CWE-23 · Relative Path Traversal (page 3)
Page 3 of 5 — CVEs classified under CWE-23, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24343 | Medium | 5.4 | 2025-04-30 | A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arb… |
CVE-2023-35816 | Low | 3.5 | 2025-04-28 | DevExpress before 23.1.3 allows arbitrary TypeConverter conversion. |
CVE-2025-46433 | Medium | 4.9 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible |
CVE-2025-43016 | Medium | 5.4 | 2025-04-25 | In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session |
CVE-2025-27791 | | 2025-04-15 | Collabora Online is a collaborative online office suite based on LibreOffice technology. In versions prior to 24.04.12.4, 23.05.19, and 22.05.25, there is a pa… | |
CVE-2025-32017 | High | 8.8 | 2025-04-08 | Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that e… |
CVE-2025-32409 | High | 8.1 | 2025-04-07 | Ratta SuperNote A6 X2 Nomad before December 2024 allows remote code execution because an arbitrary firmware image (signed with debug keys) can be sent to TCP p… |
CVE-2025-32137 | Medium | 4.9 | 2025-04-04 | Relative Path Traversal vulnerability in Cristián Lávaque s2Member s2member allows Path Traversal.This issue affects s2Member: from n/a through <= 250419. |
CVE-2023-40714 | Critical | 9.9 | 2025-04-02 | A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege vi… |
CVE-2025-2007 | High | 8.1 | 2025-04-01 | The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the… |
CVE-2025-2961 | Medium | 4.3 | 2025-03-30 | A vulnerability classified as problematic was found in opensolon up to 3.1.0. This vulnerability affects the function render_mav of the file /aa of the compone… |
CVE-2025-29789 | High | 7.5 | 2025-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.3.0 are vulnerable to Directory Tr… |
CVE-2025-27553 | High | 7.5 | 2025-03-23 | Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' p… |
CVE-2024-9363 | High | 7.5 | 2025-03-20 | An unauthorized file deletion vulnerability exists in the latest version of the Polyaxon platform, which can lead to denial of service by terminating critical… |
CVE-2024-8551 | Critical | 9.1 | 2025-03-20 | A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerabili… |
CVE-2024-7058 | Medium | 4.4 | 2025-03-20 | A vulnerability in the sanitize_path function in parisneo/lollms-webui v10 - latest allows an attacker to bypass path sanitization by using relative paths such… |
CVE-2024-6583 | Medium | 4.3 | 2025-03-20 | A path traversal vulnerability exists in the latest version of stangirard/quivr. This vulnerability allows an attacker to upload files to arbitrary paths in an… |
CVE-2024-6483 | Medium | 5.3 | 2025-03-20 | A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The… |
CVE-2024-10513 | High | 7.2 | 2025-03-20 | A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. Thi… |
CVE-2024-8510 | Medium | 5.3 | 2025-03-17 | N-central is vulnerable to a path traversal that allows unintended access to the Apache Tomcat WEB-INF directory. Customer data is not exposed. This vulnerab… |
CVE-2024-54449 | High | 8.8 | 2025-03-14 | The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with contro… |
CVE-2024-12019 | | 2025-03-14 | The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlyin… | |
CVE-2025-2056 | High | 7.5 | 2025-03-14 | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the… |
CVE-2025-23360 | High | 7.1 | 2025-03-11 | NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successful exploit of this v… |
CVE-2025-26645 | High | 8.8 | 2025-03-11 | Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2025-27610 | High | 7.5 | 2025-03-10 | Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the spec… |
CVE-2025-23410 | Critical | 9.8 | 2025-03-05 | When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supp… |
CVE-2025-25130 | High | 7.5 | 2025-03-03 | Relative Path Traversal vulnerability in Shah Alom Delete Comments By Status delete-comments-by-status allows Path Traversal.This issue affects Delete Comments… |
CVE-2025-27410 | Medium | 6.5 | 2025-02-28 | PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's… |
CVE-2024-56340 | Medium | 6.5 | 2025-02-28 | IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by inserting… |
CVE-2024-47051 | Critical | 9.1 | 2025-02-26 | This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticate… |
CVE-2025-1599 | Medium | 5.4 | 2025-02-24 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been rated as problematic. Affected by this issue is some unknown funct… |
CVE-2025-1588 | Medium | 6.5 | 2025-02-23 | A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ad… |
CVE-2025-1584 | Medium | 4.3 | 2025-02-23 | A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-we… |
CVE-2025-20059 | Critical | 9.1 | 2025-02-20 | Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through… |
CVE-2025-0822 | Medium | 6.5 | 2025-02-15 | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible fo… |
CVE-2024-13791 | Medium | 4.9 | 2025-02-14 | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes… |
CVE-2025-26349 | High | 7.2 | 2025-02-12 | A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker… |
CVE-2025-1086 | Medium | 5.3 | 2025-02-07 | A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown code of the file /s… |
CVE-2024-54462 | High | 7.1 | 2025-01-29 | The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in case… |
CVE-2024-54461 | High | 7.1 | 2025-01-29 | The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cas… |
CVE-2024-52012 | Medium | 5.4 | 2025-01-27 | Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of in… |
CVE-2025-23011 | High | 8.8 | 2025-01-23 | Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted a… |
CVE-2024-46664 | Medium | 5.5 | 2025-01-14 | A relative path traversal in Fortinet FortiRecorder [CWE-23] version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to read files from the u… |
CVE-2024-32115 | Medium | 5.5 | 2025-01-14 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete… |
CVE-2025-0390 | Medium | 5.3 | 2025-01-11 | A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of th… |
