cve.bz

CWE-30: Path Traversal: '\dir\..\filename'

Filter

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\dir\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

What the weakness is: CWE-30 at MITRE. All weaknesses

Ask an AI about CWE-30

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-30: Path Traversal: '\dir\..\filename' and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/30.html and https://cve.bz/cve/cwe/30?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.0CVE-2026-79824EPSS 0.3%

    A directory traversal vulnerability in HPE NonStop Python 3.x could allow  attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.

  2. 7.3CVE-2025-54386EPSS 1.4%

    Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discovered in WASM Traefik’s plugin installation mechanism. By supplying a maliciously…