# CWE-29.

Every Advisory and CVE whose sources give the weakness CWE-29, newest first.

## Records, newest first (an older page)

- [Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter](https://agentprime.io/advisories/GHSA-46g3-f9r8-xj4v.md)
  `GHSA-46g3-f9r8-xj4v`, `CVE-2023-2984`, `PKSA-8fvd-j3bc-qkkk` · Packagist `pimcore/pimcore`: affected `<10.5.22`, fixed in `10.5.22` · CVSS 6.3 Medium · Not analysed yet · Published 6 Jun 2023 · Tags: CWE-29
- [Path Traversal: '\\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.](https://agentprime.io/advisories/GHSA-wjq3-7jxx-whj9.md)
  `GHSA-wjq3-7jxx-whj9`, `BIT-mlflow-2023-2780`, `CVE-2023-2780`, `PYSEC-2023-69` · PyPI `mlflow`: affected `<2.3.1`, fixed in `2.3.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 May 2023 · Tags: CWE-29
- [Path Traversal: '\\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.](https://agentprime.io/advisories/GHSA-xg73-94fp-g449.md)
  `GHSA-xg73-94fp-g449`, `BIT-mlflow-2023-1177`, `CVE-2023-1177`, `PYSEC-2023-29` · PyPI `mlflow`: affected `<2.2.1`, fixed in `2.2.1` · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.70 · Not analysed yet · Published 24 Mar 2023 · Tags: CWE-29
- [Path Traversal: '\\..\filename' in salesagility/suitecrm](https://agentprime.io/advisories/CVE-2023-1034.md)
  `CVE-2023-1034` · CVE record: salesagility salesagility/suitecrm · CVSS 4.3 Medium · EPSS 0.26 · Not analysed yet · Published 25 Feb 2023 · Tags: CWE-29
- [The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file.](https://agentprime.io/advisories/CVE-2023-0104.md)
  `CVE-2023-0104` · CVE record: Weintek EasyBuilder Pro cMT · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.22 · Not analysed yet · Published 22 Feb 2023 · Tags: CWE-29
- [Froxlor is vulnerable to path traversal](https://agentprime.io/advisories/GHSA-xp3g-2729-rxm3.md)
  `GHSA-xp3g-2729-rxm3`, `CVE-2023-0316`, `PKSA-5s6p-5qzp-btk3` · Packagist `froxlor/froxlor`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 6.8 Medium · Not analysed yet · Published 16 Jan 2023 · Tags: CWE-29
- [Emerson Electric Proficy Machine Edition: Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29…](https://agentprime.io/advisories/CVE-2022-2788.md)
  `CVE-2022-2788` · CVE record: Emerson Electric Proficy Machine Edition · CVSS 3.9 Low · Not analysed yet · Published 19 Aug 2022 · Tags: CWE-29
- [Path Traversal in com.alibaba.oneagent:one-java-agent-plugin](https://agentprime.io/advisories/GHSA-9hr3-j9mc-xmq2.md)
  `GHSA-9hr3-j9mc-xmq2`, `CVE-2022-25842`, `SNYK-JAVA-COMALIBABAONEAGENT-2407874` · Maven `com.alibaba.oneagent:one-java-agent-plugin`: affected `<0.0.2`, fixed in `0.0.2` · CVSS 6.9 Medium · Not analysed yet · Published 3 May 2022 · Tags: Path traversal, CWE-29
- [Exposure of Resource to Wrong Sphere in Zip-Local](https://agentprime.io/advisories/GHSA-wxj7-97fp-j53j.md)
  `GHSA-wxj7-97fp-j53j`, `CVE-2021-23484`, `SNYK-JS-ZIPLOCAL-2327477` · npm `zip-local`: affected `<0.3.5`, fixed in `0.3.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Feb 2022 · Tags: Information disclosure, CWE-29
- [Calipso Arbitrary File Write via Archive Extraction (Zip Slip)](https://agentprime.io/advisories/GHSA-jxcc-g75x-qgw9.md)
  `GHSA-jxcc-g75x-qgw9`, `CVE-2021-23391` · npm `calipso`: affected `<=0.3.54`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 8 Jun 2021 · Tags: Information disclosure, CWE-29
- [Path Traversal in MHolt Archiver](https://agentprime.io/advisories/GHSA-h74j-692g-48mq.md)
  `GHSA-h74j-692g-48mq`, `CVE-2019-10743` · Go `github.com/mholt/archiver`: affected `>=3.0.0, <3.3.2`, fixed in `3.3.2` · CVSS 5.5 Medium · Not analysed yet · Published 18 May 2021 · Tags: Path traversal, CWE-29

Newest: <https://agentprime.io/advisories/tag/cwe-29.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-29&cursor=WyIyMDIzLTExLTE0VDE2OjE5OjI5LjIwMjAwMFoiLCJDVkUtMjAyMy02MTMwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-29/?cursor=WyIyMDIzLTExLTE0VDE2OjE5OjI5LjIwMjAwMFoiLCJDVkUtMjAyMy02MTMwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.