CWE-22

OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization d

pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to pat

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a

WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/clo

FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableId

Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CV

Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote us

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql

The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to,

prompts.chat prior to commit 0f8d4c3 contains a path traversal vulnerability in skill file handling that allows attacker

Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferr

PraisonAI is a multi-agent teams system. Prior to 1.5.113, The PraisonAI templates installation feature is vulnerable to

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and po

The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in all versions up to and including 5.1.1.

The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to,

ThreatSonar Anti-Ransomware developed by TeamT5 has an Arbitrary File Deletion vulnerability. Authenticated remote attac

The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.5. Th

The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and incl

Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authentic

WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `del

OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in

The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3

SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipel

An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iCon

A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.10, when

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Micro

Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across differe

MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where

Headplane is a feature-complete Web UI for Headscale. Prior to versions 0.6.3 and 0.7.0-beta.3, Headplane was vulnerable

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, Es

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, om

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `

Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary co

The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerabilit

The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 1

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic e

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows una