cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 149

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 5
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-126 Path Traversal Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-22, as MITRE names them. Credits.

Ask an AI about CWE-22

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2020-25134EPSS 3.4%

    An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an in…

  2. 8.8CVE-2020-25133EPSS 2.6%

    An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an in…

  3. 8.8CVE-2020-24621EPSS 3.1%

    A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directo…

  4. 9.8CVE-2020-24626EPSS 3.0%

    Unathenticated directory traversal in the ReceiverServlet class doPost() method can lead to arbitrary remote code execution in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9.

  5. 7.5CVE-2020-24625EPSS 1.6%

    Unathenticated directory traversal in the ReceiverServlet class doGet() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9.

  6. 7.5CVE-2020-24624EPSS 1.6%

    Unathenticated directory traversal in the DownloadServlet class execute() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9.

  7. 7.2CVE-2020-3143EPSS 8.5%

    A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software, Cisco TelePresence Codec (TC) Software, and Cisco RoomOS Software could allow an authenticated, remote attacker to conduct directo…

  8. 6.5CVE-2020-3130EPSS 1.8%

    A vulnerability in the web management interface of Cisco Unity Connection could allow an authenticated remote attacker to overwrite files on the underlying filesystem. The vulnerability is due to insufficient input validation. An attacker …

  9. 7.2CVE-2020-14028EPSS 1.9%

    An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. By leveraging a path traversal vulnerability in the Autoreply module's Script Name, an attacker may write to or overwrite arbitrary files, with arbitrary content, usually with…

  10. 4.3CVE-2020-5605EPSS 1.1%

    Directory traversal vulnerability in WHR-G54S firmware 1.43 and earlier allows an attacker to access sensitive information such as setting values via unspecified vectors.

  11. 5.3CVE-2020-25734EPSS 2.1%

    webTareas through 2.1 allows files/Default/ Directory Listing.

  12. 9.6CVE-2020-15182EPSS 1.2%

    The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the adminis…

  13. 6.5CVE-2020-11700ExploitEPSS 7.1%

    An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter fname, used on the page certs-x.php, would allow an attacker to retrieve the contents of arbitrary files. The user has to be authenticated before inter…

  14. 5.5CVE-2020-7529EPSS 0.9%

    A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Transversal') vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows an attacker to place content in any unprotected folder on the…

  15. 6.5CVE-2020-2278EPSS 1.4%

    Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other '.xml' file on the Jenkins controller with a job config.xml file's conten…

  16. 6.5CVE-2020-2277EPSS 1.7%

    Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller.

  17. 6.5CVE-2020-2275EPSS 1.7%

    Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins con…

  18. 6.5CVE-2020-2254EPSS 2.1%

    Jenkins Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag that, when enabled, allows an attacker with Job/Configure or Job/Create permission to read arbitrary files on the Jenkins controller file system.

  19. 4.3CVE-2020-7268EPSS 1.0%

    Path Traversal vulnerability in McAfee McAfee Email Gateway (MEG) prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to constr…

  20. 6.5CVE-2020-4711EPSS 2.6%

    IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on th…

  21. 7.5CVE-2020-25540ExploitEPSS 75%

    ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.

  22. 7.5CVE-2020-25248EPSS 2.1%

    An issue was discovered in Hyland OnBase through 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Directory traversal exists for reading files, as demonstrated by the FileNa…

  23. 7.5CVE-2020-25247EPSS 1.5%

    An issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. Directory traversal exists for writing to files, as demonstrated by the FileName parameter.

  24. 7.5CVE-2019-20916EPSS 3.0%

    The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys fil…

  25. 6.5CVE-2020-3365EPSS 1.6%

    A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vuln…

  26. 7.5CVE-2020-25068EPSS 3.9%

    Setelsa Conacwin v3.7.1.2 is vulnerable to a local file inclusion vulnerability. This vulnerability allows a remote unauthenticated attacker to read internal files on the server via an http:IP:PORT/../../path/file_to_disclose Directory Tra…

  27. 9.8CVE-2020-6142EPSS 9.2%

    A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can cause local file inclusion. An attacker can send an HTTP request to trigger this vulnerability.

  28. 5.3CVE-2012-3337EPSS 2.0%

    IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to download arbitrary fi…

  29. 7.5CVE-2020-7669EPSS 1.8%

    This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction.

  30. 7.5CVE-2020-7666EPSS 1.5%

    This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based (relative and absolute) path traversal attacks in cpio file extraction.

  31. 7.5CVE-2020-7665EPSS 1.8%

    This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction.

  32. 9.8CVE-2020-7522EPSS 1.7%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earlier) when accessing a vulnerable method of `SoundUploadServlet` which may lead t…

  33. 9.8CVE-2020-7521EPSS 1.7%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earlier) when accessing a vulnerable method of `FileUploadServlet` which may lead to…

  34. 7.5CVE-2020-25032EPSS 3.9%

    An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.

  35. 8.0CVE-2020-14352EPSS 2.5%

    A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files out…

  36. 8.8CVE-2020-12456EPSS 3.1%

    A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notification window, due to improper rendering of chat messages. A successful exploit…

  37. 4.9CVE-2020-3490EPSS 3.0%

    A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrative privileges to conduct directory traversal attacks and obtain read access to se…

  38. 6.5CVE-2020-3440EPSS 2.6%

    A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an unauthenticated, remote attacker to overwrite arbitrary files on an end-user system. The vulnerability is due to improper validation of URL parameters that are …

  39. 8.8CVE-2020-17389EPSS 10%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism c…

  40. 8.8CVE-2020-17387EPSS 10%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism c…

  41. 8.8CVE-2020-15644EPSS 9.3%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism c…

  42. 8.8CVE-2020-15643EPSS 59%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism c…

  43. 7.5CVE-2020-15641EPSS 3.2%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the …

  44. 7.5CVE-2020-15640EPSS 3.2%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the …

  45. 9.8CVE-2020-15639EPSS 12%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the decryptF…

  46. 9.8CVE-2020-16245EPSS 7.7%

    Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code.

  47. 7.5CVE-2020-17385EPSS 1.6%

    Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly, which allows unauthorized user to launch Path Traversal attack and access arbitrate file on the system.

  48. 7.5CVE-2020-7377EPSS 1.1%

    The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write arbitrary files to arbitrary locations on the…

  49. 9.8CVE-2020-7376EPSS 1.1%

    The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can be exploited to write arbitrary files to arbitrary locations on the host filesys…

  50. 5.3CVE-2020-19877EPSS 1.7%

    DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information.