Path Traversal: 'dir/../../filename'
CWE-27
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal../ sequences that can resolve to a location that is outside of that directory.
We track 17 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Latest Path Traversal: 'dir/../../filename' vulnerabilities
- 7.7 High severity
Splunk Enterprise: Path Traversal: 'dir/../../filename'
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representation
- 8.1 High severity
Apache Kyuubi: Improper Limitation of a Pathname to a Restricted Directory
The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache K
- 9.8 Critical severity
Eclipse OpenMQ: Improper Limitation of a Pathname to a Restricted Directory
An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could
- 8.8 High severity
Apache Kyuubi: Improper Limitation of a Pathname to a Restricted Directory
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.
- 8.6 High severity
Yordam Katalog: Path Traversal: 'dir/../../filename'
Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal. This issue affects Yordam Katalog: before 21.7.
- 7.5 High severity
Tautulli: Path Traversal: 'dir/../../filename'
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `real_pms_image_proxy` endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application se
- 7.2 High severity
Iocharger firmware for AC models: Path Traversal: 'dir/../../filename'
Patch traversal, External Control of File Name or Path vulnerability in Iocharger Home allows deletion of arbitrary files This issue affects Iocharger firmware for AC model before firmware version 25010801. Likelihood: High, but requires authentication Impact:
- 7.2 High severity
kanboard: Improper Limitation of a Pathname to a Restricted Directory
Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the server. File attachments, that are viewable or downloadable in Kanboard are resolved through its `path`
- 9.8 Critical severity
eladmin: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Database Management/Deployment Management. The manipulation of the
- 8.5 High severity
traccar: Path Traversal: 'dir/../../filename'
Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by regis
- 7.5 High severity
Cisco Data Center Network Manager: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to read arbitrary files. This vulnerability is due to an unauthenticated provisioning web ser
- 9.8 Critical severity
Node: Path Traversal: 'dir/../../filename'
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve().
- 7.8 High severity
atril: Improper Limitation of a Pathname to a Restricted Directory
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhe
- 9.8 Critical severity
Jenkins Command Line Interface (CLI) Path Traversal Exploited
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files o
- 7.8 High severity
developer-center: Improper Limitation of a Pathname to a Restricted Directory
Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remot
- 7.5 High severity
graphql-engine: Improper Limitation of a Pathname to a Restricted Directory
Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vuln
- 7.5 High severity
moment: Improper Limitation of a Pathname to a Restricted Directory
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directl