CWE-22
CVEs classified under CWE-22, newest first.
2045 CVEsRSS
CVE-2026-115207Medium· 5.5Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during auto…
CVE-2026-112311Medium· 6.5WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7.
CVE-2026-81163Medium· 5.4Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.
CVE-2026-114377Low· 3.8PoCleomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal
A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation…
CVE-2026-114140High· 8.8PoCnbconvert: File write via path traversal in cell output filenames
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled …
CVE-2026-85518Medium· 6.1PoCOpenscap: openscap: arbitrary file write via path traversal in source datastream decomposition
A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tric…
CVE-2026-114375Medium· 6.3PoCleomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument cu…
CVE-2026-114376Medium· 6.3PoCleomoon-studios wiki-go API editor.go SourceHandler path traversal
A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can le…
CVE-2026-105945High· 7.7Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorizatio…
CVE-2026-92205Medium· 6.10dayBusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability
BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this…
CVE-2026-114126High· 8.7Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token t…
CVE-2026-114492Medium· 6.5gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a c…
CVE-2026-114125High· 8.6Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook develop…
CVE-2026-76479High· 7.8Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Comm…
CVE-2026-114370Low· 3.7Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal
A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link point…
CVE-2026-111833High· 7.5WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.
CVE-2026-114399Medium· 6.5Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file value…
CVE-2026-114402Medium· 4.3PoCTrudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attack…
CVE-2026-114040Low· 3.5PoCDT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get_model_meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipula…
CVE-2026-113737Medium· 5.5PoCR6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal
A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This affects the function validate_indexed_tensors of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py. Executing a m…
CVE-2026-113738Medium· 6.3PoCR6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal
A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.p…
CVE-2025-71437Medium· 6.5Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers …
CVE-2026-114063High· 7.5SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who …
CVE-2026-114083High· 8.1PoCTrigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. A…
CVE-2026-114094High· 8.8PoCDulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation a…
CVE-2026-114098High· 7.8Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repos…
CVE-2026-114097High· 7.8Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craf…
CVE-2026-114109High· 8.8uv before 0.11.15 Arbitrary File Write via Entry Point Names
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a mal…
CVE-2026-114106High· 7.5HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, whi…
CVE-2026-113743Medium· 6.3PoCTenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map…