# CWE-26.

Every Advisory and CVE whose sources give the weakness CWE-26, newest first.

## Records, newest first

- [Vvveb: Path Traversal in nextRestore() and nextBackup()](https://agentprime.io/advisories/CVE-2026-112904.md)
  `CVE-2026-112904` · CVE record: givanz Vvveb · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-26
- [Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter](https://agentprime.io/advisories/CVE-2026-15896.md)
  `CVE-2026-15896` · CVE record: WebRehab Super Forms – Drag & Drop Form Builder · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-26
- [Path Traversal through the Lookup Configuration REST API in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76317.md)
  `CVE-2026-76317` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-26
- [A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6).](https://agentprime.io/advisories/CVE-2026-46747.md)
  `CVE-2026-46747` · CVE record: Siemens SINEC INS · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-26
- [django-s3file is vulnerable to relative path traversal](https://agentprime.io/advisories/GHSA-67qg-7284-2277.md)
  `GHSA-67qg-7284-2277`, `CVE-2026-42196`, `PYSEC-2026-328` · PyPI `django-s3file`: affected `<7.0.2`, fixed in `7.0.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: Path traversal, CWE-26
- [NavigaTUM has a Path Traversal Vulnerability in the propose_edits functionality](https://agentprime.io/advisories/CVE-2026-25575.md)
  `CVE-2026-25575` · CVE record: TUM-Dev NavigaTUM · CVSS 8.8 High · Not analysed yet · Published 4 Feb 2026 · Tags: Path traversal, CWE-26
- [Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins.](https://agentprime.io/advisories/CVE-2022-45133.md)
  `CVE-2022-45133` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: CWE-26
- [RomM vulnerable to Authenticated Path Traversal](https://agentprime.io/advisories/CVE-2025-53908.md)
  `CVE-2025-53908` · CVE record: rommapp romm · CVSS 8.3 High · Not analysed yet · Published 16 Jul 2025 · Tags: CWE-26
- [Label Studio has a Path Traversal Vulnerability via image Field](https://agentprime.io/advisories/GHSA-rgv9-w7jp-m23g.md)
  `GHSA-rgv9-w7jp-m23g`, `CVE-2025-25295`, `PYSEC-2026-1506` · PyPI `label-studio-sdk`: affected `<1.0.10`, fixed in `1.0.10` · CVSS 8.7 High · Not analysed yet · Published 14 Feb 2025 · Tags: Path traversal, CWE-26
- [Arbitrary Directory Listing in Centrify PAS](https://agentprime.io/advisories/CVE-2024-5866.md)
  `CVE-2024-5866` · CVE record: Delinea Centrify PAS · CVSS 5.0 Medium · Not analysed yet · Published 2 Jul 2024 · Tags: CWE-26
- [Arbitrary File Reading in Centrify PAS](https://agentprime.io/advisories/CVE-2024-5865.md)
  `CVE-2024-5865` · CVE record: Delinea Centrify PAS · CVSS 7.7 High · Not analysed yet · Published 2 Jul 2024 · Tags: CWE-26
- [Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImage…](https://agentprime.io/advisories/CVE-2024-28064.md)
  `CVE-2024-28064` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 May 2024 · Tags: CWE-26
- [Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component.](https://agentprime.io/advisories/CVE-2024-29466.md)
  `CVE-2024-29466` · CVE record · CVSS 8.8 High · Not analysed yet · Published 30 Apr 2024 · Tags: CWE-26
- [Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request.](https://agentprime.io/advisories/CVE-2024-31551.md)
  `CVE-2024-31551` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Apr 2024 · Tags: CWE-26
- [Cisco AppDynamics: A vulnerability in the file upload functionality of Cisco AppDynamics Controller could…](https://agentprime.io/advisories/CVE-2024-20345.md)
  `CVE-2024-20345` · CVE record: Cisco Cisco AppDynamics · CVSS 6.5 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: CWE-26
- [React Native Document Picker Directory Traversal vulnerability](https://agentprime.io/advisories/GHSA-pmgm-h3cc-m4hj.md)
  `GHSA-pmgm-h3cc-m4hj`, `CVE-2024-25466` · npm `react-native-document-picker`: affected `<8.2.2 || >=9.0.0, <9.1.1`, fixed in `8.2.2`, `9.1.1` · CVSS 7.3 High · Not analysed yet · Published 16 Feb 2024 · Tags: CWE-26
- [Zip Path Traversal in Deepin-Compressor](https://agentprime.io/advisories/CVE-2023-50255.md)
  `CVE-2023-50255` · CVE record: linuxdeepin developer-center · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Dec 2023 · Tags: Path traversal, CWE-26
- [Roxy-WI has Path Traversal vulnerability](https://agentprime.io/advisories/CVE-2023-25802.md)
  `CVE-2023-25802` · CVE record: hap-wi roxy-wi · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2023 · Tags: Path traversal, CWE-26
- [Siemens Siveillance Video DLNA Server: A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1)…](https://agentprime.io/advisories/CVE-2021-42021.md)
  `CVE-2021-42021` · CVE record: Siemens Siveillance Video DLNA Server · No CVSS score · Not analysed yet · Published 9 Nov 2021 · Tags: CWE-26
- [Cisco Firepower Management Center Software Authenticated Directory Traversal Vulnerability](https://agentprime.io/advisories/CVE-2021-34762.md)
  `CVE-2021-34762` · CVE record: Cisco Cisco Firepower Management Center · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2021 · Tags: CWE-26

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-26>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-26/>. Everything for agents: <https://agentprime.io/llms.txt>.