CVE-2025-0225 | Medium | 4.3 | 2025-01-05 | A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is an unk… |
CVE-2024-13130 | Medium | 4.3 | 2025-01-05 | A vulnerability was found in Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z and IPC-HDW1200S up to 20241222. It has been rated as problematic. Affected by… |
CVE-2024-12897 | Medium | 4.3 | 2024-12-23 | A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222. It has been classified as critical. This affec… |
CVE-2023-34990 | Critical | 9.8 | 2024-12-18 | A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via… |
CVE-2024-12645 | Medium | 6.5 | 2024-12-16 | The topm-client from Chunghwa Telecom has an Arbitrary File Read vulnerability. The application sets up a simple local web server and provides APIs for communi… |
CVE-2024-12642 | High | 8.1 | 2024-12-16 | TenderDocTransfer from Chunghwa Telecom has an Arbitrary File Write vulnerability. The application sets up a simple local web server and provides APIs for comm… |
CVE-2024-49062 | Medium | 6.5 | 2024-12-12 | Microsoft SharePoint Information Disclosure Vulnerability |
CVE-2024-12482 | Medium | 4.3 | 2024-12-12 | A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been rated as problematic. Affected by this issue is the function backup of the file wetech-cm… |
CVE-2024-54154 | High | 8.0 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox |
CVE-2024-11315 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11314 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11313 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11312 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11311 | Critical | 9.8 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to uploa… |
CVE-2024-11310 | High | 7.5 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. |
CVE-2024-11309 | High | 7.5 | 2024-11-18 | The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. |
CVE-2024-35274 | Low | 2.3 | 2024-11-12 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortin… |
CVE-2024-32116 | Medium | 5.1 | 2024-11-12 | Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 th… |
CVE-2024-11067 | High | 7.5 | 2024-11-11 | The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system… |
CVE-2024-50453 | High | 7.5 | 2024-10-28 | Relative Path Traversal vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elemento… |
CVE-2024-10200 | High | 7.5 | 2024-10-21 | Administrative Management System from Wellchoose has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to… |
CVE-2024-49253 | High | 8.6 | 2024-10-16 | Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: fro… |
CVE-2024-47637 | High | 8.8 | 2024-10-16 | Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from… |
CVE-2024-9983 | High | 7.5 | 2024-10-15 | Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerabil… |
CVE-2024-45731 | High | 8.0 | 2024-10-14 | In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could wri… |
CVE-2024-9923 | Medium | 4.9 | 2024-10-14 | The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitr… |
CVE-2024-9922 | High | 7.5 | 2024-10-14 | The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerabilit… |
CVE-2024-6985 | Medium | 4.4 | 2024-10-11 | A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any f… |
CVE-2024-43614 | Medium | 5.5 | 2024-10-08 | Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally. |
CVE-2024-47949 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location |
CVE-2024-47948 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups |
CVE-2024-47769 | High | 7.5 | 2024-10-04 | IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is id… |
CVE-2024-20449 | High | 8.8 | 2024-10-02 | A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code o… |
CVE-2024-9405 | Medium | 5.3 | 2024-10-01 | An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attac… |
CVE-2024-45816 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in t… |
CVE-2024-43454 | High | 7.1 | 2024-09-10 | Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability |
CVE-2024-38258 | Medium | 6.5 | 2024-09-10 | Windows Remote Desktop Licensing Service Information Disclosure Vulnerability |
CVE-2024-43399 | High | 8.0 | 2024-08-19 | Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Befor… |
CVE-2024-7693 | High | 7.5 | 2024-08-12 | Raiden MAILD Remote Management System from Team Johnlong Software has a Relative Path Traversal vulnerability, allowing unauthenticated remote attackers to rea… |
CVE-2024-6433 | High | 7.5 | 2024-07-10 | The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted p… |
CVE-2024-3122 | Medium | 4.9 | 2024-07-01 | CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privile… |
CVE-2024-5547 | High | 7.5 | 2024-06-27 | A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vuln… |
CVE-2024-37138 | Medium | 4.1 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerability. A remote high p… |
CVE-2024-3497 | High | 8.8 | 2024-06-14 | Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the af… |
CVE-2024-2461 | | 2024-06-11 | If exploited an attacker could traverse the file system to access files or directories that would otherwise be inaccessible | |
CVE-2024-4330 | Low | 3.3 | 2024-05-30 | A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to imprope… |
CVE-2024-36362 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible |
CVE-2024-35186 | High | 8.8 | 2024-05-23 | gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A speci… |
CVE-2023-3941 | Critical | 10.0 | 2024-05-21 | Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system with root privileges. This issue affec… |
CVE-2023-3940 | High | 7.5 | 2024-05-21 | Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system. This issue affects ZkTeco-based OEM… |
CVE-2024-33615 | High | 8.8 | 2024-05-15 | A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel server, which allows file writing to the ser… |
CVE-2024-30010 | High | 8.8 | 2024-05-14 | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2024-34712 | Medium | 6.5 | 2024-05-14 | Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBan` is not url-encod… |
CVE-2024-0549 | High | 8.1 | 2024-04-16 | mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and f… |