Relative Path Traversal
CWE-23
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as.. that can resolve to a location that is outside of that directory.
We track 263 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 6 have been exploited in real attacks.
How this weakness is prevented
- Operation: Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth.
Latest Relative Path Traversal vulnerabilities
- 7.1 High severity
LogicalDOC Community: Relative Path Traversal
The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing documen
- 7.5 High severity
WP Ghost (Hide My WP Ghost) – Security &…: Relative Path Traversal
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. This makes it possible for unauthenticated attackers to read the contents of spec
- 9.8 Critical severity
NeMo Framework: Relative Path Traversal
NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successful exploit of this vulnerability may lead to code execution and data tampering.
- 7.5 High severity
rack: Relative Path Traversal
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:`
- 9.8 Critical severity
Apollo: Relative Path Traversal
When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.
- 7.5 High severity
Delete Comments By Status: Relative Path Traversal
Relative Path Traversal vulnerability in Shah Alom Delete Comments By Status delete-comments-by-status allows Path Traversal.This issue affects Delete Comments By Status: from n/a through <= 2.1.1.
- 9.9 Critical severity
mautic/core: Relative Path Traversal
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. * Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has be
- 9.1 Critical severity
Best Church Management Software: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/app/profile_crud.php. The manipulation of the argument old_cat_img leads
- 9.1 Critical severity
Online Nurse Hiring System: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/manage-nurse.php. The manipulation of the argument profilepic leads to path traversal: '../filedi
- 9.2 Critical severity
PingAM Java Policy Agent: Relative Path Traversal
Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through 5.10.3, through 2023.11.1, through 2024.9.
- 7.2 High severity
MaxTime: Relative Path Traversal
A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests.
- 7.1 High severity
image_picker_android: Improper Limitation of a Pathname to a Restricted Directory
The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provid
- 7.1 High severity
file_selector_android: Improper Limitation of a Pathname to a Restricted Directory
The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that pro
- 8.8 High severity
Fedora Repository: Relative Path Traversal
Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticat
- 7.5 High severity
Jeewms: Relative Path Traversal
A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of the file /wmOmNoticeHController.do. The manipulation leads to path traversal: '../filedir'. The attack
- 9.8 Critical severity
FortiWLM: Relative Path Traversal
A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specially crafted web requests.
- 8.1 High severity
TenderDocTransfer: Relative Path Traversal
TenderDocTransfer from Chunghwa Telecom has an Arbitrary File Write vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated r
- 9.8 Critical severity
DVC: Improper Limitation of a Pathname to a Restricted Directory
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
- 9.8 Critical severity
DVC: Improper Limitation of a Pathname to a Restricted Directory
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
- 9.8 Critical severity
DVC: Improper Limitation of a Pathname to a Restricted Directory
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
- 9.8 Critical severity
DVC: Improper Limitation of a Pathname to a Restricted Directory
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
- 9.8 Critical severity
DVC: Improper Limitation of a Pathname to a Restricted Directory
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
- 7.5 High severity
DVC: Improper Limitation of a Pathname to a Restricted Directory
The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
- 7.5 High severity
DVC: Improper Limitation of a Pathname to a Restricted Directory
The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
- 7.5 High severity
DSL6740C: Relative Path Traversal
The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device's default password is a combination of the MAC address, attacke
- 8.8 High severity
The Pack Elementor addons: Improper Limitation of a Pathname to a Restricted Directory
Relative Path Traversal vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elementor addons: from n/a through <= 2.0.9.
- 7.5 High severity
Administrative Management System: Improper Limitation of a Pathname to a Restricted Directory
Administrative Management System from Wellchoose has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to download arbitrary files on the server.
- 8.6 High severity
Analyse Uploads: Relative Path Traversal
Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through <= 0.5.
- 8.8 High severity
LiteSpeed Cache: Improper Limitation of a Pathname to a Restricted Directory
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1.
- 7.5 High severity
Enterprise Cloud Database: Improper Limitation of a Pathname to a Restricted Directory
Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
- 8.0 High severity
Splunk Enterprise: Improper Limitation of a Pathname to a Restricted Directory
In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32
- 7.5 High severity
team+: Relative Path Traversal
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
- 7.5 High severity
idurar-erp-crm: Improper Limitation of a Pathname to a Restricted Directory
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is direc
- 8.8 High severity
Cisco Data Center Network Manager: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with low privileges to execute arbitrary code on an affected device. This vulnerability is due to improper path validation. An attacker could exploi
- 9.8 Critical severity
Mobile-Security-Framework-MobSF: Improper Limitation of a Pathname to a Restricted Directory
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extractio
- 7.5 High severity
Raiden MAILD Remote Management System: Improper Limitation of a Pathname to a Restricted Directory
Raiden MAILD Remote Management System from Team Johnlong Software has a Relative Path Traversal vulnerability, allowing unauthenticated remote attackers to read arbitrary file on the remote server.
- 7.5 High severity
stitionai/devika: Relative Path Traversal
The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted path. This vulnerability can be exploited by sending a request to the application with a malicious sna
- 7.5 High severity
stitionai/devika: Relative Path Traversal
A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vulnerability arises due to insufficient sanitization of the 'project_name' parameter in the download_pro
- 8.8 High severity
Toshiba Tec e-Studio multi-function peripheral…: Relative Path Traversal
Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the affected products/models/versions, see the reference URL.
- 8.8 High severity
gitoxide: Relative Path Traversal
gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This