Relative Path Traversal
CWE-23
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as.. that can resolve to a location that is outside of that directory.
We track 263 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 6 have been exploited in real attacks.
How this weakness is prevented
- Operation: Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth.
Latest Relative Path Traversal vulnerabilities
- 8.1 High severity
FortiSwitchManager: Improper Limitation of a Pathname to a Restricted Directory
A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, FortiSwitchManager 7.2.0 and before 7.0.0 al
- 9.8 Critical severity
YugabyteDB Anywhere: Improper Limitation of a Pathname to a Restricted Directory
The High Availability functionality of Yugabyte Anywhere can be abused to write arbitrary files through the backup upload endpoint by using path traversal characters. This vulnerability is associated with program files PlatformReplicationManager.Java. This iss
- 9.8 Critical severity
My Cloud: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities
- 7.5 High severity
ArcGIS Enterprise: Improper Limitation of a Pathname to a Restricted Directory
In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker to traverse the file system and lead to the disclosure of sensitive data (not customer-published con
- 7.5 High severity
ArcGIS Server: Improper Limitation of a Pathname to a Restricted Directory
There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This coul
- 7.5 High severity
InTouch Access Anywhere: Improper Limitation of a Pathname to a Restricted Directory
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server.
- 7.8 High severity
guarddog: Improper Limitation of a Pathname to a Restricted Directory
GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to wr
- 7.5 High severity
gin-vue-admin: Improper Limitation of a Pathname to a Restricted Directory
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch
- 7.1 High severity
GeoDrive: Improper Limitation of a Pathname to a Restricted Directory
Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function. A local, low privileged attacker could potentially exploit this vulnerability, to gain unauthorized delete access to the files stored on the server filesystem,
- 9.8 Critical severity
UWP 3.0 Monitoring Gateway and Controller: Improper Limitation of a Pathname to a Restricted Directory
Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device.
- 7.5 High severity
wikmd: Improper Limitation of a Pathname to a Restricted Directory
Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing `/list/<path:folderpath>` and discloses lists of files located on the server including sensitive data. Version 1.7.1 fixes this issue.
- 8.2 High severity
ABB Zenon: Improper Limitation of a Pathname to a Restricted Directory
Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., flood the log entries. An attacker who successfully exploit the vulnerability could access the Zenon ru
- 7.2 High severity
Secure Integration Server: Improper Limitation of a Pathname to a Restricted Directory
The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore config
- 7.2 High severity
Pandora FMS: Improper Limitation of a Pathname to a Restricted Directory
Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute the .php file. The impact could lead to a Remote Code Execut
- 8.1 High severity
tzinfo: Improper Limitation of a Pathname to a Restricted Directory
TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path
- 9.8 Critical severity
DCMTK: Improper Limitation of a Pathname to a Restricted Directory
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
- 7.2 High severity
Cisco TelePresence Video Communication Server…: Relative Path Traversal
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write file
- 7.2 High severity
Cisco TelePresence Video Communication Server…: Relative Path Traversal
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write file
- 8.8 High severity
GitHub Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could potentially lead to privilege escalation. To exploit this vulnerability, an attacker would need to target a use
- 8.8 High severity
CENTUM CS 3000: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R
- 8.1 High severity
CENTUM CS 3000: Improper Limitation of a Pathname to a Restricted Directory
There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.
- 9.8 Critical severity
Aviatrix Controller Unrestricted Upload of File Exploited
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
- 7.5 High severity
VMware Tanzu Spring Cloud Config Directory Traversal Exploited
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a