VYPR

CWE-35

Path Traversal: '.../...//'

VariantIncomplete

Description

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Hierarchy (View 1000)

Parents

Children

none

CVEs mapped to this weakness (180)

page 3 of 9
  • CVE-2025-52810HigJun 27, 2025
    WordPress
    Katerio - Magazine
    risk 0.53cvss 8.1epss 0.01

    Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.

  • CVE-2025-49297HigJun 9, 2025
    Qodeinteractive
    Grill And Chow
    risk 0.53cvss 8.1epss 0.01

    Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through <= 1.6.

  • CVE-2025-49296HigJun 9, 2025
    Qodeinteractive
    Grandprix
    risk 0.53cvss 8.1epss 0.01

    Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects GrandPrix: from n/a through <= 1.6.

  • CVE-2025-49295HigJun 9, 2025
    Qodeinteractive
    Mediclinic
    risk 0.53cvss 8.1epss 0.01

    Path Traversal: '.../...//' vulnerability in Mikado-Themes MediClinic mediclinic allows PHP Local File Inclusion.This issue affects MediClinic: from n/a through <= 2.1.

  • CVE-2025-39475HigJun 9, 2025
    WordPress
    Arlo
    risk 0.53cvss 8.1epss 0.01

    Path Traversal: '.../...//' vulnerability in Frenify Arlo arlo allows PHP Local File Inclusion.This issue affects Arlo: from n/a through <= 6.0.3.

  • CVE-2025-27010HigMay 19, 2025
    WordPress
    Tastyc
    risk 0.53cvss 8.1epss 0.01

    Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a through < 2.5.2.

  • CVE-2025-39491HigMay 16, 2025
    WordPress
    Whmpress
    risk 0.53cvss 8.1epss 0.00

    Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision.

  • CVE-2025-39470HigApr 18, 2025
    WordPress
    Ivy School
    risk 0.53cvss 8.1epss 0.01

    Path Traversal: '.../...//' vulnerability in ThimPress Ivy School ivy-school allows PHP Local File Inclusion.This issue affects Ivy School: from n/a through <= 1.6.0.

  • CVE-2024-54362HigMar 28, 2025
    WordPress
    Getshop Ecommerce
    risk 0.53cvss 8.1epss 0.00

    Path Traversal: '.../...//' vulnerability in boggibill GetShop ecommerce getshop-ecommerce allows Path Traversal.This issue affects GetShop ecommerce: from n/a through <= 1.3.

  • CVE-2025-25122HigMar 3, 2025
    WizShop
    wizshop
    risk 0.53cvss 8.1epss 0.00

    Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through <= 3.0.2.

  • CVE-2025-24685HigJan 27, 2025
    WordPress
    Morkva Ua Shipping
    risk 0.53cvss 8.1epss 0.01

    Path Traversal: '.../...//' vulnerability in Ihor Kit Morkva UA Shipping morkva-ua-shipping allows PHP Local File Inclusion.This issue affects Morkva UA Shipping: from n/a through <= 1.0.18.

  • CVE-2024-41973HigNov 18, 2024
    VDE
    VDE
    risk 0.53cvss 8.1epss 0.01

    A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges.

  • CVE-2024-11136HigNov 14, 2024
    Tcl Tk
    Tcl\/tk
    risk 0.53cvss —epss 0.00

    The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delete arbitrary files from user’s external storage.

  • CVE-2023-39916CriSep 13, 2023
    Nlnetlabs
    Routinator
    risk 0.53cvss 9.3epss 0.01

    NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for…

  • CVE-2023-7300HigDec 26, 2024
    Huawei
    Home Music System
    risk 0.52cvss 8.0epss 0.00

    Huawei Home Music System has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the music host file to be deleted or the file permission to be changed.(Vulnerability ID:HWPSIRT-2023-60613)

  • CVE-2026-44933HigMay 20, 2026
    SUSE S.A.
    PluginScript
    risk 0.51cvss 7.8epss 0.00

    `PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`. If the chroot target is `/`, it is a no-op, allowing the traversed path to execute host binaries (like…

  • CVE-2025-47176HigJun 10, 2025
    Microsoft
    Office Outlook
    risk 0.51cvss 7.8epss 0.01

    '.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.

  • CVE-2025-67914HigJan 8, 2026
    WordPress
    VidMov
    risk 0.50cvss 7.7epss 0.00

    Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through <= 2.3.8.

  • CVE-2025-30014HigApr 8, 2025
    SAP
    Capital Yield Tax Management
    risk 0.50cvss 7.7epss 0.01

    SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from directory which they don�t have access to, hence causing a high impact on confidentiality. Integrity…

  • CVE-2024-54216HigDec 6, 2024
    Reputeinfosystems
    Arforms
    risk 0.50cvss 7.7epss 0.01

    Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2.