cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 25

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE

Ask an AI about CWE-22

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-64826EPSS 0.5%

    rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method.…

  2. 8.5CVE-2026-16033EPSS 0.5%

    A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from esca…

  3. 8.8CVE-2026-13622EPSS 0.2%

    A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink…

  4. 8.8CVE-2026-13105EPSS 0.5%

    IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration.

  5. 9.0CVE-2026-73407EPSS 0.5%

    Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to …

  6. 6.5CVE-2026-17266EPSS 0.7%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

  7. 4.3CVE-2026-18106EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input.

  8. 7.1CVE-2026-17094EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability.

  9. 5.3CVE-2026-66384KEVEPSS 0.7%

    An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

  10. 6.8CVE-2026-65939EPSS 0.4%

    In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.

  11. 7.1CVE-2026-73291EPSS 0.4%

    Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache file…

  12. 6.3CVE-2026-67286EPSS 0.5%

    Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name.

  13. 4.3CVE-2026-66382EPSS 0.4%

    An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

  14. 5.3CVE-2026-66381EPSS 0.4%

    A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.

  15. 9.2CVE-2026-67285EPSS 0.5%

    Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.

  16. 8.1CVE-2026-19594EPSS 0.5%

    Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal (CWE-22) via unencoded `..` identifier path seg…

  17. 5.3CVE-2026-63134EPSS 0.4%

    Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname)…

  18. 5.3CVE-2026-73244EPSS 0.4%

    kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path p…

  19. 7.8CVE-2026-73234EPSS 0.2%

    FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore() in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the docume…

  20. 9.3CVE-2026-73034ExploitEPSS 5.7%

    DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Pytho…

  21. 6.8CVE-2026-71475EPSS 0.7%

    A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly i…

  22. 8.1CVE-2026-19091EPSS 1.1%

    The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to,…

  23. 8.1CVE-2026-73227EPSS 0.5%

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP cl…

  24. 8.1CVE-2026-73225EPSS 0.5%

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory becaus…

  25. 8.1CVE-2026-73223EPSS 0.5%

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-co…

  26. 8.7CVE-2026-72713EPSS 0.8%

    XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the `file_name` form field …

  27. 8.6CVE-2026-48441EPSS 0.3%

    Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitiv…

  28. 9.8CVE-2026-65768EPSS 0.9%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.

  29. 5.5CVE-2026-48446EPSS 0.3%

    CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access se…

  30. 7.1CVE-2026-48442EPSS 0.3%

    CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain…

  31. 5.4CVE-2026-32677EPSS 0.2%

    Path traversal for some gaudi-container-runtime before version 1.24.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack m…

  32. 8.5CVE-2026-73079EPSS 0.4%

    Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider a…

  33. 7.1CVE-2026-18640EPSS 0.4%

    The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of …

  34. 6.9CVE-2026-72783EPSS 0.2%

    Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path bef…

  35. 4.9CVE-2026-72773EPSS 0.6%

    n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside…

  36. 7.1CVE-2026-72770EPSS 0.7%

    n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execut…

  37. 6.5CVE-2026-72604EPSS 0.5%

    A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path d…

  38. 7.5CVE-2026-72602EPSS 0.7%

    A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoin…

  39. 6.8CVE-2026-33922EPSS 0.2%

    A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could s…

  40. 5.9CVE-2026-66777EPSS 0.4%

    SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests …

  41. 7.6CVE-2026-44763EPSS 0.4%

    SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently acces…

  42. 7.0CVE-2026-73033EPSS 0.9%

    Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying…

  43. 7.2CVE-2026-73030EPSS 0.6%

    unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. At…

  44. 8.1CVE-2026-72903EPSS 0.5%

    Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir() and _make…

  45. 6.9CVE-2026-69112EPSS 0.2%

    Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can s…

  46. 6.9CVE-2026-12339EPSS 0.5%

    A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successf…

  47. 9.3CVE-2026-47754EPSS 0.5%

    Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=re…

  48. 5.5CVE-2026-15059EPSS 0.2%

    Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.

  49. 7.5CVE-2026-72572EPSS 1.1%

    A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name…

  50. 7.5CVE-2026-72571EPSS 1.1%

    A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir param…