CWE-22

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vul

qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.

A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game s

A Directory Traversal vulnerability discovered in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path travers

In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest c

Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of th

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for

EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server cra

In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModul

Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName pa

Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/downl

Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2

NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthentic

A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow us

Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.

The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can se

FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the a

MLflow allowed arbitrary files to be PUT onto the server.

An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL pa

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed

In the module "SoNice Retour" (sonice_retour) up to version 2.1.0 from Common-Services for PrestaShop, a guest can downl

Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive inf

The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a direc

Path traversal vulnerability in Chalemelon Power framework, affecting the getImage parameter. This vulnerability could a

Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal. This issue affects IP

An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server

** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not

In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to

An issue was discovered in server.js in etcd-browser 87ae63d75260. By supplying a /../../../ Directory Traversal input t

A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementatio

JFinalCMS 5.0.0 could allow a remote attacker to read files via ../ Directory Traversal in the /common/down/file fileKey

In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attac

The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy ar

Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user (regardless of their

Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could poten

ITPison OMICARD EDM has a path traversal vulnerability within its parameter “FileName” in a specific function. An unauth

Softnext Mail SQR Expert has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated r

Multisuns EasyLog web+ has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated rem

Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/downloa

Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not

Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthentic

The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3

JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachab

Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Da

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and ex

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.

Path traversal in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potent