cve.bz

CWE-73: External Control of File Name or Path, page 10

Filter

The product allows user input to control or influence paths or file names that are used in filesystem operations.

What the weakness is: CWE-73 at MITRE

Related attack patterns (CAPEC): 8
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-72 URL Encoding Likelihood: High · Severity: High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-78 Using Escaped Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-79 Using Slashes in Alternate Encoding Likelihood: High · Severity: High
  • CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic Likelihood: High · Severity: High
  • CAPEC-267 Leverage Alternate Encoding Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-73, as MITRE names them. Credits.

Ask an AI about CWE-73

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-73: External Control of File Name or Path and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/73.html and https://cve.bz/cve/cwe/73?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2025-66449EPSS 0.8%

    ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function …

  2. 6.8CVE-2025-13320EPSS 0.8%

    The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined…

  3. 9.1CVE-2025-65473EPSS 0.6%

    An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name.

  4. 5.5CVE-2025-67461EPSS 0.1%

    External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via local access.

  5. 7.8CVE-2025-59516EPSS 2.3%

    Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.

  6. 4.3CVE-2025-65799EPSS 0.2%

    A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal.

  7. 8.7CVE-2020-36878EPSS 0.3%

    ReQuest Serious Play Media Player 3.0 contains an unauthenticated file disclosure vulnerability when input passed through the 'file' parameter in and script is not properly verified before being used to read web log files. Attackers can ex…

  8. 8.8CVE-2025-12529EPSS 0.6%

    The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function in all versions up to, and including, 3.6.3. This makes it possible for …

  9. 6.5CVE-2021-4472EPSS 0.5%

    The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.

  10. 9.2CVE-2025-66257EPSS 0.4%

    Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch …

  11. 7.8CVE-2025-66254EPSS 0.4%

    Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deleteupgr…

  12. 6.5CVE-2025-13380EPSS 0.5%

    The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'l…

  13. 9.1CVE-2025-30201EPSS 0.8%

    Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths i…

  14. 4.9CVE-2025-11973EPSS 0.3%

    The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminst…

  15. 8.1CVE-2025-13322EPSS 0.7%

    The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2.0. This is due to the `wpag_uploadaudio_callback()` AJAX handler not proper…

  16. 5.8CVE-2025-64714EPSS 0.5%

    PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, an unauthenticated Local File Inclusion exists in the template-switching feature. If `templateselect…

  17. 7.5CVE-2025-64739EPSS 0.3%

    External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.

  18. 5.5CVE-2025-64738EPSS 0.2%

    External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access.

  19. 6.9CVE-2022-4983EPSS 0.4%

    TEC-IT TBarCode version 11.15 contains a vulnerability in the TBarCode11.ocx ActiveX/OCX control's licensing handling (INI-file based) that can be abused to cause remote creation of files on the host filesystem. Depending on where files ca…

  20. 7.8CVE-2025-59511EPSS 0.4%

    External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally.

  21. 5.7CVE-2025-20614EPSS 0.2%

    External control of file name or path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined …

  22. 3.1CVE-2025-8998EPSS 0.2%

    It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authenticating with an operator- or administrator-privileged ser…

  23. 7.5CVE-2025-11451EPSS 0.5%

    The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads in all versions up to, and including, 5.4.3 via the '/wp-json/wp/v2/aal_ajax_unit_loading' RST API endpoint. This makes …

  24. 6.2CVE-2025-12915EPSS 0.5%

    A vulnerability was found in 70mai X200 up to 20251019. This issue affects some unknown processing of the component Init Script Handler. The manipulation results in file inclusion. The attack requires a local approach. A high complexity le…

  25. 9.3CVE-2025-64486EPSS 0.2%

    calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a maliciou…

  26. 4.9CVE-2025-12137EPSS 0.5%

    The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.14.16. This is due to the plugin's REST API endpoint accepting arbitrary abs…

  27. 8.5CVE-2020-36868EPSS 0.3%

    Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient val…

  28. 8.2CVE-2025-62611EPSS 0.4%

    aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client usin…

  29. 5.3CVE-2025-8050EPSS 0.3%

    External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal.  The vulnerability could allow a user to access files hosted on the server. This issue affects Flipper: 3.1.2.

  30. 5.3CVE-2025-8048EPSS 0.3%

    External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to submit a stored local file path and then download the specified file from the system by requesting the s…

  31. 5.3CVE-2025-11738EPSS 0.4%

    The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents …

  32. 7.7CVE-2025-62382EPSS 0.4%

    Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.2, Frigate's export workflow allows an authenticated operator to nominate any filesystem location as the thumbnail source for a vi…

  33. 8.5CVE-2025-59483EPSS 0.4%

    A validation vulnerability exists in an undisclosed URL in the Configuration utility.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  34. 8.2CVE-2025-59292EPSS 0.4%

    External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.

  35. 8.2CVE-2025-59291EPSS 0.4%

    External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.

  36. 6.5CVE-2025-59244EPSS 0.8%

    External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.

  37. 7.7CVE-2025-59200EPSS 0.8%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Data Sharing Service Client allows an unauthorized attacker to perform spoofing locally.

  38. 6.5CVE-2025-59185EPSS 1.1%

    External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.

  39. 6.1CVE-2025-35053EPSS 0.4%

    Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'DownloadExportedPDF' command that allow an authenticated user to read and delete arbitrary files with 'NT AUTHORITY\NetworkService' priv…

  40. 8.1CVE-2025-10494EPSS 0.5%

    The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. Th…

  41. 3.8CVE-2025-10306EPSS 0.3%

    The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the process_backup_batch() function. This makes it possible for authenticated attacke…

  42. 3.3CVE-2025-58769EPSS 0.4%

    auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validatio…

  43. 9.8CVE-2025-6237EPSS 0.4%

    A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, a…

  44. 8.1CVE-2025-10058EPSS 0.6%

    The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_function() function in all versions up to, and including, 7.27. Th…

  45. 7.5CVE-2025-8422EPSS 0.6%

    The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via the send_email() function. This makes it possible for unauthenticated attackers…

  46. 7.5CVE-2025-59049ExploitEPSS 1.8%

    Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating…

  47. 7.2CVE-2025-58762EPSS 0.8%

    Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the applic…

  48. 7.8CVE-2025-55316EPSS 0.4%

    External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.

  49. 9.1CVE-2025-10134EPSS 0.6%

    The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2…

  50. 2.0CVE-2025-9920EPSS 0.5%

    A security flaw has been discovered in Campcodes Recruitment Management System 1.0. This impacts the function include of the file /admin/index.php. The manipulation of the argument page results in file inclusion. It is possible to launch t…