cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 145

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 5
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-126 Path Traversal Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-22, as MITRE names them. Credits.

Ask an AI about CWE-22

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.7CVE-2021-20668EPSS 0.9%

    Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL.

  2. 7.5CVE-2021-26294ExploitEPSS 17%

    An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/s…

  3. 8.8CVE-2021-26814EPSS 8.7%

    Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager…

  4. 7.8CVE-2021-28042EPSS 3.4%

    Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This can lead to remote code execution.

  5. 8.6CVE-2020-29134ExploitEPSS 28%

    The TOTVS Fluig platform allows path traversal through the parameter "file = .. /" encoded in base64. This affects all versions Fluig Lake 1.7.0, Fluig 1.6.5 and Fluig 1.6.4

  6. 9.8CVE-2021-26293EPSS 7.1%

    An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer…

  7. 5.5CVE-2021-26028EPSS 1.0%

    An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.

  8. 7.8CVE-2021-27065KEVExploitEPSS 99.8%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  9. 4.9CVE-2021-21514EPSS 5.4%

    Dell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote user with admin privileges could potentially exploit this vulnerability to view arbitrary files on the target system by…

  10. 5.3CVE-2021-22114EPSS 1.0%

    Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar,…

  11. 9.8CVE-2021-25833EPSS 44%

    A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vul…

  12. 5.5CVE-2020-9479EPSS 2.0%

    When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28…

  13. 9.1CVE-2021-25282ExploitEPSS 92%

    An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.

  14. 6.5CVE-2021-21298EPSS 1.1%

    Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with…

  15. 4.9CVE-2021-21064EPSS 8.5%

    Magento UPWARD-php version 1.1.4 (and earlier) is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 (and earlier) due to the upload feature. An attacker could potentially exploit this vulnerability to upl…

  16. 9.8CVE-2021-21972KEVExploitEPSS 99.8%

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlyi…

  17. 8.1CVE-2021-20661EPSS 2.5%

    Directory traversal vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.

  18. 7.4CVE-2021-20247EPSS 1.9%

    A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components…

  19. 7.8CVE-2021-22651EPSS 2.9%

    When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are, while process…

  20. 8.6CVE-2021-26725EPSS 1.1%

    Path Traversal vulnerability when changing timezone using web GUI of Nozomi Networks Guardian, CMC allows an authenticated administrator to read-protected system files. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3…

  21. 5.3CVE-2020-29453ExploitEPSS 20%

    The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF…

  22. 6.5CVE-2021-27328EPSS 6.4%

    Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. An authenticated user can decrypt firmware and can read sensitive information, such as a password or decryption key.

  23. 7.5CVE-2020-9050EPSS 3.8%

    Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system.

  24. 7.1CVE-2021-23340EPSS 1.3%

    This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). A…

  25. 7.5CVE-2021-20354EPSS 4.1%

    IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. I…

  26. 7.5CVE-2021-27367EPSS 1.7%

    Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal.

  27. 7.7CVE-2020-13550EPSS 3.5%

    A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted application can lead to information disclosure. An attacker can send an authenticated HTTP request to tri…

  28. 7.5CVE-2021-22857EPSS 1.8%

    The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily.

  29. 7.2CVE-2021-20072EPSS 1.5%

    Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to arbitrarily access and delete files via an authenticated directory traveral.

  30. 7.2CVE-2020-28337ExploitEPSS 17%

    A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the crede…

  31. 6.5CVE-2020-29026EPSS 1.5%

    A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with administrative permissions to read and write arbitrary files in the Linux file system. This issue affects:…

  32. 9.1CVE-2021-20651EPSS 1.9%

    Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary file or overwrite an existing file in a directory which can be accessed with the application privileges via unspecified ve…

  33. 7.8CVE-2021-21037EPSS 3.3%

    Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Path Traversal vulnerability. An unauthenticated attacker could leverage this vulnerability t…

  34. 7.5CVE-2021-22656EPSS 3.2%

    Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files.

  35. 7.2CVE-2020-27871EPSS 91%

    This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. Although authentication is required to exploit this vulnerability, the existing authentication mechanism …

  36. 6.5CVE-2020-27870EPSS 4.5%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1. Authentication is required to exploit this vulnerability. The specific flaw exists within ExportT…

  37. 9.6CVE-2020-26299EPSS 1.9%

    ftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulnerability. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP us…

  38. 7.5CVE-2021-21475EPSS 1.9%

    Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent di…

  39. 9.8CVE-2021-25140EPSS 13%

    A potential security vulnerability has been identified in the HPE Moonshot Provisioning Manager v1.20. The HPE Moonshot Provisioning Manager is an application that is installed in a VMWare or Microsoft Hyper-V environment that is used to s…

  40. 8.1CVE-2020-25237EPSS 21%

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2). When uploading files to an affected system using a zip container, the system does not correctly check i…

  41. 6.5CVE-2021-26719EPSS 1.4%

    A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain …

  42. 7.8CVE-2021-26575EPSS 0.4%

    The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletesolvideofile function.

  43. 7.8CVE-2021-26574EPSS 0.4%

    The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in libifc.so webdeletevideofile function.

  44. 5.5CVE-2020-36241EPSS 0.6%

    autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outs…

  45. 7.5CVE-2021-1297EPSS 3.7%

    Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to conduct directory traversal attacks and overwrit…

  46. 7.5CVE-2021-1296EPSS 3.7%

    Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to conduct directory traversal attacks and overwrit…

  47. 6.5CVE-2020-27994EPSS 4.0%

    SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.

  48. 7.5CVE-2020-29166EPSS 2.3%

    PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure.

  49. 6.8CVE-2021-21284EPSS 1.1%

    In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remappe…

  50. 9.1CVE-2020-15097EPSS 2.1%

    loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsear…