cve.bz

CWE-35: Path Traversal: '.../...//', page 2

Filter

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

What the weakness is: CWE-35 at MITRE. All weaknesses

Ask an AI about CWE-35

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-35: Path Traversal: '.../...//' and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/35.html and https://cve.bz/cve/cwe/35?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.6CVE-2025-58380EPSS 0.2%

    A vulnerability in Brocade Fabric OS before 9.2.1 could allow an authenticated attacker with admin privileges using the shell command “grep” to modify the path variables and move upwards in the directory structure or to traverse to differe…

  2. 8.8CVE-2025-59099EPSS 0.9%

    The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior a…

  3. 7.7CVE-2025-67914EPSS 0.3%

    Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through <= 2.3.8.

  4. 6.4CVE-2025-46256EPSS 0.3%

    Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows Path Traversal.This issue affects Advanced Database Cleaner PRO: from n/a through 3.2.10.

  5. 9.2CVE-2025-68428EPSS 2.2%

    jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsaniti…

  6. 6.5CVE-2025-28973EPSS 0.4%

    Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress pro-watermark allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through <= 2.0.

  7. 7.2CVE-2025-64676EPSS 1.0%

    '.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network.

  8. 4.9CVE-2025-64253EPSS 0.5%

    Path Traversal: '.../...//' vulnerability in WordPress.org Health Check & Troubleshooting health-check allows Path Traversal.This issue affects Health Check & Troubleshooting: from n/a through <= 1.7.1.

  9. 5.1CVE-2025-66004EPSS 0.2%

    A Path Traversal vulnerability in usbmuxd allows local users to escalate to the service user.This issue affects usbmuxd: before 3ded00c9985a5108cfc7591a309f9a23d57a8cba.

  10. 8.8CVE-2025-41736EPSS 0.8%

    A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution.

  11. 6.7CVE-2025-5454EPSS 0.2%

    An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the inst…

  12. 7.2CVE-2025-58972EPSS 0.5%

    Path Traversal: '.../...//' vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode…

  13. 8.1CVE-2025-48090EPSS 0.4%

    Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This issue affects Blanka - One Page WordPress Theme: from n/a through < 1.5.

  14. 8.1CVE-2025-39467EPSS 0.6%

    Path Traversal: '.../...//' vulnerability in Mikado-Themes Wanderland wanderland allows PHP Local File Inclusion.This issue affects Wanderland: from n/a through <= 1.7.1.

  15. 4.1CVE-2025-22288EPSS 0.3%

    Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a thro…

  16. 8.7CVE-2025-53880EPSS 0.3%

    A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the end…

  17. 8.6CVE-2025-27222ExploitEPSS 2.0%

    TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be…

  18. 9.8CVE-2025-41723EPSS 1.3%

    The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations.

  19. 5.3CVE-2025-8051EPSS 0.4%

    Path Traversal vulnerability in opentext Flipper allows Absolute Path Traversal.  The vulnerability could allow a user to access files hosted on the server. This issue affects Flipper: 3.1.2.

  20. 9.8CVE-2025-42937EPSS 0.7%

    SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-write system files causing high impact on confidentiality int…

  21. 6.5CVE-2025-43907EPSS 0.4%

    Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7…

  22. 6.7CVE-2025-20313EPSS 0.2%

    Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break …

  23. 4.4CVE-2025-43886EPSS 0.2%

    Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Path Traversal: '.../...//' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem ac…

  24. 7.5CVE-2025-48317EPSS 0.4%

    Path Traversal: '.../...//' vulnerability in Stefan Keller WooCommerce Payment Gateway for Saferpay woocommerce-payment-gateway-for-saferpay allows Path Traversal.This issue affects WooCommerce Payment Gateway for Saferpay: from n/a throug…

  25. 4.3CVE-2025-4956EPSS 0.3%

    Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through 2.0.

