CWE-73
External Control of File Name or Path
Description
The product allows user input to control or influence paths or file names that are used in filesystem operations.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-13 · CAPEC-267 · CAPEC-64 · CAPEC-72 · CAPEC-76 · CAPEC-78 · CAPEC-79 · CAPEC-80
CVEs mapped to this weakness (561)
page 13 of 29| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-33329 | Hig | 0.46 | 8.1 | 0.00 | Mar 24, 2026 | FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any… | ||
| CVE-2026-24708 | — | Hig | 0.46 | 8.2 | 0.00 | Feb 18, 2026 | An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format… | |
| CVE-2026-26158 | Hig | 0.46 | 7.0 | 0.00 | Feb 11, 2026 | A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this… | ||
| CVE-2025-66292 | Hig | 0.46 | 8.1 | 0.01 | Jan 15, 2026 | DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into… | ||
| CVE-2025-62611 | Hig | 0.46 | — | 0.00 | Oct 22, 2025 | aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to… | ||
| CVE-2025-10058 | Hig | 0.46 | 8.1 | 0.01 | Sep 17, 2025 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_function() function in all versions up to, and including, 7.27. This makes it possible for authenticated… | ||
| CVE-2025-27147 | Hig | 0.46 | 8.2 | 0.00 | Mar 25, 2025 | The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). Versions prior to 1.5.0 have an improper access… | ||
| CVE-2024-43615 | Hig | 0.46 | 7.1 | 0.01 | Oct 8, 2024 | Microsoft OpenSSH for Windows Remote Code Execution Vulnerability | ||
| CVE-2024-43581 | Hig | 0.46 | 7.1 | 0.01 | Oct 8, 2024 | Microsoft OpenSSH for Windows Remote Code Execution Vulnerability | ||
| CVE-2024-7626 | Hig | 0.46 | 8.1 | 0.01 | Sep 11, 2024 | The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including,… | ||
| CVE-2023-6569 | Hig | 0.46 | 8.2 | 0.01 | Dec 14, 2023 | External Control of File Name or Path in h2oai/h2o-3 | ||
| CVE-2023-36634 | Hig | 0.46 | 7.1 | 0.01 | Sep 13, 2023 | An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to list and delete arbitrary files and… | ||
| CVE-2026-54629 | hig | 0.45 | — | — | Jul 14, 2026 | ## Summary Anyquery's `server` mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., `csv_reader`, `log_reader`). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local… | ||
| CVE-2026-49360 | hig | 0.45 | — | — | Jul 2, 2026 | ### Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem… | ||
| CVE-2026-54134 | hig | 0.45 | — | — | Jun 23, 2026 | ### Impact OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the `FILE_UPLOAD` permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload… | ||
| CVE-2026-57113 | hig | 0.45 | — | — | Jun 18, 2026 | ## Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example `github:owner/repo/[email protected]`. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into… | ||
| CVE-2026-34030 | Med | 0.45 | — | 0.00 | Jun 15, 2026 | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch code is later used in multiple application functions, including filesystem path generation for uploaded files, profile… | ||
| CVE-2022-4983 | Med | 0.45 | — | 0.00 | Nov 12, 2025 | TEC-IT TBarCode version 11.15 contains a vulnerability in the TBarCode11.ocx ActiveX/OCX control's licensing handling (INI-file based) that can be abused to cause remote creation of files on the host filesystem. Depending on where files can be created and which filenames are… | ||
| CVE-2025-0109 | Med | 0.45 | — | 0.01 | Feb 12, 2025 | An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and… | ||
| CVE-2024-29800 | Hig | 0.45 | 8.0 | 0.00 | May 14, 2024 | Deserialization of Untrusted Data vulnerability in Timber Team & Contributors Timber.This issue affects Timber: from n/a through 1.23.0. |
- risk 0.46cvss 8.1epss 0.00
FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any…
- risk 0.46cvss 8.2epss 0.00
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format…
- risk 0.46cvss 7.0epss 0.00
A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this…
- risk 0.46cvss 8.1epss 0.01
DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into…
- risk 0.46cvss —epss 0.00
aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to…
- risk 0.46cvss 8.1epss 0.01
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_function() function in all versions up to, and including, 7.27. This makes it possible for authenticated…
- risk 0.46cvss 8.2epss 0.00
The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). Versions prior to 1.5.0 have an improper access…
- risk 0.46cvss 7.1epss 0.01
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
- risk 0.46cvss 7.1epss 0.01
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
- risk 0.46cvss 8.1epss 0.01
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including,…
- risk 0.46cvss 8.2epss 0.01
External Control of File Name or Path in h2oai/h2o-3
- risk 0.46cvss 7.1epss 0.01
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to list and delete arbitrary files and…
- risk 0.45cvss —epss —
## Summary Anyquery's `server` mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., `csv_reader`, `log_reader`). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local…
- risk 0.45cvss —epss —
### Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem…
- risk 0.45cvss —epss —
### Impact OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the `FILE_UPLOAD` permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload…
- risk 0.45cvss —epss —
## Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example `github:owner/repo/[email protected]`. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into…
- risk 0.45cvss —epss 0.00
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch code is later used in multiple application functions, including filesystem path generation for uploaded files, profile…
- risk 0.45cvss —epss 0.00
TEC-IT TBarCode version 11.15 contains a vulnerability in the TBarCode11.ocx ActiveX/OCX control's licensing handling (INI-file based) that can be abused to cause remote creation of files on the host filesystem. Depending on where files can be created and which filenames are…
- risk 0.45cvss —epss 0.01
An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and…
- risk 0.45cvss 8.0epss 0.00
Deserialization of Untrusted Data vulnerability in Timber Team & Contributors Timber.This issue affects Timber: from n/a through 1.23.0.