# CWE-27.

Every Advisory and CVE whose sources give the weakness CWE-27, newest first.

## Records, newest first

- [moment vulnerable to Path Traversal via crafted non-string locale name](https://agentprime.io/advisories/GHSA-4p3w-j4w9-5jqw.md)
  `GHSA-4p3w-j4w9-5jqw`, `CVE-2026-17495` · npm `moment`: affected `>=2.29.2, <2.31.0`, fixed in `2.31.0` · CVSS 5.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-27
- [Path Traversal through the Search Dispatch REST API in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76344.md)
  `CVE-2026-76344` · CVE record: Splunk Splunk Enterprise · CVSS 7.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-27
- [Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases](https://agentprime.io/advisories/CVE-2026-62391.md)
  `CVE-2026-62391` · CVE record: Apache Software Foundation Apache Kyuubi · CVSS 8.1 High · Not analysed yet · Published 31 Jul 2026 · Tags: Path traversal, CWE-27
- [Path traversal in Eclipse Foundation Eclipse OpenMQ and others](https://agentprime.io/advisories/CVE-2026-24457.md)
  `CVE-2026-24457` · CVE record: Eclipse Foundation Eclipse OpenMQ and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Path traversal, CWE-27
- [Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal Vulnerability](https://agentprime.io/advisories/CVE-2026-20018.md)
  `CVE-2026-20018` · CVE record: Cisco Cisco Secure Firewall Management Center (FMC) and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 4 Mar 2026 · Tags: CWE-27
- [Apache Kyuubi Server vulnerable to Path Traversal](https://agentprime.io/advisories/GHSA-f8r6-6222-9pvc.md)
  `GHSA-f8r6-6222-9pvc`, `CVE-2025-66518` · Maven `org.apache.kyuubi:kyuubi-server_2.12`: affected `>=1.6.0, <1.10.3`, fixed in `1.10.3` · CVSS 8.8 High · Not analysed yet · Published 5 Jan 2026 · Tags: Path traversal, CWE-27
- [Denial of service (DoS) vulnerability in the office service.](https://agentprime.io/advisories/CVE-2025-58292.md)
  `CVE-2025-58292` · CVE record: Huawei HarmonyOS · CVSS 3.3 Low · Not analysed yet · Published 11 Oct 2025 · Tags: CWE-27
- [Path Traversal in Yordam BT's Yordam Katalog](https://agentprime.io/advisories/CVE-2025-10438.md)
  `CVE-2025-10438` · CVE record: Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog · CVSS 8.6 High · Not analysed yet · Published 25 Sept 2025 · Tags: CWE-27
- [Tautulli vulnerable to Unauthenticated Path Traversal in \`real_pms_image_proxy\`](https://agentprime.io/advisories/CVE-2025-58761.md)
  `CVE-2025-58761` · CVE record: Tautulli Tautulli · CVSS 8.6 High · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-27
- [An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal.](https://agentprime.io/advisories/CVE-2025-52237.md)
  `CVE-2025-52237` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: CWE-27
- [Using the \<redacted> action or \<redacted>.sh script, arbitrary files and directories can be deleted using directory traversal.](https://agentprime.io/advisories/CVE-2024-43658.md)
  `CVE-2024-43658` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 7.2 High · Not analysed yet · Published 9 Jan 2025 · Tags: Path traversal, CWE-27
- [Cisco TelePresence Collaboration Endpoint and RoomOS Software Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2023-20090.md)
  `CVE-2023-20090` · CVE record: Cisco Cisco RoomOS Software and 1 more · CVSS 6.7 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: CWE-27
- [Arbitrary File Read and Delete in kanboard](https://agentprime.io/advisories/CVE-2024-51747.md)
  `CVE-2024-51747` · CVE record: kanboard kanboard · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Nov 2024 · Tags: Path traversal, CWE-27
- [elunez eladmin Database Management/Deployment Management upload path traversal](https://agentprime.io/advisories/CVE-2024-7458.md)
  `CVE-2024-7458` · CVE record: elunez eladmin · CVSS 5.1 Medium · Not analysed yet · Published 4 Aug 2024 · Tags: CWE-27
- [Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type](https://agentprime.io/advisories/CVE-2024-24809.md)
  `CVE-2024-24809` · CVE record: traccar traccar · CVSS 8.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.54 · Not analysed yet · Published 10 Apr 2024 · Tags: Unrestricted file upload, CWE-27
