CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Description
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-126 · CAPEC-64 · CAPEC-76 · CAPEC-78 · CAPEC-79
CVEs mapped to this weakness (10,483)
page 265 of 525| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-28163 | Med | 0.42 | 6.5 | 0.01 | Jun 2, 2023 | When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. *This bug only affects Firefox on Windows. Other versions of Firefox are… | ||
| CVE-2023-29159 | Hig | 0.42 | 7.5 | 0.02 | Jun 1, 2023 | Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette. | ||
| CVE-2023-27066 | Med | 0.42 | 6.5 | 0.01 | May 22, 2023 | Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle. | ||
| CVE-2023-32309 | Hig | 0.42 | 7.5 | 0.02 | May 15, 2023 | PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax `--8<--"/etc/passwd"` or `--8<--"/proc/self/environ"` the content of these files will… | ||
| CVE-2023-23169 | Med | 0.42 | 6.5 | 0.01 | May 12, 2023 | Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal. | ||
| CVE-2023-30172 | Hig | 0.42 | 7.5 | 0.01 | May 11, 2023 | A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter. | ||
| CVE-2023-31179 | Med | 0.42 | 6.5 | 0.01 | May 8, 2023 | AgilePoint NX v8.0 SU2.2 & SU2.3 - Path traversal - Vulnerability allows path traversal and downloading files from the server, by an unspecified request. | ||
| CVE-2023-30265 | Med | 0.42 | 6.5 | 0.01 | Apr 26, 2023 | CLTPHP <=6.0 is vulnerable to Directory Traversal. | ||
| CVE-2023-23838 | Med | 0.42 | 6.5 | 0.01 | Apr 25, 2023 | Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server. | ||
| CVE-2023-30620 | Hig | 0.42 | 7.5 | 0.01 | Apr 21, 2023 | mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended… | ||
| CVE-2023-29004 | Med | 0.42 | 6.5 | 0.01 | Apr 17, 2023 | hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version of Roxy-WI (6.3.9.0 at the moment of writing this report). The vulnerability can be exploited via an HTTP request to… | ||
| CVE-2023-20129 | Med | 0.42 | 6.5 | 0.01 | Apr 5, 2023 | Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery… | ||
| CVE-2023-28732 | Med | 0.42 | 6.5 | 0.01 | Mar 30, 2023 | Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects… | ||
| CVE-2022-32199 | Med | 0.42 | 6.5 | 0.02 | Mar 27, 2023 | db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter. | ||
| CVE-2023-20066 | Med | 0.42 | 6.5 | 0.02 | Mar 23, 2023 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that are outside the filesystem mountpoint of the web UI. This vulnerability is due to an insufficient security… | ||
| CVE-2023-1467 | Med | 0.42 | 6.5 | 0.01 | Mar 17, 2023 | A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the… | ||
| CVE-2023-1163 | Med | 0.42 | 6.5 | 0.02 | Mar 3, 2023 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5 and classified as critical. Affected by this vulnerability is the function getSyslogFile of the file mainfunction.cgi of the component Web Management Interface. The manipulation… | ||
| CVE-2022-3162 | Med | 0.42 | 6.5 | 0.01 | Mar 1, 2023 | Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+… | ||
| CVE-2023-22772 | Med | 0.42 | 6.5 | 0.01 | Mar 1, 2023 | An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system. | ||
| CVE-2023-22380 | Med | 0.42 | 6.5 | 0.01 | Feb 16, 2023 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise… |
- risk 0.42cvss 6.5epss 0.01
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. *This bug only affects Firefox on Windows. Other versions of Firefox are…
- risk 0.42cvss 7.5epss 0.02
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
- risk 0.42cvss 6.5epss 0.01
Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle.
- risk 0.42cvss 7.5epss 0.02
PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax `--8<--"/etc/passwd"` or `--8<--"/proc/self/environ"` the content of these files will…
- risk 0.42cvss 6.5epss 0.01
Synapsoft pdfocus 1.17 is vulnerable to local file inclusion and server-side request forgery Directory Traversal.
- risk 0.42cvss 7.5epss 0.01
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
- risk 0.42cvss 6.5epss 0.01
AgilePoint NX v8.0 SU2.2 & SU2.3 - Path traversal - Vulnerability allows path traversal and downloading files from the server, by an unspecified request.
- risk 0.42cvss 6.5epss 0.01
CLTPHP <=6.0 is vulnerable to Directory Traversal.
- risk 0.42cvss 6.5epss 0.01
Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server.
- risk 0.42cvss 7.5epss 0.01
mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended…
- risk 0.42cvss 6.5epss 0.01
hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version of Roxy-WI (6.3.9.0 at the moment of writing this report). The vulnerability can be exploited via an HTTP request to…
- risk 0.42cvss 6.5epss 0.01
Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery…
- risk 0.42cvss 6.5epss 0.01
Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects…
- risk 0.42cvss 6.5epss 0.02
db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter.
- risk 0.42cvss 6.5epss 0.02
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that are outside the filesystem mountpoint of the web UI. This vulnerability is due to an insufficient security…
- risk 0.42cvss 6.5epss 0.01
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the…
- risk 0.42cvss 6.5epss 0.02
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5 and classified as critical. Affected by this vulnerability is the function getSyslogFile of the file mainfunction.cgi of the component Web Management Interface. The manipulation…
- risk 0.42cvss 6.5epss 0.01
Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+…
- risk 0.42cvss 6.5epss 0.01
An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system.
- risk 0.42cvss 6.5epss 0.01
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise…