cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 157

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 5
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-126 Path Traversal Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-22, as MITRE names them. Credits.

Ask an AI about CWE-22

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2019-18189EPSS 4.5%

    A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) may allow an attacker to bypass authentication and log on to an affected product's management console as a root…

  2. 7.5CVE-2019-18187KEVEPSS 25%

    Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could poten…

  3. 9.8CVE-2019-14450EPSS 10%

    A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of a user controlled XML file at an unintended location. When this is combined with CVE-2019-14451, a…

  4. 5.3CVE-2019-17224EPSS 1.2%

    The web interface of the Compal Broadband CH7465LG modem (version CH7465LG-NCIP-6.12.18.25-2p6-NOSH) is vulnerable to a /%2f/ path traversal attack, which can be exploited in order to test for the existence of a file pathname outside of th…

  5. 7.5CVE-2005-2349EPSS 1.8%

    Zoo 2.10 has Directory traversal

  6. 4.3CVE-2019-4400EPSS 1.4%

    IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view ar…

  7. 9.8CVE-2013-4658EPSS 9.3%

    Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share.

  8. 8.8CVE-2013-4855EPSS 1.5%

    D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outside of the Samba share.

  9. 5.3CVE-2019-18393ExploitEPSS 14%

    PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.

  10. 6.5CVE-2019-18212EPSS 2.8%

    XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via…

  11. 7.5CVE-2019-8238EPSS 4.7%

    Adobe Acrobat and Reader versions 2019.010.20100 and earlier; 2019.010.20099 and earlier versions; 2017.011.30140 and earlier version; 2017.011.30138 and earlier version; 2015.006.30495 and earlier versions; 2015.006.30493 and earlier vers…

  12. 7.5CVE-2019-18371ExploitEPSS 56%

    An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/c…

  13. 6.5CVE-2019-16986EPSS 1.4%

    In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.)

  14. 6.5CVE-2019-16985EPSS 1.1%

    In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows deletion of any file of the system.

  15. 6.5CVE-2019-16990EPSS 1.3%

    In FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname (base64 encoded) and allows a download of it.

  16. 6.5CVE-2019-14424EPSS 1.4%

    A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request.

  17. 4.4CVE-2019-15266EPSS 0.7%

    A vulnerability in the CLI of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to view system files that should be restricted. This vulnerability is due to improper sanitization of user-supplied inp…

  18. 6.5CVE-2019-12704EPSS 1.6%

    A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to view the contents of arbitrary files on an affected device. The vulnerability is…

  19. 9.8CVE-2019-17662ExploitEPSS 97%

    ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is s…

  20. 7.5CVE-2019-16279EPSS 20%

    A memory error in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of service via a crafted HTTP request.

  21. 9.8CVE-2019-16278KEVExploitEPSS 99.0%

    Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.

  22. 7.5CVE-2019-17538ExploitEPSS 11%

    Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring.

  23. 7.5CVE-2019-17537EPSS 1.6%

    Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substring.

  24. 7.5CVE-2010-5335EPSS 2.8%

    IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (script to basic/minimizer/index.php…

  25. 7.5CVE-2010-5334EPSS 2.6%

    IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (_c to basic/index.html) is not prop…

  26. 7.5CVE-2015-9480ExploitEPSS 13%

    The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.

  27. 7.5CVE-2015-9473EPSS 3.7%

    The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter.

  28. 7.5CVE-2015-9470EPSS 4.1%

    The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter.

  29. 7.5CVE-2015-9463EPSS 4.1%

    The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.

  30. 7.5CVE-2015-9464EPSS 3.7%

    The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.

  31. 6.5CVE-2019-17109EPSS 3.2%

    Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.

  32. 5.5CVE-2019-0074EPSS 0.4%

    A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series devices with Next-Generation Routing Engine (NG-RE) allows a local authenticated user to read sensitive system files. This issue onl…

  33. 9.8CVE-2019-17399EPSS 1.7%

    The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment.

  34. 7.5CVE-2019-17187EPSS 11%

    /var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for reading arbitrary files.

  35. 8.8CVE-2019-14657EPSS 3.7%

    Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file …

  36. 7.2CVE-2019-17314EPSS 1.9%

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user.

  37. 8.8CVE-2019-17313EPSS 2.0%

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.

  38. 8.8CVE-2019-17312EPSS 2.0%

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.

  39. 8.8CVE-2019-17311EPSS 2.0%

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.

  40. 7.5CVE-2019-17199ExploitEPSS 10.0%

    www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regular expression, as demonstrated by the a.jpg\.. substring.

  41. 7.8CVE-2019-17180EPSS 0.7%

    Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modifications on Windows in the context of NT AUTHORITY\SYSTEM. This could lead to denial of service, elevati…

  42. 7.5CVE-2019-17175EPSS 1.7%

    joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal.

  43. 6.5CVE-2019-16198EPSS 1.6%

    KSLabs KSWEB 3.93 allows ../ directory traversal, as demonstrated by the hostFile parameter.

  44. 4.9CVE-2019-12691EPSS 5.1%

    A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The vulnerability is due…

  45. 7.5CVE-2019-13343EPSS 2.2%

    Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServ…

  46. 7.5CVE-2019-8291EPSS 1.4%

    Online Store System v1.0 delete_file.php doesn't check to see if a user has administrative rights nor does it check for path traversal.

  47. 6.5CVE-2019-17073EPSS 1.8%

    emlog through 6.0.0beta allows remote authenticated users to delete arbitrary files via admin/template.php?action=del&tpl=../ directory traversal.

  48. 6.5CVE-2019-7618EPSS 1.5%

    A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running C…

  49. 9.8CVE-2019-15039ExploitEPSS 13%

    An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.

  50. 5.3CVE-2019-4423EPSS 2.7%

    IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on …