CWE-22

The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowi

HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /t

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successf

Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 allows remote attac

PCViewer vt1000 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary fil

Softneta MedDream PACS Server Premium 6.7.1.1 contains a directory traversal vulnerability that allows unauthenticated a

An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerabili

IBM InfoSphere Optim Test Data Fabrication 1.0.0, 1.0.0.1, 1.0.0.2, 1.0.2, 1.0.2.2, 1.0.2.3, 1.0.2.4, 1.0.2.5, 1.0.2.6,

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() metho

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does n

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and Cac

DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/mai

Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow a

xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path} endpoint th

The Open ISES Project 3.30A contains a path traversal vulnerability in the ajax/download.php endpoint that allows unauth

Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerability in the generate_image()

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrar

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in al

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths fo

Apptha Slider Gallery 1.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbi

Mac Photo Gallery 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrar

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From versi

A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenti

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to v

WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrar

WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attacke

An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names cont

Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QuantumCloud Conversatio

Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 ve

Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.

Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.

picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to r

The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are s

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers t

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Trave

ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. This vulnerability

Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to

Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.1

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decodi

Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem.

Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, ava

A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a