Path Traversal: '..filename'
CWE-29
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '..filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
Sometimes a program checks for.. at the beginning of the input, so a.. can bypass that check. It is also useful for bypassing path traversal protection schemes that only assume that the / separator is valid.
We track 48 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3.
How this weakness is prevented
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Latest Path Traversal: '..filename' vulnerabilities
- 8.8 High severity
BioNeMo Framework: Path Traversal: '..filename'
NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious file. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering
- 7.2 High severity
mintplex-labs/anything-llm: Path Traversal: '..filename'
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component. The vulnerability arises from improper handling of user input in the `loadFlow` and `deleteFlow` methods in `server/utils
- 10.0 Critical severity
mlflow/mlflow: Path Traversal: '..filename'
A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validat
- 7.5 High severity
Wallos: Improper Limitation of a Pathname to a Restricted Directory
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. This issue has been patched in version 4.6.2.
- 7.5 High severity
FAST/TOOLS: Path Traversal: '..filename'
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are a
- 9.6 Critical severity
parisneo/lollms-webui: Path Traversal: '..filename'
A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifically within the `name` parameter of the `@router.post("/reinstall_extension")` route. This vulnerability allows attackers
- 7.4 High severity
ruby-mqtt: Path Traversal: '..filename'
A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack.
- 7.0 High severity
dbgate: Path Traversal: '..filename'
DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, re
- 7.1 High severity
dbgate: Path Traversal: '..filename'
DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists fil
- 7.5 High severity
run-llama/llama_index: Path Traversal: '..filename'
A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utils.py`. This vulnerability allows an attacker to manipulate the `image_path` input to read arbitrary
- 7.5 High severity
mlflow/mlflow: Path Traversal: '..filename'
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path
- 9.1 Critical severity
modelscope/agentscope: Path Traversal: '..filename'
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to
- 7.2 High severity
mintplex-labs/anything-llm: Path Traversal: '..filename'
A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The iss
- 9.1 Critical severity
danswer-ai/danswer: Path Traversal: '..filename'
An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the load_credentials method, where user-controlled input for realm_name and zuliprc_content is used to con
- 8.8 High severity
binary-husky/gpt_academic: Path Traversal: '..filename'
A path traversal vulnerability exists in binary-husky/gpt_academic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will
- 8.8 High severity
danny-avila/librechat: Path Traversal: '..filename'
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in versi
- 8.2 High severity
gradio-app/gradio: Path Traversal: '..filename'
A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the
- 7.2 High severity
mintplex-labs/anything-llm: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote c
- 7.1 High severity
PowerProtect DD: Improper Limitation of a Pathname to a Restricted Directory
Dell PowerProtect DD versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain a path traversal vulnerability. A local low privileged could potentially exploit this vulnerability to gain unauthorized overwrite of OS files stored on the server filesystem
- 8.6 High severity
luigi: Path Traversal: '..filename'
Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.
- 7.5 High severity
gaizhenbiao/chuanhuchatgpt: Improper Limitation of a Pathname to a Restricted Directory
An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. An attacker can read any file that matches specific criteria using an absolute path. The file must not
- 9.1 Critical severity
langchain-ai/langchainjs: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete files. The v
- 7.5 High severity
parisneo/lollms-webui: Path Traversal: '..filename'
A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the `serve_js` function in `app.py`, which allows attackers to perform path traversal attacks. This can lead
- 9.8 Critical severity
aimhubio/aim: Path Traversal: '..filename'
A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` par
- 9.1 Critical severity
stitionai/devika: Path Traversal: '..filename'
A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service (DoS). This issue is present in all versions of the application. The vulnerabil
- 7.3 High severity
parisneo/lollms: Path Traversal: '..filename'
A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper valid
- 9.8 Critical severity
parisneo/lollms: Path Traversal: '..filename'
CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().build_extension()` function. The vulnerability arises from the `/mount_extension` endpoint, where a path traversal issue allows attackers to na
- 7.2 High severity
opencart/opencart: Improper Limitation of a Pathname to a Restricted Directory
This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extr
- 7.2 High severity
mintplex-labs/anything-llm: Path Traversal: '..filename'
A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the `normalizePath()` function, intended to defend against path traversal attacks. This vulnerability enables the manager to read, delete, or overwrite the 'anythingllm.db
- 9.8 Critical severity
parisneo/lollms-webui: Improper Limitation of a Pathname to a Restricted Directory
A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of t
- 9.8 Critical severity
parisneo/lollms: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in `lollms_core\lollms\security.py`. This vulnerability allows for arbitrary file reading when the app
- 7.5 High severity
mlflow/mlflow: Improper Limitation of a Pathname to a Restricted Directory
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal se
- 9.8 Critical severity
parisneo/lollms-webui: Improper Limitation of a Pathname to a Restricted Directory
A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_personal_path")` endpoint in `./lollms-webui/lollms_core/lollms/server/endpoints/lollms_user.py`. The vulner
- 9.8 Critical severity
parisneo/lollms-webui: Improper Limitation of a Pathname to a Restricted Directory
parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by man
- 8.8 High severity
deepjavalibrary/djl: Improper Limitation of a Pathname to a Restricted Directory
A TarSlip vulnerability exists in the deepjavalibrary/djl, affecting version 0.26.0 and fixed in version 0.27.0. This vulnerability allows an attacker to manipulate file paths within tar archives to overwrite arbitrary files on the target system. Exploitation
- 7.5 High severity
parisneo/lollms-webui: Path Traversal: '..filename'
A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copy_to_custom_personas' endpoint in the 'lollms_personalities_infos.py' file. This vulnerability allows attackers to read arbitrary files by manipulating the 'categor
- 7.5 High severity
parisneo/lollms-webui: Path Traversal: '..filename'
A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `category` parameter, an attacker can traverse the directory structure and list any directory on the sys
- 7.5 High severity
mlflow/mlflow: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a p
- 8.4 High severity
parisneo/lollms-webui: Path Traversal: '..filename'
A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the '
- 9.6 Critical severity
parisneo/lollms-webui: Path Traversal: '..filename'
A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the `install_model()` function within `lollms_core/lollms/binding.py`, where the