cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 131

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 5
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-126 Path Traversal Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-22, as MITRE names them. Credits.

Ask an AI about CWE-22

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2022-29596EPSS 2.2%

    MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=_any_password_&ConnMode=1&3054=Login substring for dire…

  2. 6.5CVE-2022-30062EPSS 1.1%

    ftcms <=2.1 was discovered to be vulnerable to Arbitrary File Read via tp.php

  3. 6.5CVE-2022-30061EPSS 1.3%

    ftcms <=2.1 was discovered to be vulnerable to directory traversal attacks via the parameter tp.

  4. 6.5CVE-2022-30059EPSS 1.2%

    Shopwind <=v3.4.2 was discovered to contain a Arbitrary File Delete vulnerability via the neirong parameter at \backend\controllers\DbController.php.

  5. 5.3CVE-2022-30058EPSS 1.2%

    Shopwind <=v3.4.2 was discovered to contain a Arbitrary File Download vulnerability via the neirong parameter at \backend\controllers\DbController.php.

  6. 6.5CVE-2022-1476EPSS 46%

    The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58.…

  7. 7.5CVE-2022-30333KEVExploitEPSS 99.2%

    RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

  8. 8.8CVE-2022-26889EPSS 1.5%

    In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, …

  9. 6.5CVE-2022-24878EPSS 1.0%

    Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workaround…

  10. 8.8CVE-2022-24877EPSS 1.2%

    Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem an…

  11. 4.3CVE-2022-29474EPSS 1.6%

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, a directory traversal vulnerability exists in iCo…

  12. 4.9CVE-2022-26835EPSS 1.9%

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, directory traversal vulnerabilities exist in undi…

  13. 5.3CVE-2021-38693EPSS 1.0%

    A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive da…

  14. 7.5CVE-2021-42183EPSS 4.7%

    MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.

  15. 4.6CVE-2021-45783ExploitEPSS 1.9%

    Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker to obtain sensitive information.

  16. 5.5CVE-2022-20101EPSS 0.1%

    In aee daemon, there is a possible information disclosure due to a path traversal. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A…

  17. 3.3CVE-2022-28784EPSS 0.1%

    Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as system user. The patch addresses incorrect implementation of file path validation check logic.

  18. 7.5CVE-2022-1554EPSS 1.4%

    Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52.

  19. 7.5CVE-2022-24897EPSS 1.8%

    APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File A…

  20. 7.5CVE-2022-29970EPSS 2.1%

    Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

  21. 7.5CVE-2022-28451EPSS 1.6%

    nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.

  22. 7.5CVE-2022-26068EPSS 1.6%

    This affects the package pistacheio/pistache before 0.0.3.20220425. It is possible to traverse directories to fetch arbitrary files from the server.

  23. 9.8CVE-2022-25842EPSS 3.9%

    All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). T…

  24. 7.5CVE-2022-29967EPSS 1.6%

    static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal.

  25. 8.6CVE-2022-24900ExploitEPSS 8.4%

    Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untruste…

  26. 9.8CVE-2022-29081ExploitEPSS 84%

    Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDash…

  27. 4.9CVE-2021-43930EPSS 1.0%

    Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.

  28. 7.5CVE-2021-46421EPSS 6.0%

    Franklin Fueling Systems FFS T5 Series 1.8.7.7299 is affected by an unauthenticated directory traversal vulnerability, which allows an attacker to obtain sensitive information.

  29. 7.5CVE-2021-46420EPSS 5.7%

    Franklin Fueling Systems FFS TS-550 evo 2.23.4.8936 is affected by an unauthenticated directory traversal vulnerability, which allows an attacker to obtain sensitive information.

  30. 8.1CVE-2022-28527EPSS 1.1%

    dhcms v20170919 was discovered to contain an arbitrary folder deletion vulnerability via /admin.php?r=admin/AdminBackup/del.

  31. 8.1CVE-2022-28523EPSS 1.1%

    HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.

  32. 8.1CVE-2022-28059EPSS 1.2%

    Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\database_controller.php.

  33. 8.1CVE-2022-28058EPSS 1.2%

    Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\file_controller.php.

  34. 8.8CVE-2021-26629EPSS 1.6%

    A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is decompressed, an arbitrary file can be d in the parent path by using the path traversal pattern ‘.…

  35. 9.8CVE-2022-29806ExploitEPSS 67%

    ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.

  36. 9.8CVE-2022-23457EPSS 2.8%

    ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorr…

  37. 7.5CVE-2021-35250ExploitEPSS 13%

    A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1.

  38. 7.5CVE-2022-1392ExploitEPSS 11%

    The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues

  39. 9.8CVE-2022-1391ExploitEPSS 15%

    The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues.

  40. 9.8CVE-2022-1390ExploitEPSS 22%

    The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the …

  41. 8.1CVE-2021-40680EPSS 1.4%

    There is a Directory Traversal vulnerability in Artica Proxy (4.30.000000 SP206 through SP255, and VMware appliance 4.30.000000 through SP273) via the filename parameter to /cgi-bin/main.cgi.

  42. 7.5CVE-2022-24424EPSS 1.7%

    Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized read access to the files stored on the se…

  43. 7.5CVE-2022-28444EPSS 1.5%

    UCMS v1.6 was discovered to contain an arbitrary file read vulnerability.

  44. 6.5CVE-2022-20790EPSS 1.9%

    A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker t…

  45. 7.2CVE-2022-27925KEVExploitEPSS 99%

    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, lea…

  46. 5.9CVE-2021-43988EPSS 0.9%

    The affected product is vulnerable to a network-based attack by threat actors utilizing crafted naming conventions of files to gain unauthorized access rights.

  47. 7.5CVE-2022-1119ExploitEPSS 20%

    The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a pa…

  48. 8.8CVE-2021-44519EPSS 2.8%

    In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to remote code execution.

  49. 9.8CVE-2022-29464KEVExploitEPSS >99.9%

    Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such a…

  50. 8.8CVE-2022-29281EPSS 1.6%

    Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link. There is improper validation of the file URI scheme. A hyperlink to an SMB share could lead to execution of an arbitrary progr…