CVE-2026-73573 | Low | 3.1 | 2026-08-13 | In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper vali… |
CVE-2026-48047 | | | 2026-08-07 | XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3… |
CVE-2026-66140 | High | 8.4 | 2026-07-24 | Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-n… |
CVE-2026-46687 | | | 2026-07-16 | Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_co… |
CVE-2026-44942 | Medium | 6.5 | 2026-06-18 | A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by a… |
CVE-2026-49103 | | | 2026-05-27 | Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi. |
CVE-2026-22810 | High | 8.2 | 2026-05-18 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vuln… |
CVE-2026-33431 | Medium | 6.5 | 2026-04-20 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config/<service>/show API endpoint a… |
CVE-2026-40318 | High | 8.5 | 2026-04-16 | SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesys… |
CVE-2026-41082 | High | 7.3 | 2026-04-16 | In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. |
CVE-2026-39813 | Critical | 9.8 | 2026-04-14 | A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of… |
CVE-2024-43035 | Medium | 5.8 | 2026-03-05 | Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in ser… |
CVE-2026-28538 | Medium | 5.9 | 2026-03-05 | Path traversal vulnerability in the certificate management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-28427 | High | 7.5 | 2026-03-04 | OpenDeck is Linux software for your Elgato Stream Deck. Prior to 2.8.1, the service listening on port 57118 serves static files for installed plugins but does… |
CVE-2026-21857 | Medium | 6.5 | 2026-01-07 | REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webro… |
CVE-2025-67364 | High | 7.5 | 2026-01-07 | fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability ari… |
CVE-2026-21436 | Medium | 5.5 | 2026-01-01 | eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `--destdir`. This re… |
CVE-2025-68430 | Medium | 4.3 | 2025-12-19 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT… |
CVE-2025-67845 | Medium | 6.4 | 2025-12-19 | A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web s… |
CVE-2025-61318 | Critical | 9.1 | 2025-12-08 | Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php componen… |
CVE-2025-51661 | High | 7.5 | 2025-11-19 | A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use local filesystem storag… |
CVE-2025-13199 | Medium | 5.3 | 2025-11-15 | A vulnerability was found in code-projects Email Logging Interface 2.0. Affected is an unknown function of the file signup.cpp. The manipulation of the argumen… |
CVE-2025-63298 | High | 8.2 | 2025-10-30 | A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php component. An authen… |
CVE-2023-53691 | High | 8.3 | 2025-10-22 | Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as… |
CVE-2025-60344 | High | 8.6 | 2025-10-21 | A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used f… |
CVE-2025-57618 | High | 7.3 | 2025-10-14 | A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to read arbitrary files on the server. By leveraging this vulnerability… |
CVE-2025-57563 | Medium | 6.5 | 2025-10-14 | A path traversal in StarNet Communications Corporation FastX v.4 through v4.1.51 allows unauthenticated attackers to read arbitrary files. |
CVE-2025-61189 | Medium | 6.3 | 2025-10-01 | Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers… |
CVE-2025-61188 | Medium | 6.3 | 2025-10-01 | Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whiteliste… |
CVE-2025-59342 | | | 2025-09-17 | esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP h… |
CVE-2025-59049 | High | 7.5 | 2025-09-10 | Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented… |
CVE-2025-26427 | Medium | 4.4 | 2025-09-04 | In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local escalation of privilege with no addition… |
CVE-2025-56760 | Medium | 4.3 | 2025-09-03 | When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in t… |
CVE-2025-46094 | Low | 3.8 | 2025-08-04 | LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript. |
CVE-2025-44962 | Medium | 5.0 | 2025-08-04 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files. |
CVE-2025-54769 | High | 8.8 | 2025-07-29 | An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This ca… |
CVE-2025-45582 | Medium | 4.1 | 2025-07-11 | GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an… |
