CWE-22

cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).

In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files

Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.

comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.

cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory tr

A path traversal vulnerability in <= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary f

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should b

IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 could allow a remote attacker to traverse directories on the system. A

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the

The web interface of the Compal Broadband CH7465LG modem (version CH7465LG-NCIP-6.12.18.25-2p6-NOSH) is vulnerable to a

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from

Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. By manipulating variables that reference files with .

An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory t

permission and access control vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices.

Nokia IMPACT < 18A has path traversal that may lead to RCE if chained with CVE-2019-1743

cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers t

A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 6185

In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure.

A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path

An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_b

IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote attacker to traverse directories on the

core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary

Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain a Directory Traversal Vulnerability. A

doorGets 7.0 has an arbitrary file deletion vulnerability in /doorgets/app/requests/user/configurationRequest.php. A rem

Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directo

dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerabilit

The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversa

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows ..%2f directory traversal via a rest/json/configdb/download/ URI.

An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the

Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.

A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an

A vulnerability in the CLI of Cisco Aironet Access Points (APs) could allow an authenticated, local attacker to access s

A vulnerability in the CLI of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker

An issue was discovered in OFCMS before 1.1.3. It has admin/cms/template/getTemplates.html?res_path=res&up_dir=../ direc

eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as d

PHP Scripts Mall Advance B2B Script 2.1.4 has directory traversal via a direct request for a listing of an image directo

Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authen

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerabi

IBM Campaign 9.1.2 and 10.1 could allow a remote attacker to traverse directories on the system. An attacker could send

Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allo

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an atta

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the fil

An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename cont

IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories

Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin b

Nokia IMPACT < 18A: allows full path disclosure

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and o

A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker