cve.bz

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path traversal), page 90

Filter

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

What the weakness is: CWE-22 at MITRE

Related attack patterns (CAPEC): 5
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-126 Path Traversal Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-22, as MITRE names them. Credits.

Ask an AI about CWE-22

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-22: Improper Limitation of a Pathname to a Restricted Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/22.html and https://cve.bz/cve/cwe/22?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.0CVE-2024-6786EPSS 0.6%

    The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configurat…

  2. 7.5CVE-2024-46649EPSS 1.0%

    eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder.

  3. 7.5CVE-2024-46648EPSS 0.9%

    eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scan_folder.

  4. 6.5CVE-2024-46647EPSS 0.8%

    eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via upload_files.

  5. 6.5CVE-2024-46646EPSS 0.8%

    eNMS up to 4.7.1 is vulnerable to Directory Traversal via /download/file.

  6. 7.5CVE-2024-46645EPSS 0.9%

    eNMS 4.0.0 is vulnerable to Directory Traversal via get_tree_files.

  7. 6.5CVE-2024-46644EPSS 0.8%

    eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via edit_file.

  8. 5.3CVE-2024-9032EPSS 0.8%

    A vulnerability, which was classified as critical, was found in SourceCodester Simple Forum-Discussion System 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument page leads to path traversal. It is…

  9. 9.8CVE-2024-33109EPSS 0.9%

    Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via the Ringtone upload function.

  10. 9.1CVE-2024-8963KEVExploitEPSS 99%

    Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

  11. 9.8CVE-2024-46376EPSS 1.1%

    Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the update_account() function of the file rental/admin_class.php.

  12. 9.8CVE-2024-46375EPSS 1.1%

    Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup() function of the file rental/admin_class.php.

  13. 7.7CVE-2024-46987ExploitEPSS 15%

    Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController's download_private_file method allows authenticated users to download any file on the we…

  14. 9.9CVE-2024-46986ExploitEPSS 37%

    Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to a…

  15. 7.5CVE-2024-45601EPSS 0.3%

    Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The…

  16. 6.5CVE-2024-45816EPSS 0.7%

    Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not inte…

  17. 4.3CVE-2024-45604EPSS 0.4%

    Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for …

  18. 7.2CVE-2024-42501EPSS 1.2%

    An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned packages on the underlying operating system, enabling the threat actor to execute a…

  19. 8.1CVE-2021-27916EPSS 0.8%

    Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete files other than those in the media folders…

  20. 8.2CVE-2024-47049EPSS 0.6%

    The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.

  21. 5.5CVE-2024-44190EPSS 0.2%

    A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to read arbitrary files.

  22. 5.5CVE-2024-44167EPSS 0.6%

    This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, visionOS 2. An app may be able to overwrite arbitrary files.

  23. 5.5CVE-2024-27869EPSS 0.5%

    The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to record the screen without an indicator.

  24. 9.3CVE-2024-8752ExploitEPSS 12%

    The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system.

  25. 6.5CVE-2024-8778EPSS 0.6%

    OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files.

  26. 5.3CVE-2024-8876EPSS 0.8%

    A vulnerability, which was classified as problematic, has been found in xiaohe4966 TpMeCMS up to 1.3.3.1. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to pat…

  27. 5.3CVE-2024-8875EPSS 0.9%

    A vulnerability classified as critical was found in vedees wcms up to 0.3.2. Affected by this vulnerability is an unknown functionality of the file /wex/finder.php. The manipulation of the argument p leads to path traversal. The attack can…

  28. 5.1CVE-2024-8865EPSS 0.9%

    A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\server\api.py. The manipulation of the argument file leads to path traversal. The …

  29. 5.3CVE-2024-8782EPSS 0.7%

    A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/template/edit. The manipulation of the argument name leads to path traversal. The attack may be init…

  30. 7.5CVE-2024-38816ExploitEPSS 21%

    Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also…

  31. 8.6CVE-2024-7961EPSS 1.0%

    A path traversal vulnerability exists in the Rockwell Automation affected product. If exploited, the threat actor could upload arbitrary files to the server that could result in a remote code execution.

  32. 5.3CVE-2024-8707EPSS 0.5%

    A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function downfile of the file application/admin/controller/Appadmin.php. The manipulation o…

  33. 5.3CVE-2024-8706EPSS 0.7%

    A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument…

  34. 5.1CVE-2024-8694EPSS 0.8%

    A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation…

  35. 9.2CVE-2024-7609EPSS 0.5%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vidco Software VOC TESTER allows Path Traversal. This issue affects VOC TESTER: before 12.34.8.

  36. 8.8CVE-2024-45593EPSS 0.6%

    Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which …

  37. 6.0CVE-2024-21753EPSS 0.8%

    A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.4, FortiClientEMS 7.0 all versions, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versi…

  38. 7.5CVE-2024-44867EPSS 1.0%

    phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.

  39. 7.5CVE-2024-37728ExploitEPSS 1.9%

    Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensitive information via the "Pic/Indexes" interface

  40. 4.3CVE-2024-0067EPSS 0.4%

    Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folder/file names on the local file system of the Axis device. Axis has released pat…

  41. 7.5CVE-2024-44720EPSS 0.7%

    SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.

  42. 6.5CVE-2024-8585EPSS 0.7%

    Orca HCM from LEARNING DIGITA does not properly restrict a specific parameter of the file download functionality, allowing a remote attacker with regular privileges to download arbitrary system files.

  43. 7.8CVE-2024-40712EPSS 0.3%

    A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE).

  44. 7.7CVE-2023-30584EPSS 0.3%

    A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the tim…

  45. 4.3CVE-2024-8538EPSS 0.6%

    The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2. This is due the plugin not sanitizing a file path in an error message. This ma…

  46. 6.5CVE-2024-21904EPSS 0.4%

    A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have…

  47. 6.5CVE-2023-51366EPSS 0.5%

    A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have…

  48. 10.0CVE-2024-6445EPSS 0.6%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DataFlowX Technology DataDiodeX allows Path Traversal. This issue affects DataDiodeX: from v3.0.0 before v3.1.7.

  49. 7.1CVE-2024-45401EPSS 0.2%

    stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prior to version 1.21.3 where a plugin package containing a manifest with a malformed plugin shortname …

  50. 8.8CVE-2024-45175EPSS 0.7%

    An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive information, for example login credentials of cameras, is stored in cleartext. Thus, an a…