Path Traversal: '/dir/../filename'
CWE-26
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /dir/../filename sequences that can resolve to a location that is outside of that directory.
The '/dir/../filename' manipulation is useful for bypassing some path traversal protection schemes. Sometimes a program only checks for../ at the beginning of the input, so a /../ can bypass that check.
We track 13 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Latest Path Traversal: '/dir/../filename' vulnerabilities
- 8.7 High severity
Vvveb: Path Traversal: '/dir/../filename'
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly
- 9.1 Critical severity
Super Forms – Drag & Drop Form Builder: Path Traversal: '/dir/../filename'
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbi
- 8.8 High severity
Splunk Enterprise: Path Traversal: '/dir/../filename'
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could move files that the user account running Splunk Enterprise can read into a lookup that the user controls. The user could
- 9.9 Critical severity
django-s3file: Improper Limitation of a Pathname to a Restricted Directory
django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django
- 7.5 High severity
NavigaTUM: Improper Limitation of a Pathname to a Restricted Directory
NavigaTUM is a website and API to search for rooms, buildings and other places. Prior to commit 86f34c7, there is a path traversal vulnerability in the propose_edits endpoint allows unauthenticated users to overwrite files in directories writable by the applic
- 8.3 High severity
romm: Path Traversal: '/dir/../filename'
RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, su
- 8.7 High severity
label-studio: Improper Limitation of a Pathname to a Restricted Directory
Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functional
- 9.8 Critical severity
totemomail: Path Traversal: '/dir/../filename'
Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages).
- 8.8 High severity
spring-boot-online-exam: Path Traversal: '/dir/../filename'
Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component.
- 7.5 High severity
cmseasy: Path Traversal: '/dir/../filename'
Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request.
- 7.8 High severity
Document Picker: Path Traversal: '/dir/../filename'
Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component.
- 7.8 High severity
developer-center: Improper Limitation of a Pathname to a Restricted Directory
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Use
- 7.5 High severity
roxy-wi: Exposure of Resource to Wrong Sphere
Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename` sequences, such as `/etc/nginx/../passwd`, allowing an actor to gain information about a server. Vers