Path Traversal: '/../filedir'
CWE-25
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /../ sequences that can resolve to a location that is outside of that directory.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Latest Path Traversal: '/../filedir' vulnerabilities
- 7.7 High severity
FooGallery Premium: Improper Limitation of a Pathname to a Restricted Directory
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of
- 7.5 High severity
EVO 550: Path Traversal: '/../filedir'
Franklin Fueling System EVO 550 and EVO 5000 are vulnerable to a Path Traversal vulnerability that could allow an attacker to access sensitive files on the system.
- 9.6 Critical severity
engrampa: Improper Limitation of a Pathname to a Restricted Directory
Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive
- 7.5 High severity
VGuard: Path Traversal: '/../filedir'
Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. VGuard allows Absolute Path Traversal. This issue affects VGuard: before V500.0003.R008.4011.C0012.B351.C.
- 7.8 High severity
atril: Improper Limitation of a Pathname to a Restricted Directory
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhe
- 7.8 High severity
Cisco SD-WAN Solution: Improper Limitation of a Pathname to a Restricted Directory
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit t
- 7.8 High severity
Cisco SD-WAN Path Traversal Exploited
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerabi