CWE-29.

SonicWall NetExtender: A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor…

• SonicWall NetExtender
• CWE-29

MLFlow Path Traversal Vulnerability

• CWE-29

<2.9.2 · fixed in 2.9.2

Remote Code Execution via path traversal bypass in lollms

• CWE-29

>=5.9.0, <9.5.1 · fixed in 9.5.1

decompress: Arbitrary File Write via Archive Extraction (Zip Slip)

• Path traversal
• CWE-29

<=4.2.1 · no fixed version yet

NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious file.

• NVIDIA BioNeMo Framework
• CWE-29

Path Traversal in mintplex-labs/anything-llm

• mintplex-labs/anything-llm
• CWE-29

MLFlow path traversal vulnerability

• Path traversal
• CWE-29

<3.9.0rc0 · fixed in 3.9.0rc0

Wallos: SSRF via url parameter leading to File Traversal

• ellite Wallos
• Path traversal
• Server-side request forgery (SSRF)

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.

• Yokogawa Electric Corporation FAST/TOOLS
• CWE-29

Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-29

MQTT does not validate hostnames

• CWE-29

<0.7.0 · fixed in 0.7.0

Denial of service (DoS) vulnerability in the office service.

• Huawei HarmonyOS
• CWE-29

DbGate allows Unauthorized File Access via CSV Plugin

• dbgate
• CWE-29

DbGate allows for File Traversal via file parameter

• dbgate
• CWE-29

LlamaIndex vulnerable to Path Traversal attack through its encode_image function

• CWE-29

>=0.11.23, <0.12.41 · fixed in 0.12.41

MLflow has a Local File Read/Path Traversal in dbfs

• Path traversal
• CWE-29

<2.17.0rc0 · fixed in 2.17.0rc0

AgentScope path traversal vulnerability

• Path traversal
• CWE-29

<=0.1.1 · no fixed version yet

Aim path traversal in LockManager.release_locks

• Path traversal
• CWE-29

>=3.15.0, <=3.27.0 · no fixed version yet

Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint

• CWE-29

<=0.3.8 · no fixed version yet

Gradio Vulnerable to Arbitrary File Deletion

• CWE-29

>=4.0.0, <=5.0.0b2 · no fixed version yet

Path Traversal in mintplex-labs/anything-llm

• mintplex-labs/anything-llm
• CWE-29

Path Traversal in binary-husky/gpt_academic

• binary-husky/gpt_academic
• CWE-29

Local File Inclusion in bentoml/openllm

• bentoml/openllm
• CWE-29

Arbitrary File Overwrite in danswer-ai/danswer

• danswer-ai/danswer
• CWE-29

Path Traversal in danny-avila/librechat

• danny-avila/librechat
• CWE-29

Path Traversal in mintplex-labs/anything-llm

• mintplex-labs/anything-llm
• CWE-29

Dell PowerProtect DD: Dell PowerProtect DD versions prior to DDOS 8.3.0.0, 7.10.1.50…

• Dell PowerProtect DD
• CWE-29

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive...

• Path traversal
• CWE-29

<3.6.0 · fixed in 3.6.0

Langchain Path Traversal vulnerability

• Path traversal
• CWE-29

<0.2.19 · fixed in 0.2.19

An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. An attacker can read any file that matc...

• CWE-29

* · no fixed version yet

Local File Inclusion in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-29

Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim

• aimhubio/aim
• CWE-29

Path Traversal in stitionai/devika

• stitionai/devika
• CWE-29

lollms vulnerable to dot-dot-slash path traversal in XTTS server

• CWE-29

<=9.5.1 · no fixed version yet

Path Traversal in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-29

Zip slip in opencart

• Path traversal
• Authentication bypass

>=4.0.0.0 · no fixed version yet

Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm

• mintplex-labs/anything-llm
• CWE-29

LoLLMS Path Traversal vulnerability

• Path traversal
• CWE-29

<9.5.0 · fixed in 9.5.0

A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failur...

• CWE-29

<2.11.3 · fixed in 2.11.3

Path Traversal leading to Remote Code Execution in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-29

Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-29

Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-29

TarSlip Vulnerability in deepjavalibrary/djl

• deepjavalibrary/djl
• CWE-29

Path Traversal Vulnerability in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-29

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of...

• CWE-29

<2.12.1 · fixed in 2.12.1

Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-29

Path Traversal in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-29

Path Traversal in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-29

Path Traversal leading to Remote Code Execution in parisneo/lollms-webui

• parisneo/lollms-webui
• CWE-29

An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18.

• CWE-29

gradio vulnerable to Path Traversal

• CWE-29

<4.13.0 · fixed in 4.13.0

mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_...

• CWE-29

<2.10.0 · fixed in 2.10.0

A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI ...

• CWE-29

<0.55.5 · fixed in 0.55.5

MLflow Local File Disclosure Vulnerability

• CWE-29

<2.9.2 · fixed in 2.9.2

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

• CWE-29

<2.9.2 · fixed in 2.9.2

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

• CWE-29

<2.9.2 · fixed in 2.9.2

H2O local file inclusion vulnerability

• Broken access control
• CWE-29

<=3.40.0.4 · no fixed version yet

Ray Path Traversal vulnerability

• Path traversal
• CWE-29

<2.8.1 · fixed in 2.8.1

ModelDB Local File Include

• vertaai/modeldb
• CWE-29

Path Traversal: '\..\filename' in salesagility/suitecrm

• salesagility/suitecrm
• CWE-29