CWE-36: Absolute Path Traversal
Filter
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
What the weakness is: CWE-36 at MITRE
Ask an AI about CWE-36
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-36: Absolute Path Traversal and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/36.html and https://cve.bz/cve/cwe/36?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.9CVE-2026-116635
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the cont…
- 5.6CVE-2026-118693EPSS 0.1%
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document…
- 8.8CVE-2026-83784EPSS 1.1%
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
- 8.1CVE-2026-83746EPSS 1.1%
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
- 6.5CVE-2026-83683EPSS 1.3%
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.
- 8.8CVE-2026-70297EPSS 1.2%
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
- 8.4CVE-2026-55062EPSS 0.2%
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory compon…
- 3.5CVE-2025-70820EPSS 0.3%
Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.
- 8.8CVE-2026-89009EPSS 1.0%
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the …
- 6.5CVE-2026-82092EPSS 0.8%
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
- 9.9CVE-2026-68487EPSS 0.6%
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
- 6.5CVE-2026-88288EPSS 0.5%
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
- 7.8CVE-2026-69612EPSS 0.4%
Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2026-68896EPSS 0.4%
Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
- 5.5CVE-2026-47630EPSS 0.2%
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution.
- 9.1CVE-2026-47606EPSS 0.7%
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure.
- 8.4CVE-2026-46345EPSS 0.2%
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does no…
- 9.2CVE-2026-47243EPSS 0.2%
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-rs standalone virtio-fs path is vulnerable to a guest-root to …
- 8.5CVE-2026-54202EPSS 0.5%
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the in…
- 7.5CVE-2026-61891EPSS 0.5%
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and str…
- 5.6CVE-2026-13346EPSS 0.3%
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a…
- 7.5CVE-2026-13189EPSS 0.4%
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side req…
- 10.0CVE-2026-57211EPSS 0.6%
RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path val…
- 5.3CVE-2026-15302EPSS 0.7%
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain file…
- 5.5CVE-2026-58300EPSS 0.4%
Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
- 7.6CVE-2026-49290EPSS 0.8%
Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal vulnerability in Slopsmith's archive extractors allows an attacker to write arbi…
- 6.5CVE-2026-53698EPSS 0.3%
Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.
- 6.9CVE-2026-10075EPSS 0.4%
DreamMaker developed by Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to read file names under arbitrary path by exploiting an Absolute Path Traversal vulnerability.
- 8.2CVE-2026-10044EPSS 0.6%
Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts/{filename} endpoint on Windows deployments that allows unauthenticated remote attackers to read arbitrary files by supplying…
- 8.6CVE-2026-32997EPSS 0.5%
A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.
- 6.5CVE-2026-4782EPSS 0.5%
The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function with the 'custom_svg' parameter of the 'fusion_section_separator' shortcod…
- 4.3CVE-2026-32175EPSS 0.7%
A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. …
- 6.5CVE-2026-42315EPSS 0.4%
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no sanitization at all…
- 4.6CVE-2026-6418EPSS 0.6%
An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper pa…
- 5.3CVE-2026-44029EPSS 0.6%
An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack" directory traversal. The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.…
- 5.5CVE-2026-7217EPSS 0.4%
A security vulnerability has been detected in Deepractice PromptX up to 2.4.0. The affected element is the function read_docx/read_xlsx/read_pptx/list_xlsx_sheets/read_pdf of the file packages/mcp-office/src/index.ts of the component Docum…
- 7.5CVE-2026-35465EPSS 0.4%
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the C…
- 6.6CVE-2026-34515EPSS 0.4%
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.…
- 7.5CVE-2026-4373EPSS 0.4%
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths fro…
- 7.5CVE-2026-0846EPSS 0.6%
A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitiza…
- 7.5CVE-2026-2753EPSS 0.5%
An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path input. Unauthenticated remote attackers can exploit this issue by submitting reque…
- 7.5CVE-2026-28414ExploitEPSS 3.1%
Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read…
- 7.5CVE-2026-27117EPSS 0.4%
bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.11, a path traversal vulnerability ("Zip Slip") exists in bit7z's archive extraction functionality. The library does…
- 8.8CVE-2026-26337EPSS 0.4%
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolute path traversal.
- 8.7CVE-2026-1330EPSS 0.7%
MeetingHub developed by HAMASTAR Technology has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
- 4.6CVE-2026-20834EPSS 0.7%
Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.
- 9.1CVE-2025-68472EPSS 20%
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move th…
- 5.3CVE-2025-15237EPSS 0.4%
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerabilit…
- 5.3CVE-2025-15236EPSS 0.4%
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerabilit…
- 8.7CVE-2025-15227EPSS 0.5%
BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.