cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 37

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE

Ask an AI about CWE-22

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2026-8713ExploitEPSS 3.0%

    The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for u…

  2. 4.9CVE-2026-7547EPSS 0.6%

    The Woosa – Marktplaats for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in versions up to and including 2.0.4. This is due to insufficient path sanitization in the render_logs_ui() function, whi…

  3. 9.3CVE-2026-54414EPSS 0.7%

    FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by Fol…

  4. 8.7CVE-2026-56078EPSS 0.9%

    PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite a…

  5. 7.7CVE-2026-54017EPSS 0.5%

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the terminal-server reverse proxy in `backend/open_webui/routers/terminals.py` does not fully confine the user-controlled `p…

  6. 8.7CVE-2026-48716EPSS 0.3%

    nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge/src/whatsapp.ts constructs a filesystem path using the fileName field from an incoming WhatsApp document message without sanitization. The…

  7. 8.6CVE-2026-54223EPSS 0.6%

    UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any file on the application’s server that application has privileges to, what results in Remote Code Execution.  Because ven…

  8. 7.1CVE-2026-8811EPSS 0.3%

    SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible l…

  9. 9.3CVE-2026-48768EPSS 0.3%

    TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT U…

  10. 6.5CVE-2026-12568EPSS 0.3%

    The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path …

  11. 5.3CVE-2026-12565EPSS 0.2%

    The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addresse…

  12. 6.3CVE-2026-48820EPSS 0.3%

    CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element…

  13. 7.1CVE-2026-49133EPSS 0.3%

    Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parame…

  14. 7.4CVE-2026-55201EPSS 0.3%

    Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by retu…

  15. 8.7CVE-2026-53872EPSS 0.5%

    picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen. Attackers can bypass RCE-focused blocklist…

  16. 9.1CVE-2026-20181EPSS 8.9%

    A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid admi…

  17. 7.7CVE-2026-54193EPSS 0.3%

    Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.

  18. 6.5CVE-2026-52716EPSS 0.3%

    Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.

  19. 8.6CVE-2025-69128EPSS 0.5%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCareer: from n/a through 7.3.

  20. 7.5CVE-2026-9690EPSS 0.3%

    Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.

  21. 9.1CVE-2026-50203EPSS 0.6%

    A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-en…

  22. 10.0CVE-2026-48055EPSS 0.7%

    Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does …

  23. 6.5CVE-2026-47277EPSS 0.4%

    Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read th…

  24. 6.5CVE-2026-40724EPSS 0.4%

    CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.

  25. 8.6CVE-2026-27400EPSS 0.5%

    Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.

  26. 7.5CVE-2026-22334EPSS 0.5%

    Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.

  27. 9.8CVE-2026-10094EPSS 0.4%

    A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 through SOLIDWORKS Desktop Release 2026 could allow an attacker to write arbitrary files on the server.

  28. 8.6CVE-2025-69139EPSS 0.5%

    Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions.

  29. 7.5CVE-2025-69131EPSS 0.5%

    Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.

  30. 7.7CVE-2025-60223EPSS 0.4%

    Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions.

  31. 7.5CVE-2024-32729EPSS 0.4%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Path Traversal. This issue affects Conversational Forms for ChatBot: from n/a through 1.1…

  32. 9.1CVE-2026-48776EPSS 0.2%

    LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied …

  33. 9.3CVE-2026-48777EPSS 0.5%

    FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-contro…

  34. 8.1CVE-2026-8442EPSS 0.5%

    The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers com…

  35. 9.9CVE-2026-49766EPSS 0.5%

    Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.

  36. 7.5CVE-2026-49061EPSS 0.4%

    Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.

  37. 7.7CVE-2026-40779EPSS 0.3%

    Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions.

  38. 8.6CVE-2026-40769EPSS 0.4%

    Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi &#8211; Save Entries, File Upload &amp; Country Code Field <= 1.0.6 versions.

  39. 7.7CVE-2026-40727EPSS 0.3%

    Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.

  40. 4.4CVE-2026-39489EPSS 0.3%

    Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.

  41. 6.8CVE-2026-39468ExploitEPSS 1.2%

    Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.

  42. 7.5CVE-2026-50877EPSS 0.6%

    An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names containing traversal characters.

  43. 9.8CVE-2026-50869EPSS 0.7%

    An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request.

  44. 9.1CVE-2026-45390EPSS 0.4%

    In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. This is not desired behavior, and tar(1) rejects such extractions, but ocaml-tar decompresses it anyway. The imp…

  45. 6.5CVE-2026-20262KEVEPSS 29%

    A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability ex…

  46. 8.7CVE-2016-20081EPSS 0.6%

    WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-downlo…

  47. 8.7CVE-2016-20076EPSS 0.6%

    WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tool…

  48. 2.0CVE-2026-12211EPSS 0.4%

    A flaw has been found in Intelbras iNVU 7016 FT 3.004.00IB000.0.T Build 2025-09-26. This impacts an unknown function of the file /RPC2_Loadfile/syslog/ of the component Web Interface. Executing a manipulation can lead to path traversal. Th…

  49. 5.5CVE-2026-12198EPSS 0.5%

    A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can le…

  50. 3.4CVE-2026-9062ExploitEPSS 0.5%

    The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration fil…