cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 134

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 5
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-126 Path Traversal Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-22, as MITRE names them. Credits.

Ask an AI about CWE-22

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2021-42787EPSS 1.3%

    It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentConfigurationServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/agent/configuration" API. The affected endpoint does not ha…

  2. 7.5CVE-2022-24716ExploitEPSS 89%

    Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration…

  3. 8.8CVE-2022-24715ExploitEPSS 15%

    Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbi…

  4. 8.7CVE-2021-32008EPSS 1.0%

    This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories.

  5. 4.9CVE-2022-26484EPSS 2.7%

    An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize admin/cgi-bin/rulemgr.pl/getfile/ input data, allowing a remote authenticated ad…

  6. 7.5CVE-2021-46381ExploitEPSS 59%

    Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].

  7. 9.8CVE-2021-3762EPSS 4.8%

    A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentiall…

  8. 8.1CVE-2021-41002EPSS 1.0%

    Multiple authenticated remote path traversal vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Swi…

  9. 6.5CVE-2021-43070EPSS 0.6%

    Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2 may allow an authenticated attacker to retrieve arbitrary files from the u…

  10. 7.5CVE-2022-25634EPSS 2.0%

    Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.

  11. 6.5CVE-2022-24718EPSS 1.1%

    ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the `svg` property as an argument to the `build(MessagePageOpt…

  12. 9.1CVE-2021-42767EPSS 1.5%

    A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.

  13. 8.1CVE-2022-25412EPSS 1.1%

    Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile parameters.

  14. 5.3CVE-2022-26315EPSS 1.2%

    qrcp through 0.8.4, in receive mode, allows ../ Directory Traversal via the file name specified by the uploader.

  15. 6.5CVE-2021-24820EPSS 3.0%

    The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculat…

  16. 4.9CVE-2021-24689EPSS 1.3%

    The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack

  17. 6.5CVE-2021-44665ExploitEPSS 7.7%

    A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when downloading a project file via download.php.

  18. 8.8CVE-2021-44664ExploitEPSS 13%

    An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypass…

  19. 6.5CVE-2022-23135EPSS 1.4%

    There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destination path, an attacker with specific permissions could modify the FTP access path to access and modi…

  20. 4.3CVE-2022-22349EPSS 1.0%

    IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI configuration data. An authorized user could import invalid data which could be used for an …

  21. 7.5CVE-2021-45746EPSS 1.5%

    A Directory Traversal vulnerability exists in WeBankPartners wecube-platform 3.2.1 via the file variable in PluginPackageController.java.

  22. 7.5CVE-2020-27467ExploitEPSS 15%

    A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.

  23. 7.5CVE-2022-23612EPSS 1.9%

    OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subject to arbitrary file exfiltration due to failure to sanitize request when satisf…

  24. 6.5CVE-2022-0665EPSS 1.5%

    Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.

  25. 5.5CVE-2021-27755EPSS 0.3%

    "Sametime Android potential path traversal vulnerability when using File class"

  26. 5.5CVE-2021-27753EPSS 0.3%

    "Sametime Android PathTraversal Vulnerability"

  27. 8.8CVE-2021-25082ExploitEPSS 5.2%

    The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be c…

  28. 5.3CVE-2022-25358EPSS 1.1%

    A ..%2F path traversal vulnerability exists in the path handler of awful-salmonella-tar before 0.0.4. Attackers can only list directories (not read files). This occurs because the safe-path? Scheme predicate is not used for directories.

  29. 6.5CVE-2021-40841EPSS 1.1%

    A Path Traversal vulnerability for a log file in LiveConfig 2.12.2 allows authenticated attackers to read files on the underlying server.

  30. 6.5CVE-2022-0673EPSS 1.0%

    A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.

  31. 9.1CVE-2021-26619EPSS 0.9%

    An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerability to delete arbitrary files of unspecified number of users.

  32. 7.5CVE-2022-25298EPSS 1.7%

    This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files from the server.

  33. 7.5CVE-2022-22914EPSS 1.4%

    An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal.

  34. 7.5CVE-2022-24983EPSS 2.7%

    Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST response. When chained with CVE-2022-24984, this could lead to unauthenticated remote code execution on…

  35. 7.5CVE-2021-35380ExploitEPSS 37%

    A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the fil…

  36. 4.3CVE-2022-25188EPSS 1.2%

    Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file sys…

  37. 6.5CVE-2022-25178EPSS 1.7%

    Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files o…

  38. 7.5CVE-2021-43734ExploitEPSS 11%

    kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.

  39. 9.8CVE-2022-24977EPSS 6.4%

    ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSI…

  40. 4.4CVE-2021-44111EPSS 0.5%

    A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup.

  41. 7.5CVE-2021-22804EPSS 1.3%

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files being read in the context of the user running IGSS, due to missing validation of user supplied data i…

  42. 8.8CVE-2021-22748EPSS 1.9%

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code execution when a file is saved. Affected Product: C-Bus Toolkit (V1.15.9 and prior), C-Gate Server…

  43. 9.8CVE-2020-14523EPSS 2.3%

    Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.

  44. 8.1CVE-2022-24647EPSS 1.0%

    Cuppa CMS v1.0 was discovered to contain an arbitrary file deletion vulnerability via the unlink() function.

  45. 9.8CVE-2022-24312EPSS 3.5%

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end of file or create a new file in the context of the Data Server potentially leadin…

  46. 9.8CVE-2022-24311EPSS 3.5%

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by inserting at beginning of file or create a new file in the context of the Data Server potential…

  47. 5.4CVE-2022-23620EPSS 1.0%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when seri…

  48. 5.3CVE-2021-45286EPSS 1.7%

    Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php.

  49. 7.8CVE-2022-21999KEVExploitEPSS 41%

    Windows Print Spooler Elevation of Privilege Vulnerability

  50. 7.5CVE-2022-21193EPSS 2.0%

    Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an arbitrary file on the server via unspecified vectors.