cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 110

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE

Related attack patterns (CAPEC): 5
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-126 Path Traversal Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-22, as MITRE names them. Credits.

Ask an AI about CWE-22

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2023-42280EPSS 1.1%

    mee-admin 1.5 is vulnerable to Directory Traversal. The download method in the CommonFileController.java file does not verify the incoming data, resulting in arbitrary file reading.

  2. 8.1CVE-2023-42456EPSS 0.6%

    Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a c…

  3. 9.8CVE-2023-4760EPSS 1.2%

    In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component. The reason for this is a not completely secure extraction of the file name in the FileUp…

  4. 7.5CVE-2023-4152EPSS 1.0%

    Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all…

  5. 9.8CVE-2015-5467EPSS 0.9%

    web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.

  6. 6.8CVE-2023-40930EPSS 1.3%

    An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mnt/.

  7. 6.5CVE-2022-45447EPSS 0.9%

    M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly checked in the resource /m4pdf/pdf.php, returning any file given its relative path…

  8. 5.5CVE-2023-43616EPSS 0.4%

    An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction.

  9. 5.3CVE-2023-41599ExploitEPSS 12%

    An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.

  10. 9.8CVE-2022-28357EPSS 1.2%

    NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.

  11. 6.5CVE-2023-37739EPSS 1.3%

    i-doit Pro v25 and below was discovered to be vulnerable to path traversal.

  12. 4.3CVE-2021-28485EPSS 0.7%

    In Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific parameter in the https request after authentication, which allows access to files on the system th…

  13. 6.5CVE-2023-39916EPSS 0.6%

    NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store th…

  14. 7.5CVE-2023-4914EPSS 0.9%

    Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1.

  15. 7.5CVE-2023-32558EPSS 1.7%

    The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CV…

  16. 7.8CVE-2023-35670EPSS 0.1%

    In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private directories due to a path traversal error. This could lead to local escalation of privilege with no additional execution pr…

  17. 7.5CVE-2023-38256EPSS 0.7%

    Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 vulnerable to a path traversal attack, which could allow an attacker to access files stored on the system.

  18. 9.1CVE-2022-33164EPSS 1.5%

    IBM Security Directory Server 7.2.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view or write to arbitrary files on th…

  19. 7.5CVE-2023-41578EPSS 0.9%

    Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection.

  20. 7.8CVE-2023-4782EPSS 0.3%

    Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

  21. 7.5CVE-2023-40924ExploitEPSS 3.2%

    SolarView Compact < 6.00 is vulnerable to Directory Traversal.

  22. 7.5CVE-2023-39584EPSS 35%

    Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.

  23. 7.8CVE-2021-35980EPSS 0.4%

    Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Path traversal vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve…

  24. 7.8CVE-2021-28644EPSS 0.4%

    Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Path traversal vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve…

  25. 4.3CVE-2023-41930EPSS 0.9%

    Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was no…

  26. 5.5CVE-2023-4480EPSS 0.7%

    Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privilege…

  27. 8.8CVE-2023-39448EPSS 1.3%

    Path traversal vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to alter or create arbitrary files on the server, resulting in arbitrary code execution.

  28. 7.5CVE-2023-4748EPSS 0.9%

    A vulnerability, which was classified as critical, has been found in Yongyou UFIDA-NC up to 20230807. This issue affects some unknown processing of the file PrintTemplateFileServlet.java. The manipulation of the argument filePath leads to …

  29. 5.5CVE-2023-41057EPSS 0.4%

    hyper-bump-it is a command line tool for updating the version in project files.`hyper-bump-it` reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is…

  30. 7.5CVE-2023-4616EPSS 1.6%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail en…

  31. 7.5CVE-2023-4615EPSS 1.6%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/download/upd…

  32. 9.8CVE-2023-4614EPSS 2.5%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/installation/setThum…

  33. 9.8CVE-2023-4613EPSS 2.5%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/settings/upload endp…

  34. 4.9CVE-2023-39912EPSS 3.8%

    Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is installed.

  35. 6.5CVE-2023-41747EPSS 0.4%

    Sensitive information disclosure due to unauthenticated path traversal. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.

  36. 3.8CVE-2023-41044EPSS 0.7%

    Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Graylog's Supp…

  37. 8.1CVE-2023-31167EPSS 0.4%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Screen Builder Software on Windows allows Relative Path Traversal. SEL acSELera…

  38. 6.5CVE-2023-41040EPSS 1.1%

    GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPyth…

  39. 7.8CVE-2023-39139EPSS 0.4%

    An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.

  40. 7.8CVE-2023-39138EPSS 0.4%

    An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.

  41. 7.8CVE-2023-39135EPSS 0.4%

    An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry.

  42. 8.8CVE-2023-40597EPSS 0.2%

    In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.

  43. 6.5CVE-2023-41266KEVExploitEPSS 85%

    A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unau…

  44. 5.3CVE-2023-39559EPSS 0.7%

    AudimexEE 15.0 was discovered to contain a full path disclosure vulnerability.

  45. 7.2CVE-2023-20890EPSS 20%

    Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operations for Networks can write files to arbitrary locations resulting in remote code…

  46. 7.5CVE-2023-40828EPSS 1.5%

    An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.

  47. 7.5CVE-2023-40827EPSS 1.7%

    An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.

  48. 7.5CVE-2023-40826EPSS 1.4%

    An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.

  49. 7.8CVE-2023-39810EPSS 0.8%

    An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.

  50. 5.3CVE-2023-40587EPSS 0.8%

    Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a `index.html` file t…