CWE-22

A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete_dir_file of the file application/admin/co

A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.

A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath

A vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the f

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Contr

An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

A security flaw has been discovered in Ollama up to 0.20.2. This affects the function digestToPath of the file x/imagege

OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to a pat

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/s

bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4

In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.2

A vulnerability was determined in lharries whatsapp-mcp 0.0.1. Affected by this vulnerability is the function SendMessag

A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing h

OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symb

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traver

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability

A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/t

Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to r

Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to v

Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallo

A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of t

A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file s

A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown fu

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metag

A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by th

A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the fil

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dis

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an a

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handl

A vulnerability has been found in thinkgem JeeSite up to 5.15.1. The affected element is an unknown function of the comp

Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.

BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can

A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshE

The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 v

Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL p

A vulnerability was identified in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. Impacted is the

The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including,

A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privileg

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functiona