
CVE-2025-62878 | Critical | 9.9 | 2026-02-25 | A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensiti… |
CVE-2026-27117 | Medium | 5.5 | 2026-02-24 | bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.11, a path traversal vulnerability (… |
CVE-2026-27202 | High | 7.5 | 2026-02-21 | GetSimple CMS is a content management system. All versions of GetSimple CMS have a flaw in the Uploaded Files feature that allows for arbitrary file reads. Thi… |
CVE-2026-2818 | High | 8.2 | 2026-02-20 | A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction di… |
CVE-2026-21620 | | 2026-02-20 | Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file mod… | |
CVE-2026-26362 | High | 8.1 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentiall… |
CVE-2025-58467 | Medium | 6.5 | 2026-02-11 | A relative path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnera… |
CVE-2026-1762 | Low | 2.9 | 2026-02-10 | A vulnerability in GE Vernova Enervista UR Setup on Windows allows File Manipulation.This issue affects Enervista: 8.6 and prior versions. |
CVE-2026-25951 | High | 7.2 | 2026-02-09 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticat… |
CVE-2026-25057 | Critical | 9.1 | 2026-02-09 | MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assig… |
CVE-2025-22873 | Low | 3.8 | 2026-02-04 | It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the par… |
CVE-2026-25575 | High | 7.5 | 2026-02-04 | NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path traversal vulnerability in the propose… |
CVE-2026-25121 | High | 7.5 | 2026-02-04 | apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was di… |
CVE-2026-24909 | Medium | 5.9 | 2026-01-27 | vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction. |
CVE-2026-23890 | Medium | 6.5 | 2026-01-26 | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable sh… |
CVE-2026-23888 | Medium | 6.5 | 2026-01-26 | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside t… |
CVE-2026-1022 | High | 7.5 | 2026-01-16 | Statistics Database System developed by Gotac has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Trav… |
CVE-2025-68472 | High | 8.1 | 2026-01-12 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload… |
CVE-2025-67366 | High | 7.5 | 2026-01-07 | @sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path tr… |
CVE-2025-15225 | High | 7.5 | 2025-12-29 | WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitr… |
CVE-2025-66737 | Medium | 4.3 | 2025-12-26 | Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged attacker can read arbitrary files via a crafted request resul… |
CVE-2025-57403 | High | 7.5 | 2025-12-26 | Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL (or a p… |
CVE-2025-15015 | High | 7.5 | 2025-12-22 | Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traver… |
CVE-2025-66626 | High | 8.1 | 2025-12-09 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 t… |
CVE-2025-62552 | High | 7.8 | 2025-12-09 | Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally. |
CVE-2016-20023 | Medium | 5.0 | 2025-12-05 | In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided. |
CVE-2025-12097 | High | 7.5 | 2025-12-04 | There is a relative path traversal vulnerability in the NI System Web Server that may result in information disclosure. Successful exploitation requires an at… |
CVE-2025-13771 | Medium | 6.5 | 2025-11-28 | WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arb… |
CVE-2025-66386 | Medium | 4.1 | 2025-11-28 | app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin. |
CVE-2024-47856 | Critical | 9.8 | 2025-11-24 | In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or more spaces and is not… |
CVE-2025-40605 | Medium | 5.3 | 2025-11-20 | A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted dire… |