CWE-23
Relative Path Traversal
Description
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-139 · CAPEC-76
CVEs mapped to this weakness (525)
page 14 of 27| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-8865 | Med | 0.44 | 6.3 | 0.07 | Mar 23, 2020 | This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the params[template]… | ||
| CVE-2023-29377 | Med | 0.43 | 6.6 | 0.00 | Sep 14, 2026 | An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA… | ||
| CVE-2026-54910 | Hig | 0.43 | 7.7 | 0.00 | Jul 20, 2026 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without… | ||
| CVE-2026-59832 | Hig | 0.43 | 7.7 | 0.00 | Jul 9, 2026 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks,… | ||
| CVE-2025-59341 | Hig | 0.43 | — | 0.02 | Sep 17, 2025 | esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host… | ||
| CVE-2024-49062 | Med | 0.43 | 6.5 | 0.03 | Dec 12, 2024 | Microsoft SharePoint Information Disclosure Vulnerability | ||
| CVE-2024-38258 | Med | 0.43 | 6.5 | 0.05 | Sep 10, 2024 | Windows Remote Desktop Licensing Service Information Disclosure Vulnerability | ||
| CVE-2023-33144 | Med | 0.43 | 6.6 | 0.01 | Jun 14, 2023 | Visual Studio Code Spoofing Vulnerability | ||
| CVE-2022-2139 | Med | 0.43 | 6.5 | 0.16 | Jul 22, 2022 | The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code. | ||
| CVE-2020-5280 | Hig | 0.43 | 7.6 | 0.07 | Mar 25, 2020 | http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService.… | ||
| CVE-2026-79728 | Med | 0.42 | 6.5 | 0.00 | Sep 9, 2026 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem… | ||
| CVE-2026-66907 | Hig | 0.42 | 7.5 | 0.01 | Aug 24, 2026 | Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the… | ||
| CVE-2026-63490 | Hig | 0.42 | 7.5 | 0.00 | Aug 20, 2026 | Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation… | ||
| CVE-2026-62837 | Med | 0.42 | 6.5 | 0.01 | Aug 11, 2026 | Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||
| CVE-2026-10595 | Hig | 0.42 | 7.5 | 0.00 | Aug 9, 2026 | A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem… | ||
| CVE-2026-56794 | Med | 0.42 | 6.5 | 0.00 | Aug 7, 2026 | Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. | ||
| CVE-2026-6540 | Hig | 0.42 | 7.5 | 0.00 | Jul 30, 2026 | Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path… | ||
| CVE-2026-58481 | Med | 0.42 | 6.5 | 0.00 | Jul 20, 2026 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox`… | ||
| CVE-2026-54066 | Hig | 0.42 | 7.5 | 0.02 | Jun 24, 2026 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous… | ||
| CVE-2026-49290 | Hig | 0.42 | — | 0.01 | Jun 19, 2026 | Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal vulnerability in Slopsmith's archive extractors allows an attacker to write arbitrary files outside the extraction… |
- risk 0.44cvss 6.3epss 0.07
This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the params[template]…
- risk 0.43cvss 6.6epss 0.00
An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA…
- risk 0.43cvss 7.7epss 0.00
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without…
- risk 0.43cvss 7.7epss 0.00
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks,…
- risk 0.43cvss —epss 0.02
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host…
- risk 0.43cvss 6.5epss 0.03
Microsoft SharePoint Information Disclosure Vulnerability
- risk 0.43cvss 6.5epss 0.05
Windows Remote Desktop Licensing Service Information Disclosure Vulnerability
- risk 0.43cvss 6.6epss 0.01
Visual Studio Code Spoofing Vulnerability
- risk 0.43cvss 6.5epss 0.16
The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code.
- risk 0.43cvss 7.6epss 0.07
http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService.…
- risk 0.42cvss 6.5epss 0.00
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem…
- risk 0.42cvss 7.5epss 0.01
Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the…
- risk 0.42cvss 7.5epss 0.00
Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation…
- risk 0.42cvss 6.5epss 0.01
Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
- risk 0.42cvss 7.5epss 0.00
A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem…
- risk 0.42cvss 6.5epss 0.00
Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
- risk 0.42cvss 7.5epss 0.00
Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path…
- risk 0.42cvss 6.5epss 0.00
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox`…
- risk 0.42cvss 7.5epss 0.02
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous…
- risk 0.42cvss —epss 0.01
Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal vulnerability in Slopsmith's archive extractors allows an attacker to write arbitrary files outside the extraction…