Relative Path Traversal
CWE-23
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as.. that can resolve to a location that is outside of that directory.
We track 263 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 6 have been exploited in real attacks.
How this weakness is prevented
- Operation: Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth.
Latest Relative Path Traversal vulnerabilities
- 10.0 Critical severity
ZkTeco-based OEM devices with firmware…: Relative Path Traversal
Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system with root privileges. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others)
- 7.5 High severity
ZkTeco-based OEM devices with firmware…: Relative Path Traversal
Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1
- 8.8 High severity
PowerPanel business: Relative Path Traversal
A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel server, which allows file writing to the server outside the intended scope, and could allow an attacker to achieve remote code execution.
- 8.1 High severity
mintplex-labs/anything-llm: Relative Path Traversal
mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnera
- 8.2 High severity
nicegui: Improper Limitation of a Pathname to a Restricted Directory
NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend fi
- 9.9 Critical severity
mintplex-labs/anything-llm: Relative Path Traversal
mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside o
- 7.5 High severity
Symphony Plus S+ Operations: Relative Path Traversal
ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products (e.g., S+ Operations, S+ Engineering and S+ Analyst) This issue affects Symphony Plus S+ Operations: from
- 8.8 High severity
Cisco Emergency Responder: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attacker to perform arbitrary actions on an affected device. This vulnerability is due to insufficient pro
- 7.5 High severity
Dell OpenManage Enterprise: Improper Limitation of a Pathname to a Restricted Directory
Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, to gain unauthorized access to the files stored on the server filesystem, with the privilege
- 7.5 High severity
Artica Proxy: Relative Path Traversal
The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administ
- 9.8 Critical severity
RaspberryMatic: Relative Path Traversal
RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior to version 3.75.6.20240316 contains a unauthenticated remote code execution (RCE) vulnerability, caused by multiple issues within the Java b
- 9.9 Critical severity
File Manager: Improper Limitation of a Pathname to a Restricted Directory
The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) and 8.3.4 (Pro version) via the target parameter in the mk_file_folder_manager_action_callback_short
- 7.5 High severity
ZKBio Media: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName wit
- 7.3 High severity
JetBrains TeamCity Relative Path Traversal Exploited
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
- 8.8 High severity
FortiManager: Improper Limitation of a Pathname to a Restricted Directory
A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests.
- 9.8 Critical severity
jupyterlab-lsp: Improper Limitation of a Pathname to a Restricted Directory
jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control
- 7.5 High severity
Lif-Auth-Server: Improper Limitation of a Pathname to a Restricted Directory
Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Ser
- 8.8 High severity
Triton Inference Server: Improper Limitation of a Pathname to a Restricted Directory
NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful
- 7.8 High severity
developer-center: Improper Limitation of a Pathname to a Restricted Directory
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Use
- 7.5 High severity
Repox: Relative Path Traversal
A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting in a disclosure of sensitive information. An attacker could access files such as application code or data, backend cred
- 9.8 Critical severity
JimuReport: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is an unknown functionality of the file /download/image. The manipulation of the argument imageUrl leads to relative path traversal. The attack
- 7.5 High severity
FortiWLM: Relative Path Traversal
A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests.
- 7.1 High severity
BGS5: Improper Limitation of a Pathname to a Restricted Directory
A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to escape from virtual directo
- 7.5 High severity
parse-server: Improper Limitation of a Pathname to a Restricted Directory
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.
- 8.8 High severity
xwiki-platform: Improper Limitation of a Pathname to a Restricted Directory
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versions 14.10.8 and 15.3-rc-1, triggering the office converter with a specially crafted file name allows
- 8.8 High severity
Aqua Drive: Improper Limitation of a Pathname to a Restricted Directory
Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged user could access/modify stored resources of other users. It could also be possible to access and modify
- 7.5 High severity
ConacWin CB: Improper Limitation of a Pathname to a Restricted Directory
Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter.
- 8.1 High severity
sudo-rs: Improper Limitation of a Pathname to a Restricted Directory
Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout h
- 9.8 Critical severity
Eclipse RAP: Improper Limitation of a Pathname to a Restricted Directory
In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName
- 7.8 High severity
N6845A Geolocation Server: Unrestricted Upload of File with Dangerous Type
In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges due to an improper path validation, which could result in local privilege escalation or a denial
- 7.5 High severity
SmartBPM.NET: Improper Limitation of a Pathname to a Restricted Directory
SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.
- 7.1 High severity
FortiADC: Improper Limitation of a Pathname to a Restricted Directory
A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the underlying file system via crafted CLI commands.
- 7.1 High severity
Dmidecode: Relative Path Traversal
Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. NOTE: Some third parties have indicated the fix in 3.5 does not adequately address the vulnerabilit
- 7.8 High severity
FortiClientWindows: Improper Limitation of a Pathname to a Restricted Directory
A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauthorized code or commands via sending a crafted request to a specific named pipe.
- 8.2 High severity
FortiOS: Improper Limitation of a Pathname to a Restricted Directory
A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, For
- 9.8 Critical severity
Drag and Drop Multiple File Upload Contact…: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative
- 9.8 Critical severity
Access Management Java Policy Agent: Improper Limitation of a Pathname to a Restricted Directory
Relative Path Traversal vulnerability in ForgeRock Access Management Java Policy Agent allows Authentication Bypass. This issue affects Access Management Java Policy Agent: all versions up to 5.10.1
- 9.8 Critical severity
Access Management Web Policy Agent: Improper Limitation of a Pathname to a Restricted Directory
Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass. This issue affects Access Management Web Policy Agent: all versions up to 5.10.1
- 8.1 High severity
MuYuCMS: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in MuYuCMS 2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin.php/accessory/filesdel.html. The manipulation of the argument filedelur leads to relative path traversal. The at
- 8.8 High severity
MuYuCMS: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in MuYuCMS 2.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /editor/index.php. The manipulation of the argument file_path leads to relative path traversal. The attack can