CWE-22

Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internat

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for D

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are s

A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program com

Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authent

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.101.1 and 16.10.0, an Improper Limitati

The Media Sync plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.9 via the

An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addres

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issu

Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and e

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.16. This vulnerability affects the functio

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 t

Agent Zero before version 1.15 contains a path traversal vulnerability that allows unauthenticated attackers to read arb

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streaml

Navigate CMS 2.8.5 contains a path traversal vulnerability that allows authenticated users to download arbitrary files b

Open STA Manager 2.3 contains a path traversal vulnerability that allows authenticated users to download arbitrary files

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mamunur Rashid Classifie

A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allow

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js

Joomla com_jsjobs 1.2.6 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local Fil

The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a c

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows aut

Allegra exportReport Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attacker

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, r

CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.

Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos fro

Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.

Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level pri

The postman_download module uses the workspace name field from the Postman API to construct the local directory path wit

Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kes

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the ex

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to

motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion detection

ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote at

ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attack

Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read ar

The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SI

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin object keys such as "", ".", and ".." passed pnpm's

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Tra

A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadO

The PixMagix – WordPress Image Editor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, a

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Dir

Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the inte

Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via

Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that