CWE-23: Relative Path Traversal
Filter
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
What the weakness is: CWE-23 at MITRE
Ask an AI about CWE-23
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-23: Relative Path Traversal and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/23.html and https://cve.bz/cve/cwe/23?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.7CVE-2026-120312
Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save()…
- 8.7CVE-2026-120311
Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed …
- 9.9CVE-2026-120307
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default uploa…
- 8.5CVE-2026-120225
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traver…
- 6.1CVE-2026-61725EPSS 0.1%
sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In `src/util/decompress.rs`, `decompress_impl` comp…
- 7.1CVE-2026-119553EPSS 0.4%
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can uplo…
- 8.8CVE-2026-107239EPSS 0.6%
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.
- 3.8CVE-2026-90727EPSS 0.3%
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain…
- 6.5CVE-2026-68866EPSS 0.2%
PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Re…
- 9.3CVE-2026-115812EPSS 0.5%
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and …
- 5.3CVE-2026-114714EPSS 0.4%
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path sep…
- 8.7CVE-2026-114110EPSS 0.3%
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD referen…
- 7.5CVE-2026-111093EPSS 0.4%
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files
- 7.8CVE-2026-110746EPSS 0.2%
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHO…
- 7.3CVE-2026-103508EPSS 0.4%
P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging d…
- 8.6CVE-2026-41545EPSS 0.4%
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have alr…
- 8.7CVE-2026-39993EPSS 0.4%
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have alre…
- 9.8CVE-2026-76519KEVEPSS 2.2%
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to imp…
- 8.7CVE-2026-110690EPSS 0.9%
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the roo…
- 8.8CVE-2026-83923EPSS 1.0%
Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
- 7.8CVE-2026-83873EPSS 0.4%
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.
- 4.7CVE-2026-83865EPSS 0.3%
Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.
- 7.8CVE-2026-70222EPSS 0.4%
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.
- 6.5CVE-2026-69968EPSS 0.9%
Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering over a network.
- 5.3CVE-2026-105275EPSS 0.3%
Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could access file paths outside the intended directory and use obse…
- 8.7CVE-2026-101024EPSS 0.4%
Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations ac…
- 9.4CVE-2026-103663EPSS 0.7%
Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, …
- 9.1CVE-2026-76454EPSS 0.6%
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause…
- 6.5CVE-2026-90466EPSS 0.5%
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'. The startup flag 'trusted_jar_paths' references …
- 6.5CVE-2026-106552EPSS 0.4%
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
- 6.5CVE-2026-106490EPSS 0.4%
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage p…
- 8.5CVE-2026-103278EPSS 0.3%
Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visi…
- 8.5CVE-2026-10739EPSS 0.1%
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.
- 8.2CVE-2026-13224EPSS 0.4%
A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.
- 6.9CVE-2026-102252EPSS 0.09%
A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning…
- 9.1CVE-2026-8066EPSS 0.7%
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files a…
- 6.5CVE-2026-93537EPSS 0.3%
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem…
- 8.7CVE-2026-93468EPSS 0.7%
The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files.
- 8.4CVE-2026-55062EPSS 0.2%
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory compon…
- 7.2CVE-2026-76424EPSS 0.9%
A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker cou…
- 5.3CVE-2026-50024EPSS 0.5%
GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto temp_dst/.git/logs/,…
- 9.8CVE-2026-76440EPSS 0.6%
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review res…
- 8.6CVE-2026-82768EPSS 0.5%
Path traversal vulnerability exists in SGA1000. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker who can access the product via FTP.
- 8.6CVE-2026-82765EPSS 0.5%
Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker who can access the product via FTP.
- 8.6CVE-2023-45858EPSS 0.9%
A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.
- 4.3CVE-2023-40772EPSS 0.9%
A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.
- 3.3CVE-2023-32778EPSS 0.3%
An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload.
- 6.6CVE-2023-29377EPSS 0.5%
An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA ob…
- 6.8CVE-2026-89065EPSS 0.2%
Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the e…
- 9.1CVE-2026-84939EPSS 0.9%
Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default en…