cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 156

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 5
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-126 Path Traversal Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-22, as MITRE names them. Credits.

Ask an AI about CWE-22

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2019-16246EPSS 3.3%

    Intesync Solismed 3.3sp1 allows Local File Inclusion (LFI), a different vulnerability than CVE-2019-15931. This leads to unauthenticated code execution.

  2. 9.8CVE-2019-15931EPSS 2.7%

    Intesync Solismed 3.3sp allows Directory Traversal, a different vulnerability than CVE-2019-16246.

  3. 9.1CVE-2019-19374EPSS 3.4%

    An issue was discovered in core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_upload.inc in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior t…

  4. 9.1CVE-2019-19683EPSS 1.8%

    RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs.

  5. 7.5CVE-2019-14251ExploitEPSS 7.8%

    An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a document on the server once successfully authenticated. However, an attacker can leverage downloadDocServer() to traverse t…

  6. 9.8CVE-2019-7195KEVExploitEPSS 89%

    This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.

  7. 9.8CVE-2019-7194KEVExploitEPSS 83%

    This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.

  8. 6.5CVE-2019-19229EPSS 2.3%

    admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= Directory Traversal.

  9. 9.8CVE-2019-19459EPSS 3.5%

    An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. An attacker can write arbitrary content to arbitrary files, as demonstrated by CVE-2019-19458 files under the web root, or .bat files that will be used with auto start. This allows …

  10. 8.6CVE-2019-19458EPSS 2.8%

    SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature.

  11. 8.6CVE-2014-9356EPSS 4.9%

    Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.

  12. 5.3CVE-2015-2060EPSS 2.3%

    cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.

  13. 7.5CVE-2019-18922ExploitEPSS 24%

    A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] allows unauthenticated attackers to read arbitrary system files via a GET request. NOTE: This is an End-of-Life product.

  14. 7.5CVE-2019-19372EPSS 1.5%

    A downloadFile.php download_file path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully work…

  15. 10.0CVE-2019-18253EPSS 2.0%

    An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior) outside the intended directory.

  16. 8.8CVE-2019-10220EPSS 5.1%

    Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.

  17. 6.5CVE-2015-9538ExploitEPSS 10%

    The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.

  18. 6.5CVE-2011-4350ExploitEPSS 16%

    Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of arbitrary local files via specially-crafted URL request.

  19. 7.8CVE-2019-16765EPSS 5.4%

    If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed …

  20. 5.3CVE-2019-17406EPSS 1.1%

    Nokia IMPACT < 18A has path traversal that may lead to RCE if chained with CVE-2019-1743

  21. 7.5CVE-2015-1396EPSS 3.3%

    A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.

  22. 4.3CVE-2019-17404EPSS 1.0%

    Nokia IMPACT < 18A: allows full path disclosure

  23. 7.5CVE-2019-13157EPSS 1.7%

    nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive.

  24. 7.5CVE-2013-3311EPSS 3.7%

    Directory traversal vulnerability in the Loftek Nexus 543 IP Camera allows remote attackers to read arbitrary files via a .. (dot dot) in the URL of an HTTP GET request.

  25. 7.5CVE-2019-16758ExploitEPSS 17%

    In Lexmark Services Monitor 2.27.4.0.39 (running on TCP port 2070), a remote attacker can use a directory traversal technique using /../../../ or ..%2F..%2F..%2F to obtain local files on the host operating system.

  26. 7.5CVE-2019-10767EPSS 2.2%

    An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. **Note:**…

  27. 6.5CVE-2019-16540EPSS 1.6%

    A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitrary files on the Jenkins master.

  28. 9.8CVE-2019-10765EPSS 1.7%

    iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.

  29. 5.3CVE-2019-3423EPSS 1.3%

    permission and access control vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. An attacker can construct a URL for directory traversal and access to other unauthorized files or resources.

  30. 5.3CVE-2019-18978EPSS 2.5%

    An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.

  31. 9.8CVE-2013-3073EPSS 3.7%

    A Symlink Traversal vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34.

  32. 6.5CVE-2019-3662EPSS 1.4%

    Path Traversal: '/absolute/pathname/here' vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to gain unintended access to files on the system via carefully constructed HTTP requests.

  33. 7.5CVE-2019-18951ExploitEPSS 20%

    SibSoft Xfilesharing through 2.5.1 allows op=page&tmpl=../ directory traversal to read arbitrary files.

  34. 9.8CVE-2013-4657EPSS 1.9%

    Symlink Traversal vulnerability in NETGEAR WNR3500U and WNR3500L due to misconfiguration in the SMB service.

  35. 9.8CVE-2013-4654EPSS 2.7%

    Symlink Traversal vulnerability in TP-LINK TL-WDR4300 and TL-1043ND..

  36. 9.8CVE-2013-4656EPSS 2.2%

    Symlink Traversal vulnerability in ASUS RT-AC66U and RT-N56U due to misconfiguration in the SMB service.

  37. 5.3CVE-2019-18924EPSS 1.3%

    Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. By manipulating variables that reference files with ../ (and variations), it is possible to list all the directories and check if a particular file exists.

  38. 7.2CVE-2019-17327EPSS 2.7%

    JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary co…

  39. 7.5CVE-2019-16876EPSS 1.4%

    Portainer before 1.22.1 allows Directory Traversal.

  40. 7.5CVE-2019-15004EPSS 3.9%

    The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before…

  41. 5.3CVE-2019-15003EPSS 1.7%

    The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before…

  42. 4.3CVE-2014-9014ExploitEPSS 12%

    Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote authenticated users to download arbitrary files via a .. (dot dot) in the file …

  43. 6.5CVE-2019-10218EPSS 3.4%

    A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside…

  44. 7.5CVE-2019-18665ExploitEPSS 15%

    The Log module in SECUDOS DOMOS before 5.6 allows local file inclusion.

  45. 9.8CVE-2019-13551EPSS 4.9%

    Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Path traversal vulnerabilities are caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage these vulnerabilities to remotel…

  46. 6.5CVE-2019-17324EPSS 1.2%

    ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ../ characters. This could lead to create malicious HTML file, because they can inject a content with crafted template. U…

  47. 6.5CVE-2019-17322EPSS 1.2%

    ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to be written. This can be an executable file that is written to in the arbitrary directory. User inte…

  48. 8.8CVE-2019-3976EPSS 1.7%

    RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs a malicious package then a directory could…

  49. 5.5CVE-2019-10743EPSS 6.4%

    All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions. It is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archi…

  50. 9.8CVE-2009-3887EPSS 2.5%

    ytnef has directory traversal