cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 6

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE

Ask an AI about CWE-22

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-61702EPSS 0.4%

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory compon…

  2. 8.8CVE-2026-85634EPSS 0.4%

    A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deploym…

  3. 6.5CVE-2026-78851EPSS 1.1%

    Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.

  4. 8.9CVE-2026-62679EPSS 0.4%

    Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before cano…

  5. 5.9CVE-2026-58393EPSS 0.4%

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/…

  6. 9.9CVE-2026-57155EPSS 0.9%

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV countr…

  7. 5.5CVE-2026-63130EPSS 0.3%

    EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside th…

  8. 7.8CVE-2026-110746EPSS 0.2%

    A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHO…

  9. 8.4CVE-2026-104025EPSS 0.2%

    Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with..…

  10. 9.3CVE-2026-50619EPSS 0.4%

    A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the follow…

  11. 8.7CVE-2026-34015EPSS 0.4%

    A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed th…

  12. 7.2CVE-2026-26243EPSS 0.4%

    A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed th…

  13. 8.7CVE-2026-41544EPSS 0.4%

    A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vu…

  14. 5.3CVE-2026-24718EPSS 0.4%

    A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed th…

  15. 7.7CVE-2025-66275EPSS 0.4%

    A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed th…

  16. 7.7CVE-2025-66272EPSS 0.4%

    A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed th…

  17. 5.4CVE-2026-62664EPSS 0.3%

    FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::create…

  18. 6.5CVE-2026-104107EPSS 0.4%

    FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input befor…

  19. 4.3CVE-2026-0312EPSS 0.1%

    Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.

  20. 5.3CVE-2026-110766EPSS 0.3%

    Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to…

  21. 6.9CVE-2026-110666EPSS 0.5%

    A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the component File Upload. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The p…

  22. 8.2CVE-2026-100406EPSS 0.4%

    dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/que…

  23. 8.1CVE-2026-104103EPSS 0.5%

    Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate …

  24. 7.1CVE-2026-92153EPSS 0.4%

    F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the pa…

  25. 6.9CVE-2026-110717EPSS 0.5%

    Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filename…

  26. 4.8CVE-2026-110657EPSS 0.2%

    Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef wit…

  27. 9.8CVE-2026-59774ExploitEPSS 28%

    Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessi…

  28. 6.5CVE-2026-101217EPSS 0.6%

    Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially exploit this v…

  29. 8.6CVE-2026-107508EPSS 0.5%

    The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configur…

  30. 3.7CVE-2026-110458EPSS 0.3%

    A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device.

  31. 3.7CVE-2026-110457EPSS 0.3%

    A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device.

  32. 5.1CVE-2026-53564EPSS 0.4%

    Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.

  33. 5.5CVE-2026-103820EPSS 0.2%

    CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to wri…

  34. 9.3CVE-2026-90530EPSS 0.3%

    ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive f…

  35. 5.5CVE-2026-79715EPSS 0.1%

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended dire…

  36. 8.7CVE-2026-63162EPSS 0.7%

    Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination…

  37. 7.7CVE-2026-106634EPSS 0.5%

    Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnera…

  38. 9.6CVE-2026-102238EPSS 0.8%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

  39. 6.5CVE-2026-85932EPSS 1.2%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  40. 6.5CVE-2026-70298EPSS 1.2%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

  41. 7.3CVE-2026-70161EPSS 0.5%

    Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.

  42. 5.5CVE-2026-70084EPSS 0.5%

    Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally.

  43. 6.5CVE-2026-69973EPSS 0.8%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Libarchive allows an unauthorized attacker to perform tampering over a network.

  44. 8.8CVE-2026-69943EPSS 1.2%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  45. 6.7CVE-2026-110235EPSS 0.3%

    MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named .…

  46. 4.6CVE-2026-110232EPSS 0.2%

    Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like…

  47. 5.6CVE-2026-110231EPSS 0.3%

    muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZI…

  48. 5.3CVE-2026-110212EPSS 0.4%

    Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply p…

  49. 8.8CVE-2026-105727EPSS 1.0%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.

  50. 6.8CVE-2026-102229EPSS 1.1%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.