  26. 5.3CVE-2025-48081EPSS 0.3%

    Path Traversal: '.../...//' vulnerability in Printeers Printeers Print & Ship allows Path Traversal.This issue affects Printeers Print & Ship: from n/a through 1.17.0.

  27. 6.5CVE-2025-53561EPSS 0.5%

    Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent files / folders access: from n/a through <= 2.6.0.

  28. 4.2CVE-2025-52712EPSS 0.2%

    Path Traversal: '.../...//' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Path Traversal.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.

  29. 8.4CVE-2025-8088KEVEPSS 94%

    A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov,…

  30. 5.4CVE-2024-52885EPSS 0.5%

    The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to at least one File Share application) to list the file names of 'nobody'-accessibl…

  31. 9.3CVE-2025-53417EPSS 20%

    DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability

  32. 7.3CVE-2025-20320EPSS 0.5%

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could c…

  33. 7.5CVE-2025-52805EPSS 0.5%

    Path Traversal: '.../...//' vulnerability in VaultDweller Leyka leyka allows PHP Local File Inclusion.This issue affects Leyka: from n/a through <= 3.32.1.

  34. 8.1CVE-2025-52811EPSS 0.6%

    Path Traversal: '.../...//' vulnerability in Creanncy Davenport - Versatile Blog and Magazine WordPress Theme davenport allows PHP Local File Inclusion.This issue affects Davenport - Versatile Blog and Magazine WordPress Theme: from n/a th…

  35. 8.1CVE-2025-52810EPSS 0.6%

    Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.

  36. 7.5CVE-2025-49451EPSS 0.5%

    Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery allows Path Traversal.This issue affects Aeroscroll Gallery – Infinite Scroll Imag…

  37. 7.8CVE-2025-47176EPSS 0.8%

    '.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.

  38. 9.3CVE-2025-30515EPSS 0.6%

    CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.

  39. 9.8CVE-2025-49297EPSS 0.6%

    Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through <= 1.6.

  40. 9.8CVE-2025-49296EPSS 0.6%

    Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects GrandPrix: from n/a through <= 1.6.

  41. 9.8CVE-2025-49295EPSS 0.6%

    Path Traversal: '.../...//' vulnerability in Mikado-Themes MediClinic mediclinic allows PHP Local File Inclusion.This issue affects MediClinic: from n/a through <= 2.1.

  42. 8.1CVE-2025-39475EPSS 0.7%

    Path Traversal: '.../...//' vulnerability in Frenify Arlo arlo allows PHP Local File Inclusion.This issue affects Arlo: from n/a through <= 6.0.3.

  43. 5.4CVE-2025-27445EPSS 0.5%

    A path traversal vulnerability in RSFirewall component 2.9.7 - 3.1.5 for Joomla was discovered. This vulnerability allows authenticated users to read arbitrary files outside the Joomla root directory. The flaw is caused by insufficient san…

  44. 9.2CVE-2025-5598EPSS 0.5%

    Path Traversal vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Retrieve Embedded Sensitive Data.This issue affects airleader MASTER: 3.0046.

  45. 5.3CVE-2025-46441EPSS 0.4%

    Path Traversal: '.../...//' vulnerability in ctltwp Section Widget section-widget allows Path Traversal.This issue affects Section Widget: from n/a through <= 3.3.1.

  46. 8.1CVE-2025-27010EPSS 0.8%

    Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a through < 2.5.2.

  47. 7.5CVE-2025-39492EPSS 0.5%

    Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision.

  48. 8.1CVE-2025-39491EPSS 0.4%

    Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision.

  49. 6.7CVE-2025-40573EPSS 0.2%

    A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to path traversal attacks. This could allow a privileged local attacker to restore backups that are ou…

  50. 8.8CVE-2025-47649EPSS 0.5%

    Path Traversal: '.../...//' vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows PHP Local File Inclusion.This issue affects Open Close WooCommerce Store: from n/a through <= 4.9.9.