CWE-22

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.50.

A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitiza

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling

NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Na

Kenik Camera management Panel is vulnerable to Path Traversal vulnerability. An unauthenticated attacker can send GET re

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go use

A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulne

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, the legacy router first ret

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bas

SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vuln

CloakBrowser is a tool to bypass bot detection tests. Prior to version 0.3.28, the cloakserve CDP multiplexer uses the u

Path traversal vulnerability in Gleam's handling of custom documentation pages allows arbitrary file read and file write

Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/pa

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal

tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names,

A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of

Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file upl

A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and A

This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController compo

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potentia

The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requir

Backend users with file download permissions were able to download files from the fallback storage of the file abstracti

Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. This vulnerability allows an attacker in the same

Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisa

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1

CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1

SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An atta

UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any f

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item iden

Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Pr

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e4

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink reference

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create pe

motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program w

Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forge

Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. Th

AIL Framework contains a path traversal vulnerability in its PDF object handling. Prior to commit 14c618fce4d1df02358717

A validation vulnerability has been identified in certain web features related to file management or upload in several p

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows aut

Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent`

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAge

Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion wer

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Imp

A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute

A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of fi