CWE-73
External Control of File Name or Path
Description
The product allows user input to control or influence paths or file names that are used in filesystem operations.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-13 · CAPEC-267 · CAPEC-64 · CAPEC-72 · CAPEC-76 · CAPEC-78 · CAPEC-79 · CAPEC-80
CVEs mapped to this weakness (674)
page 34 of 34| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-25964 | Med | 0.00 | 4.9 | 0.00 | Feb 13, 2026 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the… | ||
| CVE-2026-25636 | Hig | 0.00 | 8.2 | 0.00 | Feb 6, 2026 | calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from… | ||
| CVE-2026-22783 | Cri | 0.00 | 9.6 | 0.00 | Jan 12, 2026 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore file management system has a vulnerability where mass assignment of the file_local_name field combined with path trust in… | ||
| CVE-2025-66449 | Hig | 0.00 | 8.8 | 0.01 | Dec 16, 2025 | ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user… | ||
| CVE-2025-30201 | Hig | 0.00 | 7.7 | 0.01 | Nov 21, 2025 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings,… | ||
| CVE-2025-58762 | Cri | 0.00 | 9.1 | 0.01 | Sep 9, 2025 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the application filesystem. This leads to remote… | ||
| CVE-2024-5823 | Cri | 0.00 | 9.1 | 0.01 | Oct 29, 2024 | A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to overwrite critical configuration files within the system. Exploiting this vulnerability can lead to unauthorized changes… | ||
| CVE-2024-6714 | Hig | 0.00 | 8.8 | 0.00 | Jul 23, 2024 | An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege. | ||
| CVE-2024-5334 | Hig | 0.00 | 7.5 | 0.02 | Jun 27, 2024 | A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by… | ||
| CVE-2023-1105 | Hig | 0.00 | 8.1 | 0.01 | Mar 1, 2023 | External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3. | ||
| CVE-2021-3845 | Hig | 0.00 | 7.5 | 0.01 | Jan 4, 2022 | ws-scrcpy is vulnerable to External Control of File Name or Path | ||
| CVE-2021-3626 | Hig | 0.00 | 8.8 | 0.00 | Oct 1, 2021 | The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation. | ||
| CVE-2020-15264 | Hig | 0.00 | 8.0 | 0.02 | Oct 20, 2020 | The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a… | ||
| CVE-2014-2375 | 0.00 | — | 0.02 | Sep 15, 2014 | Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature. |
- risk 0.00cvss 4.9epss 0.00
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbitrary files on the…
- risk 0.00cvss 8.2epss 0.00
calibre is an e-book manager. In 9.1.0 and earlier, a path traversal vulnerability in Calibre's EPUB conversion allows a malicious EPUB file to corrupt arbitrary existing files writable by the Calibre process. During conversion, Calibre resolves CipherReference URI from…
- risk 0.00cvss 9.6epss 0.00
Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to 2.4.24, the DFIR-IRIS datastore file management system has a vulnerability where mass assignment of the file_local_name field combined with path trust in…
- risk 0.00cvss 8.8epss 0.01
ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user…
- risk 0.00cvss 7.7epss 0.01
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings,…
- risk 0.00cvss 9.1epss 0.01
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the application filesystem. This leads to remote…
- risk 0.00cvss 9.1epss 0.01
A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to overwrite critical configuration files within the system. Exploiting this vulnerability can lead to unauthorized changes…
- risk 0.00cvss 8.8epss 0.00
An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege.
- risk 0.00cvss 7.5epss 0.02
A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by…
- risk 0.00cvss 8.1epss 0.01
External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
- risk 0.00cvss 7.5epss 0.01
ws-scrcpy is vulnerable to External Control of File Name or Path
- risk 0.00cvss 8.8epss 0.00
The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation.
- risk 0.00cvss 8.0epss 0.02
The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a…
- CVE-2014-2375Sep 15, 2014risk 0.00cvss —epss 0.02
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.