CVE-2025-53513 | High | 8.8 | 2025-07-08 | The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Upload… |
CVE-2025-48050 | High | 7.5 | 2025-05-15 | In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier… |
CVE-2025-47423 | Medium | 5.8 | 2025-05-07 | Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to… |
CVE-2025-27920 | High | 7.2 | 2025-05-05 | Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attack… |
CVE-2025-46646 | Medium | 4.5 | 2025-04-26 | In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix f… |
CVE-2024-53636 | Medium | 6.4 | 2025-04-26 | An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbit… |
CVE-2025-43928 | Medium | 5.8 | 2025-04-20 | In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username fi… |
CVE-2025-43919 | Medium | 5.8 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/ma… |
CVE-2025-32807 | Medium | 5.3 | 2025-04-11 | A path traversal vulnerability in FusionDirectory before 1.5 allows remote attackers to read arbitrary files on the host that end with .png (and .svg or .xpm f… |
CVE-2025-2961 | Medium | 4.3 | 2025-03-30 | A vulnerability classified as problematic was found in opensolon up to 3.1.0. This vulnerability affects the function render_mav of the file /aa of the compone… |
CVE-2025-30343 | Low | 3.0 | 2025-03-21 | A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface all… |
CVE-2025-1599 | Medium | 5.4 | 2025-02-24 | A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been rated as problematic. Affected by this issue is some unknown funct… |
CVE-2025-1588 | Medium | 6.5 | 2025-02-23 | A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ad… |
CVE-2025-1584 | Medium | 4.3 | 2025-02-23 | A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-we… |
CVE-2025-1086 | Medium | 5.3 | 2025-02-07 | A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown code of the file /s… |
CVE-2025-0390 | Medium | 5.3 | 2025-01-11 | A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of th… |
CVE-2024-13130 | Medium | 4.3 | 2025-01-05 | A vulnerability was found in Dahua IPC-HFW1200S, IPC-HFW2300R-Z, IPC-HFW5220E-Z and IPC-HDW1200S up to 20241222. It has been rated as problematic. Affected by… |
CVE-2024-12897 | Medium | 4.3 | 2024-12-23 | A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222. It has been classified as critical. This affec… |
CVE-2024-12482 | Medium | 4.3 | 2024-12-12 | A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2. It has been rated as problematic. Affected by this issue is the function backup of the file wetech-cm… |
CVE-2022-20656 | Medium | 6.5 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco PI and Cisco EPNM could allow an authenticated, remote attacker to conduct a path trav… |
CVE-2024-10379 | Medium | 4.3 | 2024-10-25 | A vulnerability classified as problematic was found in ESAFENET CDG 5. Affected by this vulnerability is the function actionViewDecyptFile of the file /com/esa… |
CVE-2024-6786 | Medium | 6.5 | 2024-09-21 | The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system… |
CVE-2024-8409 | Medium | 4.3 | 2024-09-04 | A vulnerability classified as problematic has been found in ABCD ABCD2 up to 2.2.0-beta-1. This affects an unknown part of the file /common/show_image.php. The… |
CVE-2024-37403 | Medium | 5.5 | 2024-08-07 | Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting i… |
CVE-2024-23657 | High | 8.8 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the `getTex… |
CVE-2024-6746 | Medium | 4.3 | 2024-07-15 | A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-4790 | Medium | 4.3 | 2024-05-14 | A vulnerability classified as problematic has been found in DedeCMS 5.7.114. This affects an unknown part of the file /sys_verifies.php?action=view. The manipu… |
CVE-2024-3686 | Medium | 4.3 | 2024-04-12 | A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file up… |
CVE-2024-3227 | Medium | 4.7 | 2024-04-03 | A vulnerability was found in Panwei eoffice OA up to 9.5. It has been declared as critical. This vulnerability affects unknown code of the file /general/system… |
CVE-2024-3218 | Medium | 5.4 | 2024-04-03 | A vulnerability classified as critical has been found in Shibang Communications IP Network Intercom Broadcasting System 1.0. This affects an unknown part of th… |
CVE-2024-2825 | Medium | 6.3 | 2024-03-22 | A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /ureport/designer/saveRep… |
CVE-2024-22079 | High | 7.5 | 2024-03-20 | An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Directory traversal can occur via the system logs download mechanism. |
