cve.bz

CWE-23: Relative Path Traversal, page 3

Filter

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

What the weakness is: CWE-23 at MITRE

Ask an AI about CWE-23

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-23: Relative Path Traversal and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/23.html and https://cve.bz/cve/cwe/23?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2026-50663EPSS 0.9%

    Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network.

  2. 8.0CVE-2026-40400EPSS 0.9%

    Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

  3. 6.5CVE-2026-14903EPSS 1.2%

    Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

  4. 7.1CVE-2026-55474EPSS 0.5%

    Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to t…

  5. 9.8CVE-2026-59792EPSS 0.6%

    In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

  6. 7.1CVE-2026-50181EPSS 0.2%

    Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `WriteFileTool` appear to treat `curr_dir` as the intended working-directory boundary for file operation…

  7. 7.7CVE-2026-59832EPSS 0.5%

    SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath co…

  8. 6.5CVE-2026-59149EPSS 0.5%

    Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBas…

  9. 8.6CVE-2026-61343EPSS 1.0%

    LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template director…

  10. 7.5CVE-2026-8650EPSS 0.6%

    Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

  11. 5.4CVE-2026-59996EPSS 0.2%

    scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

  12. 5.4CVE-2026-59995EPSS 0.2%

    sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

  13. 8.0CVE-2026-14476EPSS 0.7%

    A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files …

  14. 7.1CVE-2026-57871EPSS 0.5%

    Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: through 1.0.0-alpha3.

  15. 8.0CVE-2025-53829EPSS 0.5%

    ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with administrative privileges can exploit a path traversal vulnerability in the system to execute arbitrary code. U…

  16. 5.5CVE-2026-58522EPSS 0.4%

    Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

  17. 7.1CVE-2026-57988EPSS 0.8%

    Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  18. 8.8CVE-2026-44941EPSS 0.5%

    A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.

  19. 2.4CVE-2026-8387EPSS 0.4%

    A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting `.zip` archives using the `ZipFile.extractall()` method in `StorageManager._extract_to_cache()`. This issue arises …

  20. 5.3CVE-2026-44948EPSS 0.5%

    A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, c…

  21. 7.5CVE-2026-8023EPSS 0.9%

    Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM is enabled) that serves files from a configured root directory. Before this fix, both th…

  22. 8.8CVE-2026-25707EPSS 0.6%

    A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escal…

  23. 8.8CVE-2026-50016EPSS 0.5%

    pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linki…

  24. 2.4CVE-2026-45188EPSS 0.2%

    Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

  25. 7.5CVE-2026-54066ExploitEPSS 2.2%

    SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the /export/ route but the identical root cause remains in the /assets/*path r…

  26. 10.0CVE-2026-52813EPSS 1.1%

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allo…

  27. 7.3CVE-2026-41046EPSS 0.2%

    A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious config files for snapper and so cause a denial of service or potentially escalate privileges to root.

  28. 7.6CVE-2026-49290EPSS 0.8%

    Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal vulnerability in Slopsmith's archive extractors allows an attacker to write arbi…

  29. 5.1CVE-2026-10720EPSS 0.3%

    Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate…

  30. 8.6CVE-2026-8100EPSS 0.5%

    Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific conditions. This issue is due to improper handling of URL-encoded paths during request processing. In c…

  31. 7.1CVE-2026-34026EPSS 0.4%

    Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The application constructs a file path usin…

  32. 5.5CVE-2026-48569EPSS 0.4%

    Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

  33. 6.5CVE-2026-47287EPSS 0.8%

    Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.

  34. 8.1CVE-2026-48681EPSS 0.6%

    OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

  35. 8.1CVE-2026-5422EPSS 4.9%

    A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) with…

  36. 6.9CVE-2026-10074EPSS 0.3%

    DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing privileged local attackers to exploit Relative Path Traversal to download arbitrary system files.

  37. 8.7CVE-2026-10073EPSS 0.4%

    DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing unauthenticated local attackers to exploit Relative Path Traversal to download arbitrary system files.

  38. 10.0CVE-2026-8326EPSS 0.4%

    Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing arbitrary files in all directories as root. This leads to RCE. The affected component is the RDP drive redirection.  Depending…

  39. 7.5CVE-2025-41280EPSS 0.1%

    Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector …

  40. 8.7CVE-2025-41271EPSS 0.4%

    Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to read arbitrary files from the device.

  41. 8.8CVE-2025-41268EPSS 0.4%

    Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to delete arbitrary files on the …

  42. 8.5CVE-2025-48977EPSS 0.5%

    Relative Path Traversal vulnerability in Apache Ignite REST API. Authenticated REST API users can read any file on the server with "cmd=log" command and a log path crafted in a certain way. This issue affects Apache Ignite: from 2.0.0 thr…

  43. 7.5CVE-2026-8361EPSS 0.4%

    A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome

  44. 8.2CVE-2026-48126EPSS 0.3%

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory b…

  45. 9.4CVE-2026-8134EPSS 0.7%

    Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing …

  46. 6.7CVE-2026-34926KEVEPSS 13%

    A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vuln…

  47. 9.3CVE-2026-23734EPSS 19%

    XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki…

  48. 7.5CVE-2026-8073EPSS 0.6%

    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versio…

  49. 9.3CVE-2026-41948ExploitEPSS 23%

    Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can …

  50. 5.5CVE-2026-41612EPSS 0.5%

    Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.