CWE-22

The affected products are vulnerable to directory traversal, which may allow an attacker to obtain arbitrary operating s

Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /..

The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags

Directory traversal vulnerability in T&D Data Server (Japanese Edition) Ver.2.22 and earlier, T&D Data Server (English E

Wiris Mathtype v7.28.0 was discovered to contain a path traversal vulnerability in the resourceFile parameter. This vuln

The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the

A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to crea

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for P

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to cho

OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an at

OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing

Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal (to WEBINF/web.xml from sample/WEB-INF/web.xml

mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning p

The piaoyunsoft/bt_lnmp repository through 2019-10-10 on GitHub allows absolute path traversal because the Flask send_fi

Goldshell ASIC Miners v2.2.1 and below was discovered to contain a path traversal vulnerability which allows unauthentic

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitsubishi Electric GENE

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules.

The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insuff

A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal

An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWin

OMICARD EDM’s mail file relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploi

OMICARD EDM’s mail image relay function has a path traversal vulnerability. An unauthenticated remote attacker can explo

do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL wi

VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability

Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and G

Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling di

Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose

IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEReso

FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an impro

Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and

Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.

Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 s

GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in vers

Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when access

An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and downloa

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go

The number identification module has a path traversal vulnerability. Successful exploitation of this vulnerability may c

Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component

IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the t

McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebser

The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauth

Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote atta

ICEcoder v8.1 allows attackers to execute a directory traversal.

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter

Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.

Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10.

SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file

SonicWall GMS is vulnerable to file path manipulation resulting that an unauthenticated attacker can gain access to web

Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a