CWE-22
CVEs classified under CWE-22, newest first.
1927 CVEsRSS
CVE-2026-118038High· 7.1Path Traversal in Telerik Document Processing Libraries AI Agent Tools
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments t…
CVE-2026-86383Medium· 6.8Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Limitation of a Pathname to a Restrict…
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Limitation of a Pathname to a Restrict…
CVE-2026-105457Medium· 6.5Authenticated Arbitrary Local File Read via Path Traversal in HAVELSAN's Liman MYS
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: before 2.3.5-1132.
CVE-2026-86388Medium· 5.3Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
CVE-2026-86398High· 8.8Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
CVE-2026-104743Medium· 4.9Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp_file' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and a…
CVE-2026-15323High· 7.5Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_checkout function. This makes it possible for unauthenticated a…
CVE-2026-107745Medium· 4.2AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.…
CVE-2026-116673Low· 3.3systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
CVE-2026-115923Medium· 6.5Backstage catalog rules can be bypassed for URL locations using encoded path segments
Backstage catalog rules can be bypassed for URL locations using encoded path segments
CVE-2026-59179High· 8.3PoCOpenHop: Path Traversal in Flow ID File Operations
OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `Fl…
CVE-2026-58257High· 7.2GRR vulnerable to Arbitrary File Read and Deletion
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate t…
CVE-2026-57200High· 7.5Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST …
CVE-2026-116690High· 7.5MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path vali…
CVE-2026-112350High· 7.5Sunhillo SureLine Path Traversal via radarUpdater.cgi
Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and in…
CVE-2026-116682High· 8.6FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory
FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory
CVE-2026-108140Medium· 5.9A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path tr…
A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path tr…
CVE-2026-108141Medium· 5.9A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path tr…
A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path tr…
CVE-2026-93864High· 7.1Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP s…
CVE-2026-117510Medium· 6.3Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal
A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the component gr00tsonic Checkpoint Loader. This manip…
CVE-2026-117509Medium· 6.3PoCcrownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal
A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack…
CVE-2026-117566Medium· 5.3EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, hi…
GHSA-j456-xh4h-cpf2High· 8.6NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment
NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment
GHSA-gq48-pqfc-9p58MediumGitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
GHSA-g5ff-637f-6q2mHigh· 8.1LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
CVE-2026-115924High· 8.6Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
CVE-2026-116800Medium· 6.2WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal…
CVE-2026-116602Medium· 6.5SourceCodester Online Food Ordering System delete.php unlink path traversal
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The atta…
CVE-2026-93328Critical· 9.3PoCMissing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to extern…
CVE-2026-110748NoneApache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files
This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. …