CWE-22

Erugo is a self-hosted file-sharing platform. In versions up to and including 0.2.14, an authenticated low-privileged us

A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows

A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execu

Vociferous provides cross-platform, offline speech-to-text with local AI refinement. Prior to 4.4.2, the vulnerability e

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network App

Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Pat

A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artif

Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processe

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` ac

A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary f

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTT

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to a

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior,

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulner

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Dir

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related fi

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing un

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache fil

An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote

Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.71.0, an

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio

Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue aff

OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and ea

ApostropheCMS is an open-source content management framework. Prior to version 3.5.3 of `@apostrophecms/import-export`,

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the deskto

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypas

Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to system

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subt

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitra

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the exte

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP &#8

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saleswonder Team: Tobias

A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files dur

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerab

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PO

Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.

Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions.

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDas

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilit

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations

OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.s

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restor

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions,

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contai

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exis

The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, an

HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.0