CWE-22
CVEs classified under CWE-22, newest first.
1932 CVEsRSS
CVE-2026-56834High· 7.5PoCPraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that…
CVE-2026-57113High· 8.1PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-control…
CVE-2026-56833High· 7.5PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. …
GHSA-8cqv-vvq2-6p8cHigh· 7.5Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive
Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive
CVE-2026-105265Medium· 5.3Kiloview E3 NDI Encoder Path Traversal
A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory .
CVE-2026-115375Critical· 9.9Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance ba…
CVE-2026-115355High· 7.5Mistune before 3.3.0 Path Traversal and XSS via Include Directive
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messa…
CVE-2026-115353High· 8.6Mistune before 3.3.0 Path Traversal via include Directive
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives …
CVE-2026-115354Medium· 6.5PoCMistune before 3.3.0 Arbitrary Local File Read via Include Directive
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.r…
CVE-2026-77156Medium· 6.4ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absol…
CVE-2026-114606Medium· 5.6draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)
draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpF…
CVE-2026-92709High· 8.1Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE
Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs in…
CVE-2017-20287High· 7.5PoCJavo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter
Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests…
CVE-2018-25439High· 7.5PoCMetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequence…
CVE-2018-25438High· 7.5PoCIntermesh Group-Office < 3.5.5 Path Traversal via compress.php
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests…
CVE-2019-25779High· 7.5WooThemes Diarise 1.5.9 Local File Disclosure via download.php
WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to…
CVE-2021-48015High· 7.5JeeWMS Path Traversal via showOrDownByurl.do
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do …
CVE-2021-48014Critical· 9.8PoCFineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request …
CVE-2021-48013High· 7.5PoCWeaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload
Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with d…
CVE-2022-51022Critical· 9.1YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. A…
CVE-2021-48017High· 7.5PoCOrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi
OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with .…
CVE-2022-51025Medium· 6.5PoCPenta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer
Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with t…
CVE-2022-51024High· 7.5PoCKavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover…
CVE-2024-58396High· 7.5PoCYouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManCo…
CVE-2026-115207Medium· 5.5Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during auto…
CVE-2026-112311Medium· 6.5WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7.
CVE-2026-81163Medium· 5.4Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.
CVE-2026-114377Low· 3.8PoCleomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal
A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation…
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
A flaw was found in nbconvert. This flaw allows an attacker to perform an arbitrary file write by enticing a user to convert a maliciously crafted Jupyter notebook. Due to improper path validation in ExtractOutputPreprocessor, attacker-con…
CVE-2026-85518Medium· 6.1PoCOpenscap: openscap: arbitrary file write via path traversal in source datastream decomposition
A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tric…