# Path traversal. File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first - [Ansible-core: user module generate_ssh_key follows a symlinked \~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)](https://agentprime.io/advisories/CVE-2026-123037.md) `CVE-2026-123037` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 and 2 more · CVSS 6.7 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: Path traversal - [Dagu MCP DAG specification read bypasses path containment and workspace isolation](https://agentprime.io/advisories/CVE-2026-102943.md) `CVE-2026-102943` · CVE record: dagucloud dagu · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Broken access control - [FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directory](https://agentprime.io/advisories/CVE-2026-68509.md) `CVE-2026-68509` · CVE record: M66B FairEmail · CVSS 6.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [LXC: lxc-copy host-context hostname update follows symlink](https://agentprime.io/advisories/CVE-2026-100395.md) `CVE-2026-100395` · CVE record: lxc lxc · CVSS 6.8 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, CWE-61 - [KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF](https://agentprime.io/advisories/CVE-2026-81190.md) `CVE-2026-81190` · CVE record: kurrent-io KurrentDB · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Server-side request forgery (SSRF) - [Code Graph RAG structural tools follow out-of-root symlinks](https://agentprime.io/advisories/CVE-2026-87008.md) `CVE-2026-87008` · CVE record: vitali87 code-graph-rag · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read](https://agentprime.io/advisories/CVE-2026-77604.md) `CVE-2026-77604` · CVE record: vitali87 code-graph-rag · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM](https://agentprime.io/advisories/CVE-2026-63213.md) `CVE-2026-63213` · CVE record: SuiteCRM SuiteCRM · CVSS 7.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0](https://agentprime.io/advisories/CVE-2026-107129.md) `CVE-2026-107129` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Privileged file deletion in SafeNet Authentication Client SACSrv](https://agentprime.io/advisories/CVE-2026-112110.md) `CVE-2026-112110` · CVE record: Thalesgroup Safenet Authentication Client Service · CVSS 5.8 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Race condition - [GluonTS arbitrary file write during archive extraction](https://agentprime.io/advisories/CVE-2026-119083.md) `CVE-2026-119083` · CVE record: AWS gluonts · CVSS 8.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION](https://agentprime.io/advisories/CVE-2026-102523.md) `CVE-2026-102523` · CVE record: MariaDB server · CVSS 8.0 High · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Apache OFBiz: Authenticated Path Traversal in Catalog Image Management](https://agentprime.io/advisories/CVE-2026-66903.md) `CVE-2026-66903` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage](https://agentprime.io/advisories/CVE-2026-76150.md) `CVE-2026-76150` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Broken access control - [Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services](https://agentprime.io/advisories/CVE-2026-76152.md) `CVE-2026-76152` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Broken access control - [Apache OFBiz: webtools xmldsdump exports any entity to any path](https://agentprime.io/advisories/CVE-2026-82916.md) `CVE-2026-82916` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Broken access control - [Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass](https://agentprime.io/advisories/CVE-2026-97356.md) `CVE-2026-97356` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Path Traversal in Kobikom Telecommunications' Kobikom](https://agentprime.io/advisories/CVE-2026-104720.md) `CVE-2026-104720` · CVE record: Kobikom Telecommunications and Informatics Services Inc. Kobikom · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory](https://agentprime.io/advisories/CVE-2026-121489.md) `CVE-2026-121489` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter](https://agentprime.io/advisories/CVE-2026-116617.md) `CVE-2026-116617` · CVE record: stylemix Motors – Car Dealership & Classified Listings Plugin · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [DeepGraphLearning KnowledgeGraphEmbedding Checkpoint Loading run.py override_config path traversal](https://agentprime.io/advisories/CVE-2026-122188.md) `CVE-2026-122188` · CVE record: DeepGraphLearning KnowledgeGraphEmbedding · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument](https://agentprime.io/advisories/CVE-2026-122311.md) `CVE-2026-122311` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.\_\_init\_\_ path traversal](https://agentprime.io/advisories/CVE-2026-122159.md) `CVE-2026-122159` · CVE record: Edge0-AI Audio8_TTS · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal - [Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)](https://agentprime.io/advisories/CVE-2026-57565.md) `CVE-2026-57565` · CVE record: readest readest · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview](https://agentprime.io/advisories/CVE-2026-57567.md) `CVE-2026-57567` · CVE record: readest readest · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write](https://agentprime.io/advisories/CVE-2026-121746.md) `CVE-2026-121746` · CVE record: nvm-sh nvm · CVSS 6.7 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity](https://agentprime.io/advisories/CVE-2026-58128.md) `CVE-2026-58128` · CVE record: Alan Health Alan: Health Insurance · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [nvm prints the contents of any readable file through a symlinked .nvmrc](https://agentprime.io/advisories/CVE-2026-121747.md) `CVE-2026-121747` · CVE record: nvm-sh nvm · CVSS 6.7 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal, Information disclosure, CWE-61 - [nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable](https://agentprime.io/advisories/CVE-2026-121748.md) `CVE-2026-121748` · CVE record: nvm-sh nvm · CVSS 1.8 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink](https://agentprime.io/advisories/CVE-2026-122235.md) `CVE-2026-122235` · CVE record: janhq jan · CVSS 5.7 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith](https://agentprime.io/advisories/CVE-2026-16725.md) `CVE-2026-16725` · CVE record: IBM Watson Speech Services Cartridge · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Comfast CF-WR632AX Multipart webmgnt path traversal](https://agentprime.io/advisories/CVE-2026-122013.md) `CVE-2026-122013` · CVE record: Comfast CF-WR632AX · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File](https://agentprime.io/advisories/CVE-2026-122136.md) `CVE-2026-122136` · CVE record: romkatv powerlevel10k · CVSS 4.