# CWE-25.

Every Advisory and CVE whose sources give the weakness CWE-25, newest first.

## Records, newest first

- [SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability.](https://agentprime.io/advisories/CVE-2026-68959.md)
  `CVE-2026-68959` · CVE record: Sky Co., LTD. SKYSEA Client View and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-25
- [Swing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user](https://agentprime.io/advisories/GHSA-pj88-9xww-gxmh.md)
  `GHSA-pj88-9xww-gxmh`, `CVE-2026-23877`, `PYSEC-2026-1947` · PyPI `swingmusic`: affected `<2.1.4`, fixed in `2.1.4` · CVSS 5.3 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Broken access control, CWE-25
- [Riello NetMan: Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../…](https://agentprime.io/advisories/CVE-2025-68916.md)
  `CVE-2025-68916` · CVE record: Riello NetMan · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Dec 2025 · Tags: CWE-25
- [Denial of service (DoS) vulnerability in the office service.](https://agentprime.io/advisories/CVE-2025-58286.md)
  `CVE-2025-58286` · CVE record: Huawei HarmonyOS · CVSS 3.3 Low · Not analysed yet · Published 11 Oct 2025 · Tags: CWE-25
- [Tsinghua Unigroup Electronic Archives System exampleDownload.html path traversal](https://agentprime.io/advisories/CVE-2025-0225.md)
  `CVE-2025-0225` · CVE record: Tsinghua Unigroup Electronic Archives System · CVSS 5.3 Medium · Not analysed yet · Published 5 Jan 2025 · Tags: Path traversal, CWE-25
- [pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution](https://agentprime.io/advisories/GHSA-47h8-jmp3-9f28.md)
  `GHSA-47h8-jmp3-9f28`, `CVE-2024-56327`, `PYSEC-2026-1839` · PyPI `pyrage`: affected `>=1.2.0, <1.2.3`, fixed in `1.2.3` · CVSS 7.7 High · Not analysed yet · Published 19 Dec 2024 · Tags: Code injection, CWE-25, CWE-1395
- [age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution](https://agentprime.io/advisories/GHSA-32gq-x56h-299c.md)
  `GHSA-32gq-x56h-299c`, `GO-2024-3344` · Go `filippo.io/age`: affected `<1.2.1`, fixed in `1.2.1` · No CVSS score · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-25
- [Best WordPress Gallery Plugin – FooGallery <= 2.4.16 - Authenticated (Contributor+) Directory Traversal](https://agentprime.io/advisories/CVE-2023-6947.md)
  `CVE-2023-6947` · CVE record: https\://fooplugins.com FooGallery Premium · CVSS 7.7 High · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-25
- [Path Traversal vulnerability in Franklin Fueling System EVO 550/5000](https://agentprime.io/advisories/CVE-2024-2442.md)
  `CVE-2024-2442` · CVE record: Franklin Fueling System EVO 550 and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Mar 2024 · Tags: CWE-25
- [Path traversal via crafted cpio archives in Engrampa archivers](https://agentprime.io/advisories/CVE-2023-52138.md)
  `CVE-2023-52138` · CVE record: mate-desktop engrampa · CVSS 8.2 High · Not analysed yet · Published 5 Feb 2024 · Tags: CWE-25
- [Path Traversal in VGuard IP Camera Network Recorder](https://agentprime.io/advisories/CVE-2023-6919.md)
  `CVE-2023-6919` · CVE record: Biges Safe Life Technologies Electronics Inc. VGuard · CVSS 7.5 High · Not analysed yet · Published 26 Jan 2024 · Tags: CWE-25
- [Remote Code Execution Vulnerability in Atril's EPUB ebook parsing](https://agentprime.io/advisories/CVE-2023-52076.md)
  `CVE-2023-52076` · CVE record: mate-desktop atril · CVSS 8.5 High · Not analysed yet · Published 25 Jan 2024 · Tags: Path traversal, CWE-25, CWE-27
- [Path Traversal in Neutron IP Camera](https://agentprime.io/advisories/CVE-2023-6118.md)
  `CVE-2023-6118` · CVE record: Neutron IP Camera · CVSS 7.5 High · Not analysed yet · Published 23 Nov 2023 · Tags: CWE-25
- [Cisco SD-WAN Software Privilege Escalation Vulnerabilities](https://agentprime.io/advisories/CVE-2022-20818.md)
  `CVE-2022-20818` · CVE record: Cisco Cisco SD-WAN Solution · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2022 · Tags: CWE-25
- [Cisco SD-WAN Software Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2022-20775.md)
  `CVE-2022-20775` · CVE record: Cisco Cisco Catalyst SD-WAN and 4 more · CVSS 7.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.12 · Not analysed yet · Published 30 Sept 2022 · Tags: CWE-25

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-25>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-25/>. Everything for agents: <https://agentprime.io/llms.txt>.