- [A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to read arbitrary files.](https://agentprime.io/advisories/CVE-2024-20348.md)
  `CVE-2024-20348` · CVE record: Cisco Cisco Data Center Network Manager · CVSS 7.5 High · Not analysed yet · Published 3 Apr 2024 · Tags: CWE-27
- [An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.](https://agentprime.io/advisories/CVE-2024-27764.md)
  `CVE-2024-27764` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2024 · Tags: CWE-27
- [cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.](https://agentprime.io/advisories/CVE-2024-25828.md)
  `CVE-2024-25828` · CVE record · CVSS 4.9 Medium · Not analysed yet · Published 22 Feb 2024 · Tags: CWE-27
- [Node: The permission model protects itself against path traversal attacks by calling…](https://agentprime.io/advisories/CVE-2024-21896.md)
  `CVE-2024-21896` · CVE record: NodeJS Node · CVSS 7.9 High · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-27
- [Remote Code Execution Vulnerability in Atril's EPUB ebook parsing](https://agentprime.io/advisories/CVE-2023-52076.md)
  `CVE-2023-52076` · CVE record: mate-desktop atril · CVSS 8.5 High · Not analysed yet · Published 25 Jan 2024 · Tags: Path traversal, CWE-25, CWE-27
- [Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE](https://agentprime.io/advisories/GHSA-6f9g-cxwr-q5jr.md)
  `GHSA-6f9g-cxwr-q5jr`, `BIT-jenkins-2024-23897`, `CVE-2024-23897` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=1.606, <2.426.3 || >=2.427, <2.440.1 || >=2.441, <2.442`, fixed in `2.426.3`, `2.440.1`, `2.442` · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 24 Jan 2024 · Tags: Path traversal, CWE-27
- [Deepin Reader RCE vulnerability due to a design flaw](https://agentprime.io/advisories/CVE-2023-50254.md)
  `CVE-2023-50254` · CVE record: linuxdeepin developer-center · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Dec 2023 · Tags: Path traversal, CWE-27
- [SonicWall GMS: Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to…](https://agentprime.io/advisories/CVE-2023-34125.md)
  `CVE-2023-34125` · CVE record: SonicWall GMS and 1 more · No CVSS score · EPSS 0.24 · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-27
- [Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities](https://agentprime.io/advisories/CVE-2023-20131.md)
  `CVE-2023-20131` · CVE record: Cisco Cisco Prime Infrastructure · CVSS 6.5 Medium · Not analysed yet · Published 5 Apr 2023 · Tags: CWE-27
- [Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities](https://agentprime.io/advisories/CVE-2023-20130.md)
  `CVE-2023-20130` · CVE record: Cisco Cisco Prime Infrastructure · CVSS 6.5 Medium · Not analysed yet · Published 5 Apr 2023 · Tags: CWE-27
- [Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities](https://agentprime.io/advisories/CVE-2023-20129.md)
  `CVE-2023-20129` · CVE record: Cisco Cisco Prime Infrastructure · CVSS 6.5 Medium · Not analysed yet · Published 5 Apr 2023 · Tags: CWE-27
- [Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities](https://agentprime.io/advisories/CVE-2023-20127.md)
  `CVE-2023-20127` · CVE record: Cisco Cisco Prime Infrastructure · CVSS 6.5 Medium · Not analysed yet · Published 5 Apr 2023 · Tags: CWE-27
- [Unauthenticated path traversal vulnerability in Hasura GraphQL Engine](https://agentprime.io/advisories/CVE-2023-27588.md)
  `CVE-2023-27588` · CVE record: hasura graphql-engine · CVSS 7.5 High · Not analysed yet · Published 14 Mar 2023 · Tags: Path traversal, CWE-27
- [Path Traversal: 'dir/../../filename' in moment.locale](https://agentprime.io/advisories/GHSA-8hfj-j24r-96c4.md)
  `GHSA-8hfj-j24r-96c4`, `CVE-2022-24785` · npm `moment` and 1 more: affected `<2.29.2`, fixed in `2.29.2` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 4 Apr 2022 · Tags: Path traversal, CWE-27
- [A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access to sensitive information.](https://agentprime.io/advisories/CVE-2021-35027.md)
  `CVE-2021-35027` · CVE record: Zyxel ZyWALL VPN2S Firmware · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2021 · Tags: CWE-27

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-27>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-27/>. Everything for agents: <https://agentprime.io/llms.txt>.