CWE-73 · External Control of File Name or Path (page 4)
Page 4 of 7 — CVEs classified under CWE-73, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40086 | Medium | 5.3 | 2026-04-10 | Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers t… |
CVE-2025-65115 | High | 8.8 | 2026-04-07 | Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Mana… |
CVE-2026-35174 | Critical | 9.1 | 2026-04-06 | Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an admini… |
CVE-2026-34783 | High | 8.1 | 2026-04-06 | Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library fun… |
CVE-2026-34522 | High | 8.1 | 2026-04-02 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-33949 | High | 8.1 | 2026-04-01 | Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write… |
CVE-2026-30292 | High | 8.4 | 2026-04-01 | An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal files via the file im… |
CVE-2026-30291 | High | 8.4 | 2026-04-01 | An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical internal files via the fil… |
CVE-2026-30289 | High | 8.4 | 2026-04-01 | An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal files via the file… |
CVE-2026-30287 | High | 8.4 | 2026-04-01 | An arbitrary file overwrite vulnerability in Deep Thought Industries ACE Scanner PDF Scanner v1.4.5 allows attackers to overwrite critical internal files via t… |
CVE-2026-23898 | High | 7.2 | 2026-04-01 | Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism. |
CVE-2026-5210 | High | 7.3 | 2026-03-31 | A vulnerability was detected in SourceCodester Leave Application System 1.0. This affects an unknown part. Performing a manipulation of the argument page resul… |
CVE-2026-30282 | Critical | 9.0 | 2026-03-31 | An arbitrary file overwrite vulnerability in UXGROUP LLC Cast to TV Screen Mirroring v2.2.77 allows attackers to overwrite critical internal files via the file… |
CVE-2026-30284 | High | 8.6 | 2026-03-31 | An arbitrary file overwrite vulnerability in UXGROUP LLC Voice Recorder v10.0 allows attackers to overwrite critical internal files via the file import process… |
CVE-2026-30281 | Critical | 9.8 | 2026-03-31 | An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to… |
CVE-2026-30276 | Critical | 9.8 | 2026-03-31 | An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import proces… |
CVE-2026-30940 | High | 7.2 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, a path traversal vulnerability exists in the theme file management API (/baser/api/admin/b… |
CVE-2026-33027 | Medium | 6.5 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequence… |
CVE-2026-33989 | High | 8.1 | 2026-03-27 | Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vuln… |
CVE-2026-33645 | High | 7.1 | 2026-03-26 | Fireshare facilitates self-hosted media and link sharing. In version 1.5.1, an authenticated path traversal vulnerability in Fireshare’s chunked upload endpoin… |
CVE-2026-0965 | Low | 3.3 | 2026-03-26 | A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a maliciou… |
CVE-2026-33329 | High | 8.1 | 2026-03-24 | FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js… |
CVE-2026-33309 | Critical | 9.9 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (Exte… |
CVE-2026-33354 | High | 7.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.php` accepts a requester-controlled `chun… |
CVE-2019-25618 | Medium | 6.2 | 2026-03-22 | AdminExpress 1.2.5 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input through the Sy… |
CVE-2026-2351 | Medium | 6.5 | 2026-03-21 | The Task Manager plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.0.2 via the callback_get_text_from_url() fun… |
CVE-2026-33476 | High | 7.5 | 2026-03-20 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance… |
CVE-2026-32949 | High | 7.5 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) vulner… |
CVE-2026-32749 | High | 7.6 | 2026-03-19 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploaded archiv… |
CVE-2019-25472 | High | 7.5 | 2026-03-11 | IntelBras Telefone IP TIP200 and 200 LITE contain an unauthenticated arbitrary file read vulnerability in the dumpConfigFile function accessible via the cgiSer… |
CVE-2026-30903 | Critical | 9.6 | 2026-03-11 | External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation… |
CVE-2026-27825 | Critical | 9.0 | 2026-03-10 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the `confluence_download_attachme… |
CVE-2026-25605 | Medium | 6.7 | 2026-03-10 | A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file deletion without properly validating the… |
CVE-2026-25573 | High | 7.4 | 2026-03-10 | A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application builds shell commands with caller-provided strings and… |
CVE-2026-24287 | High | 7.8 | 2026-03-10 | External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-30240 | Critical | 9.6 | 2026-03-09 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA (Pro… |
CVE-2026-29611 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling… |
CVE-2026-28459 | High | 7.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitr… |
CVE-2026-28442 | High | 8.5 | 2026-03-05 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, users are restricted from deleting inter… |
CVE-2026-28286 | High | 8.5 | 2026-03-02 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in… |
CVE-2026-26228 | Medium | 4.9 | 2026-02-26 | VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET… |
CVE-2026-23521 | Medium | 6.5 | 2026-02-23 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices… |
CVE-2026-27211 | Critical | 10.0 | 2026-02-21 | Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration (constrained by… |
CVE-2026-27115 | High | 7.1 | 2026-02-20 | ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below have an unvalidated command-line argument that allows any user to trigger recursiv… |
CVE-2026-26975 | High | 8.8 | 2026-02-20 | Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthentica… |
CVE-2026-27008 | Medium | 6.7 | 2026-02-20 | OpenClaw is a personal AI assistant. Prior to version 2026.2.15, a bug in `download` skill installation allowed `targetDir` values from skill frontmatter to re… |
CVE-2026-26202 | High | 7.5 | 2026-02-19 | Penpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user can read arbitrary files from the server… |
CVE-2026-26361 | Medium | 6.5 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access c… |
CVE-2026-26360 | High | 8.1 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access c… |
CVE-2026-26359 | High | 8.8 | 2026-02-19 | Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access c… |
CVE-2026-24708 | High | 8.2 | 2026-02-18 | An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk… |
CVE-2026-25964 | Medium | 4.9 | 2026-02-13 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the Reci… |
CVE-2025-61879 | High | 7.7 | 2026-02-12 | In Infoblox NIOS through 9.0.7, a High-Privileged User Can Trigger an Arbitrary File Write via the Account Creation Mechanism. |
CVE-2026-1669 | High | 7.5 | 2026-02-11 | Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacke… |
CVE-2026-26158 | High | 7.0 | 2026-02-11 | A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar arc… |
CVE-2026-26157 | High | 7.0 | 2026-02-11 | A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracte… |
CVE-2025-54162 | Medium | 4.9 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulne… |
CVE-2026-21249 | Low | 3.3 | 2026-02-10 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-25636 | High | 8.2 | 2026-02-06 | calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitra… |
CVE-2026-25628 | High | 8.5 | 2026-02-06 | Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files via /logger endpoint… |
CVE-2025-64712 | Critical | 9.8 | 2026-02-04 | The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many mo… |
CVE-2020-37080 | Critical | 9.8 | 2026-02-03 | webTareas 2.0.p8 contains a file deletion vulnerability in the print_layout.php administration component that allows authenticated attackers to delete arbitrar… |
CVE-2020-37078 | High | 8.8 | 2026-02-03 | i-doit Open Source CMDB 1.14.1 contains a file deletion vulnerability in the import module that allows authenticated attackers to delete arbitrary files by man… |
CVE-2024-5986 | Critical | 9.1 | 2026-02-02 | A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `… |
CVE-2026-23835 | | 2026-01-30 | LobeHub is an open source human-and-AI-agent network. Prior to version 1.143.3, the file upload feature in `Knowledge Base > File Upload` does not validate the… | |
CVE-2021-47871 | High | 8.8 | 2026-01-21 | Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the A… |
CVE-2021-47746 | High | 7.5 | 2026-01-21 | NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through… |
CVE-2025-53912 | Critical | 9.6 | 2026-01-20 | An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted HTTP request can lead… |
CVE-2026-23529 | High | 7.7 | 2026-01-16 | Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery. Prior to 2.11.0, there is an arbitrary file rea… |
CVE-2025-66292 | High | 8.1 | 2026-01-15 | DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/d… |
CVE-2026-20931 | High | 8.0 | 2026-01-13 | External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network. |
CVE-2026-20925 | Medium | 6.5 | 2026-01-13 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-20872 | Medium | 6.5 | 2026-01-13 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-22783 | Critical | 9.6 | 2026-01-12 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore fil… |
CVE-2025-66003 | | 2026-01-08 | An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and… | |
CVE-2025-14059 | Medium | 6.5 | 2026-01-07 | The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing p… |
CVE-2025-68428 | High | 7.5 | 2026-01-05 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allow… |
CVE-2025-62842 | High | 7.8 | 2026-01-02 | An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they ca… |
CVE-2025-12654 | Low | 2.7 | 2025-12-21 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and inclu… |
CVE-2025-68478 | High | 7.1 | 2025-12-19 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's… |
CVE-2025-68155 | High | 7.5 | 2025-12-16 | @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoint in `@vitejs/plug… |
CVE-2025-66449 | High | 8.8 | 2025-12-16 | ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on th… |
CVE-2025-13320 | Medium | 6.8 | 2025-12-12 | The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient val… |
CVE-2025-65473 | Critical | 9.1 | 2025-12-11 | An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to e… |
CVE-2025-67461 | Medium | 5.0 | 2025-12-10 | External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via l… |
CVE-2025-59516 | High | 7.8 | 2025-12-09 | Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-65799 | Medium | 4.3 | 2025-12-08 | A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal. |
CVE-2020-36878 | | 2025-12-05 | ReQuest Serious Play Media Player 3.0 contains an unauthenticated file disclosure vulnerability when input passed through the 'file' parameter in and script is… | |
CVE-2025-12529 | High | 8.8 | 2025-12-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() f… |
CVE-2021-4472 | Medium | 6.5 | 2025-11-26 | The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbi… |
CVE-2025-66257 | Critical | 9.1 | 2025-11-26 | Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1… |
CVE-2025-66254 | Critical | 9.1 | 2025-11-26 | Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500… |
CVE-2025-13380 | Medium | 6.5 | 2025-11-25 | The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0… |
CVE-2025-30201 | High | 7.7 | 2025-11-21 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows au… |
CVE-2025-11973 | Medium | 4.9 | 2025-11-21 | The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports f… |
CVE-2025-13322 | High | 8.1 | 2025-11-21 | The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and includin… |
CVE-2025-64714 | Medium | 5.8 | 2025-11-13 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, an unauthenticated L… |
CVE-2025-64739 | Medium | 4.3 | 2025-11-13 | External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access. |
CVE-2025-64738 | Medium | 5.0 | 2025-11-13 | External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information… |
CVE-2022-4983 | | 2025-11-12 | TEC-IT TBarCode version 11.15 contains a vulnerability in the TBarCode11.ocx ActiveX/OCX control's licensing handling (INI-file based) that can be abused to ca… |