CWE-22

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure o

kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file l

A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthe

Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by cap

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to

This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files f

OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical rec

A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.

A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackag

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.

Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd]

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can

An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for wh

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disreg

BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.

Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. The HTTP Server does not have enough input d

An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar pack

An attacker could utilize a function in MDT AutoSave versions prior to v6.02.06 that permits changing a designated path

The rc-httpd component through 2022-03-31 for 9front (Plan 9 fork) allows ..%2f directory traversal if serve-static is u

Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allow

There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remo

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vul

Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal

Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privilege

aEnrich a+HRD has inadequate filtering for special characters in URLs. An unauthenticated remote attacker can bypass aut

InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file read

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stac

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a ma

Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal.

The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/i

UCMS v1.6 was discovered to contain an arbitrary file read vulnerability.

Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthentic

The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include state

A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to t

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to ver

Franklin Fueling Systems FFS TS-550 evo 2.23.4.8936 is affected by an unauthenticated directory traversal vulnerability,

Franklin Fueling Systems FFS T5 Series 1.8.7.7299 is affected by an unauthenticated directory traversal vulnerability, w

static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal.

nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.

Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52.

MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o

SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.

mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary

Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web appli

A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by

In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal.

In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to san