CWE-22
CVEs classified under CWE-22, newest first.
2048 CVEsRSS
CVE-2026-113352High· 7.5uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant …
CVE-2026-112372Medium· 6.6PoCH3C Magic NX15 upload importprofile path traversal
A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely.…
CVE-2026-112302Medium· 6.3PoCkiwilan php-archive Extraction ArchiveZip.php extract path traversal
A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is …
CVE-2026-53995High· 8.2PoCMLflow 3.17.1 and prior Path Traversal via Trace ID API
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the …
CVE-2026-11319Medium· 6.2PoCTickTick Android 8.2.2.0 Path Traversal via ShareReceiveActivity
TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by s…
CVE-2026-112248Medium· 4.7grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversal
A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Pi…
CVE-2026-12660Low· 2.7IBM MQ Path Traversal
IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.
GHSA-pcc4-rvhr-2pr8MediumGraphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
CVE-2026-111053Medium· 6.9FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/template_exists endpoint permits path traversal because templateExists uses Path::join on the attacker-con…
CVE-2026-111915Medium· 5.9Yank Note before 3.93.1 Path Traversal via /api/help Endpoint
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass t…
CVE-2026-111925Medium· 5.3PoCMopidy before 4.0.5 Path Traversal via File Backend library.lookup
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library…
CVE-2026-79985High· 7.4PoCApache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component. This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file…
CVE-2026-79984High· 7.4PoCApache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component. This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remo…
CVE-2026-79986High· 7.4PoCApache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel rem…
CVE-2026-112138Medium· 4.7PoCdiem-project diem dmCodeEditor actions.class.php join path traversal
A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can …
CVE-2026-79983High· 7.4PoCorg.apache.camel/camel-ftp: camel-ftp: Unauthorized remote file access via path traversal (CVE-2026-79983)
A flaw was found in the Apache Camel FTP component. Remote-file consumers fail to validate directory listing entries received from remote servers, which allows path traversal outside the configured target directory. A compromised server or…
CVE-2026-78163Medium· 5.9PoCApache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure
Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component. This is…
CVE-2026-111398High· 7.7WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.1…
CVE-2026-112027Medium· 5.3PoCcms: light0011 cms: Information disclosure via filename manipulation in Uploadify (CVE-2026-112027)
A flaw was found in the Uploadify component of light0011 cms. A remote attacker can exploit an improper input handling vulnerability by manipulating the filename parameter in the check-exists script. This issue leads to information disclos…
CVE-2026-112049Medium· 5.5Vita3K before build 4187 Path Traversal via VPK Package Installation
Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or a…
CVE-2026-112051Medium· 6.5Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom …
CVE-2026-112005High· 7.7PoCWhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB fi…
CVE-2026-112015High· 7.5Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd
Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or pa…
CVE-2026-110253Medium· 5.4weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions…
CVE-2026-104246Medium· 5.9Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments
The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content…
CVE-2026-110268Medium· 4.9Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrat…
CVE-2026-111855High· 7.5An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to …
CVE-2026-111854High· 8.1An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient…
CVE-2026-68549Low· 3.3ClickMigrate has Path Traversal in "revision -m" argument
ClickMigrate has Path Traversal in "revision -m" argument
CVE-2026-111618Medium· 5.3PoCCoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints
CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any read…