CWE-25: Path Traversal: '/../filedir'
Filter
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.
What the weakness is: CWE-25 at MITRE. All weaknesses
Ask an AI about CWE-25
Show the prompt
Explain CWE-25: Path Traversal: '/../filedir' and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/25.html and https://cve.bz/cve/cwe/25?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.8CVE-2026-68959EPSS 0.7%
SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary…
- 5.3CVE-2026-23877EPSS 0.6%
Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (in…
- 7.2CVE-2025-68916EPSS 2.6%
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution.
- 5.5CVE-2025-58286EPSS 0.1%
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
- 5.3CVE-2025-0225EPSS 0.5%
A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is an unknown functionality of the file /setting/ClassFy/exampleDownload.html. The manipu…
- 7.7CVE-2023-6947EPSS 0.8%
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to …
- 7.5CVE-2024-2442EPSS 0.7%
Franklin Fueling System EVO 550 and EVO 5000 are vulnerable to a Path Traversal vulnerability that could allow an attacker to access sensitive files on the system.
- 9.6CVE-2023-52138EPSS 1.7%
Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives,…
- 7.5CVE-2023-6919EPSS 0.6%
Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. VGuard allows Absolute Path Traversal. This issue affects VGuard: before V500.0003.R008.4011.C0012.B351.C.
- 7.8CVE-2023-52076EPSS 1.1%
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing a…
- 7.5CVE-2023-6118EPSS 0.8%
Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal. This issue affects IP Camera: before b1130.1.0.1.
- 7.8CVE-2022-20818EPSS 0.6%
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An att…
- 7.8CVE-2022-20775KEVEPSS 12%
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker coul…