cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 159

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 5
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-126 Path Traversal Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-22, as MITRE names them. Credits.

Ask an AI about CWE-22

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2019-13237ExploitEPSS 7.3%

    In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.js…

  2. 6.5CVE-2019-15055EPSS 2.2%

    MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows the…

  3. 7.5CVE-2019-11654EPSS 2.6%

    Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files.

  4. 5.3CVE-2019-15520EPSS 1.9%

    comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.

  5. 9.8CVE-2019-15519EPSS 3.0%

    Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.

  6. 5.3CVE-2019-15518EPSS 2.0%

    Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.

  7. 5.5CVE-2019-15517EPSS 0.7%

    jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.

  8. 7.5CVE-2019-15516EPSS 2.2%

    Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.

  9. 7.5CVE-2019-15326EPSS 2.3%

    The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.

  10. 8.1CVE-2017-18585EPSS 2.0%

    The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.

  11. 9.1CVE-2017-18586EPSS 2.5%

    The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.

  12. 9.1CVE-2014-10390EPSS 2.5%

    The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.

  13. 7.5CVE-2019-14751EPSS 5.7%

    NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

  14. 7.5CVE-2019-11029EPSS 2.5%

    Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system f…

  15. 6.5CVE-2019-11013ExploitEPSS 26%

    Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of the restricted directory on…

  16. 7.5CVE-2019-15323EPSS 2.0%

    The ad-inserter plugin before 2.4.20 for WordPress has path traversal.

  17. 7.5CVE-2016-10924ExploitEPSS 12%

    The ebook-download plugin before 1.2 for WordPress has directory traversal.

  18. 7.5CVE-2019-11603EPSS 2.4%

    A HTTP Traversal Attack in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2 allows remote attackers to read files outside the http root.

  19. 7.5CVE-2019-11601EPSS 2.7%

    A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.

  20. 7.5CVE-2019-4460EPSS 2.6%

    IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary fi…

  21. 6.5CVE-2019-3967EPSS 29%

    In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system.

  22. 7.8CVE-2019-9852EPSS 1.8%

    LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, …

  23. 8.8CVE-2019-12791EPSS 6.5%

    A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root via the password reset form.

  24. 5.3CVE-2018-14672EPSS 1.7%

    In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.

  25. 8.8CVE-2019-14788EPSS 3.7%

    wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunctio…

  26. 9.1CVE-2019-12479EPSS 2.0%

    An issue was discovered in 20|20 Storage 2.11.0. A Path Traversal vulnerability in the TwentyTwenty.Storage library in the LocalStorageProvider allows creating and reading files outside of the specified basepath. If the application using t…

  27. 8.8CVE-2019-14530ExploitEPSS 66%

    An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for th…

  28. 7.8CVE-2019-3744EPSS 0.4%

    Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software packag…

  29. 4.9CVE-2019-14798EPSS 4.4%

    The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.

  30. 6.5CVE-2019-14312ExploitEPSS 21%

    Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename…

  31. 6.7CVE-2019-1952EPSS 0.7%

    A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to overwrite or read arbitrary files. The attacker would need valid administrator privilege-level credentials. …

  32. 7.5CVE-2019-14701EPSS 2.3%

    An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can trigger read operations on an arbitrary file via Path Traversal in the TZ parameter, but cannot retrieve the data that is read. This…

  33. 7.5CVE-2019-14700EPSS 2.1%

    An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. There is disclosure of the existence of arbitrary files via Path Traversal in HTTPD. This occurs because the filename specified in the TZ parameter …

  34. 7.5CVE-2019-14521EPSS 2.4%

    The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter.

  35. 7.5CVE-2019-7859EPSS 1.5%

    A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.

  36. 5.3CVE-2017-18448EPSS 1.2%

    cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).

  37. 7.8CVE-2019-10168EPSS 0.5%

    The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libv…

  38. 7.8CVE-2019-10167EPSS 0.5%

    The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that pro…

  39. 8.8CVE-2016-10828EPSS 2.6%

    cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).

  40. 8.6CVE-2019-10185EPSS 4.0%

    It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to r…

  41. 6.5CVE-2019-10182EPSS 2.7%

    It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary fi…

  42. 7.5CVE-2019-14452EPSS 3.7%

    Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.

  43. 7.8CVE-2019-10161EPSS 0.5%

    It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd proces…

  44. 7.2CVE-2019-10152EPSS 0.5%

    A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to b…

  45. 9.1CVE-2019-13635EPSS 44%

    The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.

  46. 8.8CVE-2019-14418EPSS 4.1%

    An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a VRP user with sufficient privileges to overwrite any file in the VRP virtual ma…

  47. 6.5CVE-2019-6726EPSS 4.3%

    The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php mishandle ../ in an HTTP Referer header.

  48. 7.5CVE-2019-1020001EPSS 2.3%

    yard before 0.9.20 allows path traversal.

  49. 5.4CVE-2019-14362EPSS 2.1%

    Openbravo ERP before 3.0PR19Q1.3 is affected by Directory Traversal. This vulnerability could allow remote authenticated attackers to replace a file on the server via the getAttachmentDirectoryForNewAttachment inpKey value.

  50. 7.5CVE-2019-14322ExploitEPSS 56%

    In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.