CVE-2024-2564 | Medium | 6.3 | 2024-03-17 | A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the file /apps/system/api… |
CVE-2024-2563 | Medium | 5.4 | 2024-03-17 | A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /a… |
CVE-2024-2318 | Medium | 4.3 | 2024-03-08 | A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /… |
CVE-2024-1459 | Medium | 5.3 | 2024-02-12 | A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an a… |
CVE-2024-0989 | Medium | 5.4 | 2024-01-29 | A vulnerability, which was classified as problematic, has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this issue is the function del… |
CVE-2024-0882 | Medium | 4.3 | 2024-01-25 | A vulnerability was found in qwdigital LinkWechat 5.1.0. It has been classified as problematic. This affects an unknown part of the file /linkwechat-api/common… |
CVE-2023-52076 | High | 8.5 | 2024-01-25 | Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists… |
CVE-2024-0465 | Low | 3.5 | 2024-01-12 | A vulnerability classified as problematic was found in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2024-0417 | Medium | 5.4 | 2024-01-11 | A vulnerability, which was classified as critical, was found in DeShang DSShop up to 2.1.5. This affects an unknown part of the file application/home/controlle… |
CVE-2024-0416 | Medium | 5.4 | 2024-01-11 | A vulnerability, which was classified as critical, has been found in DeShang DSMall up to 5.0.3. Affected by this issue is some unknown functionality of the fi… |
CVE-2023-6699 | Critical | 9.1 | 2024-01-11 | The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the… |
CVE-2024-0354 | Medium | 5.3 | 2024-01-10 | A vulnerability, which was classified as critical, has been found in unknown-o download-station up to 1.1.8. This issue affects some unknown processing of the… |
CVE-2024-0341 | Low | 3.5 | 2024-01-09 | A vulnerability was found in Inis up to 2.0.1. It has been rated as problematic. This issue affects some unknown processing of the file /app/api/controller/def… |
CVE-2023-7134 | Medium | 6.3 | 2023-12-28 | A vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipu… |
CVE-2023-7098 | Low | 3.1 | 2023-12-25 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3. This vulnerability affects unknown code of the f… |
CVE-2023-7058 | Medium | 6.3 | 2023-12-22 | A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as critical. Affected by this vulnerability is an unknow… |
CVE-2023-7041 | Medium | 5.4 | 2023-12-21 | A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this issue is some unknown functionali… |
CVE-2023-7040 | Medium | 4.3 | 2023-12-21 | A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown functionality of th… |
CVE-2023-6900 | Medium | 4.6 | 2023-12-17 | A vulnerability, which was classified as critical, has been found in rmountjoy92 DashMachine 0.5-4. Affected by this issue is some unknown functionality of the… |
CVE-2018-25094 | Low | 3.5 | 2023-12-03 | A vulnerability was found in ระบบบัญชีออนไลน์ Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of… |
CVE-2023-4171 | Medium | 4.3 | 2023-08-05 | A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code… |
CVE-2023-3240 | Low | 3.5 | 2023-06-14 | A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersN… |
CVE-2023-3239 | Low | 3.5 | 2023-06-14 | A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQr… |
CVE-2023-3098 | Medium | 4.4 | 2023-06-05 | A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS. Affected is the function restore_all_sound_file. The manipulati… |
CVE-2023-3057 | Medium | 4.3 | 2023-06-02 | A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/A… |
CVE-2023-3056 | Medium | 4.3 | 2023-06-02 | A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file index.php. The manipul… |
CVE-2023-20167 | Medium | 6.0 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform path traversal attacks on the underlying oper… |
CVE-2023-20166 | Medium | 6.0 | 2023-05-18 | Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform path traversal attacks on the underlying oper… |
CVE-2023-20098 | Medium | 4.4 | 2023-05-09 | A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files.
This vulnerability is due… |
CVE-2023-1800 | High | 7.3 | 2023-04-02 | A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file… |
CVE-2023-1398 | Medium | 6.3 | 2023-03-14 | A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/upload… |