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle](https://agentprime.io/advisories/CVE-2026-76806.md) `CVE-2026-76806` · CVE record: solidtime-io solidtime · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Cisco Unified Computing System Central Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-76506.md) `CVE-2026-76506` · CVE record: Cisco Cisco Unified Computing System Central Software · CVSS 7.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal](https://agentprime.io/advisories/CVE-2026-121967.md) `CVE-2026-121967` · CVE record: coder coder · CVSS 2.3 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Path traversal in plug-in deployment](https://agentprime.io/advisories/CVE-2026-110935.md) `CVE-2026-110935` · CVE record: Phoenix Contact PLCnext Engineer · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Forged LFT metadata permits arbitrary file read and deletion](https://agentprime.io/advisories/CVE-2026-114425.md) `CVE-2026-114425` · CVE record: SEPPmail AG SEPPmail Secure Email Gateway (SEG) · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Path Traversal in TÜBİTAK BİLGEM's İmzager](https://agentprime.io/advisories/CVE-2026-19731.md) `CVE-2026-19731` · CVE record: TÜBİTAK BİLGEM Software Technologies Research Institute İmzager · CVSS 3.3 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting](https://agentprime.io/advisories/CVE-2026-115426.md) `CVE-2026-115426` · CVE record: Unknown WPvivid — Backup, Migration & Staging · CVSS 5.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path](https://agentprime.io/advisories/CVE-2026-115242.md) `CVE-2026-115242` · CVE record: Unknown WPvivid — Backup, Migration & Staging · CVSS 5.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal - [Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-92189.md) `CVE-2026-92189` · CVE record: Quest Foglight for Databases · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-92197.md) `CVE-2026-92197` · CVE record: Quest Foglight for Databases · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-92186.md) `CVE-2026-92186` · CVE record: Quest Foglight for Databases · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-92194.md) `CVE-2026-92194` · CVE record: Quest Foglight for Databases · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-92195.md) `CVE-2026-92195` · CVE record: Quest Foglight for Databases · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-92192.md) `CVE-2026-92192` · CVE record: Quest Foglight for Databases · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-92193.md) `CVE-2026-92193` · CVE record: Quest Foglight for Databases · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-92187.md) `CVE-2026-92187` · CVE record: Quest Foglight for Databases · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths](https://agentprime.io/advisories/CVE-2026-120641.md) `CVE-2026-120641` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Tanium addressed a path traversal vulnerability in Tanium Data Service.](https://agentprime.io/advisories/CVE-2026-108327.md) `CVE-2026-108327` · CVE record: Tanium Tanium Data Service and 1 more · CVSS 5.0 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Bake filesystem path entitlements approval can be skipped for path using basename prefix](https://agentprime.io/advisories/CVE-2026-121542.md) `CVE-2026-121542` · CVE record: Docker Docker Buildx · CVSS 1.8 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Symlink following in Google Chrome](https://agentprime.io/advisories/CVE-2026-121224.md) `CVE-2026-121224` · CVE record: Google Chrome · CVSS 8.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace](https://agentprime.io/advisories/CVE-2026-88968.md) `CVE-2026-88968` · CVE record: anthropics claude-code · CVSS 7.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal, Race condition - [isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)](https://agentprime.io/advisories/CVE-2026-63395.md) `CVE-2026-63395` · CVE record: isomorphic-git isomorphic-git · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout](https://agentprime.io/advisories/CVE-2026-63478.md) `CVE-2026-63478` · CVE record: isomorphic-git isomorphic-git · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive export](https://agentprime.io/advisories/CVE-2026-63500.md) `CVE-2026-63500` · CVE record: yeti-platform yeti · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write](https://agentprime.io/advisories/CVE-2026-63502.md) `CVE-2026-63502` · CVE record: yeti-platform yeti · CVSS 8.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [zt-zip: ZipUtil.unpack can change file permissions of output directory](https://agentprime.io/advisories/CVE-2026-63499.md) `CVE-2026-63499` · CVE record: zeroturnaround zt-zip · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [zt-zip: Path traversal in fluent API unpack](https://agentprime.io/advisories/CVE-2026-63436.md) `CVE-2026-63436` · CVE record: zeroturnaround zt-zip · CVSS 6.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .