# Path traversal.

File paths that escape the directory they should stay in. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source](https://agentprime.io/advisories/GHSA-6xx4-9wp6-65p7.md)
  `GHSA-6xx4-9wp6-65p7` · crates.io `skilo`: affected `>=0.5.0, <0.11.1`, fixed in `0.11.1` · CVSS 6.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal, CWE-61
- [openhole-server vulnerable to path traversal via URL-decoded request path](https://agentprime.io/advisories/GHSA-fh2f-xfxc-q9cc.md)
  `GHSA-fh2f-xfxc-q9cc`, `CVE-2026-54650`, `GO-2026-6135` · Go `github.com/bablilayoub/openhole`: affected `<0.1.2`, fixed in `0.1.2` · CVSS 8.6 High · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [goshs has a Path Traversal issue](https://agentprime.io/advisories/GHSA-wg2q-39h6-66x9.md)
  `GHSA-wg2q-39h6-66x9`, `CVE-2026-66063`, `GO-2026-6137` · Go `goshs.de/goshs/v2` and 3 more: affected `<2.1.5-0.20260727065949-f3ef599e4091`, fixed in `2.1.5-0.20260727065949-f3ef599e4091` · CVSS 6.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema \`$ref\` (\`file://\` and \`../\` traversal), bypassing \`--no-allow-remote-refs\`](https://agentprime.io/advisories/GHSA-8359-h9fx-j6v9.md)
  `GHSA-8359-h9fx-j6v9`, `CVE-2026-55389`, `PYSEC-2026-3558` · PyPI `datamodel-code-generator`: affected `<0.62.0`, fixed in `0.62.0` · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal, Information disclosure, CWE-610
- [datamodel-code-generator vulnerable to arbitrary local file read via XSD \`schemaLocation\` (\`xs:include\`/\`xs:import\`) path traversal, with no remote-ref gate](https://agentprime.io/advisories/GHSA-442q-2j6p-642g.md)
  `GHSA-442q-2j6p-642g`, `CVE-2026-55390`, `PYSEC-2026-3556` · PyPI `datamodel-code-generator`: affected `>=0.59.0, <0.62.0`, fixed in `0.62.0` · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal, Information disclosure, CWE-610
- [Path Traversal in IBM Desktop App](https://agentprime.io/advisories/CVE-2026-14973.md)
  `CVE-2026-14973` · CVE record: IBM Aspera Desktop App · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory](https://agentprime.io/advisories/GHSA-q6vm-xqc9-v3ff.md)
  `GHSA-q6vm-xqc9-v3ff`, `CVE-2026-50567`, `GO-2026-6127` · Go `github.com/fission/fission`: affected `<1.25.0`, fixed in `1.25.0` · CVSS 7.7 High · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability](https://agentprime.io/advisories/CVE-2026-15280.md)
  `CVE-2026-15280` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-5114.md)
  `CVE-2026-5114` · CVE record: softaculous SpeedyCache – Cache, Optimization, Performance · CVSS 4.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [Bridge | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2026-48374.md)
  `CVE-2026-48374` · CVE record: Adobe Adobe Bridge · CVSS 7.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [TinyWeb 0.0.8 Path Traversal via URL Path Component](https://agentprime.io/advisories/CVE-2026-67185.md)
  `CVE-2026-67185` · CVE record: GeneralSandman TinyWeb · CVSS 8.7 High · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [@wakaru/cli arbitrary file write during bundle unpack](https://agentprime.io/advisories/GHSA-7wpj-vvmv-pgm8.md)
  `GHSA-7wpj-vvmv-pgm8`, `CVE-2026-54545` · npm `@wakaru/cli`: affected `>=1.0.0, <1.4.0`, fixed in `1.4.0` · CVSS 7.1 High · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory](https://agentprime.io/advisories/CVE-2026-7521.md)
  `CVE-2026-7521` · CVE record: Mattermost Mattermost · CVSS 5.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [Path Traversal in Quick.CMS](https://agentprime.io/advisories/CVE-2026-63303.md)
  `CVE-2026-63303` · CVE record: OpenSolution Quick.CMS · CVSS 5.1 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter](https://agentprime.io/advisories/CVE-2026-16585.md)
  `CVE-2026-16585` · CVE record: wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots · CVSS 7.2 High · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action](https://agentprime.io/advisories/CVE-2026-14490.md)
  `CVE-2026-14490` · CVE record: deveasel Demi – One Click Demo Import, Backup & Site Migration · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [Path traversal in zip-lib](https://agentprime.io/advisories/CVE-2026-17524.md)
  `CVE-2026-17524` · CVE record: zip-lib · CVSS 8.7 High · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal
- [Path traversal in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-64740.md)
  `CVE-2026-64740` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-64731.md)
  `CVE-2026-64731` · CVE record: Apple macOS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Symlink following in Apple macOS](https://agentprime.io/advisories/CVE-2026-43765.md)
  `CVE-2026-43765` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-43749.md)
  `CVE-2026-43749` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-43772.md)
  `CVE-2026-43772` · CVE record: Apple macOS · CVSS 8.2 High · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Path traversal in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-43723.md)
  `CVE-2026-43723` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 7.8 High · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Potential path traversal leading to unauthorized file writes](https://agentprime.io/advisories/CVE-2026-65921.md)
  `CVE-2026-65921` · CVE record: jfrog artifactory · CVSS 8.8 High · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [phpMyFAQ before 4.1.6 Path Traversal via category image deletion](https://agentprime.io/advisories/CVE-2026-66397.md)
  `CVE-2026-66397` · CVE record: thorsten phpMyFAQ · CVSS 8.6 High · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass](https://agentprime.io/advisories/CVE-2026-47078.md)
  `CVE-2026-47078` · CVE record: Erlang OTP · CVSS 4.8 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Path traversal Vulnerability](https://agentprime.io/advisories/CVE-2025-59181.md)
  `CVE-2025-59181` · CVE record: Ericsson Packet Core Controller (PCC) · CVSS 4.8 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server](https://agentprime.io/advisories/CVE-2026-66050.md)
  `CVE-2026-66050` · CVE record: nitroshare nitroshare-desktop · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-66476.md)
  `CVE-2026-66476` · CVE record: Syed Balkhi Easy Digital Downloads · CVSS 4.9 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-65436.md)
  `CVE-2026-65436` · CVE record: Themeum Kirki · CVSS 6.8 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [ZJONSSON node-unzipper extract.js Extract path traversal](https://agentprime.io/advisories/CVE-2026-17514.md)
  `CVE-2026-17514` · CVE record: ZJONSSON node-unzipper · CVSS 4.8 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1](https://agentprime.io/advisories/CVE-2026-65878.md)
  `CVE-2026-65878` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 8.3 High · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Arbitrary Path Execution via CPS URI in proCertum SmartSign](https://agentprime.io/advisories/CVE-2026-57916.md)
  `CVE-2026-57916` · CVE record: Asseco proCertum SmartSign · CVSS 4.6 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Path Traversal Vulnerability in ZTE Blade A75 5G](https://agentprime.io/advisories/CVE-2026-40000.md)
  `CVE-2026-40000` · CVE record: ZTE Blade A75 5G · CVSS 1.8 Low · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1](https://agentprime.io/advisories/CVE-2026-65765.md)
  `CVE-2026-65765` · CVE record: phoca.cz Phoca Commander extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Path traversal
- [perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink](https://agentprime.io/advisories/CVE-2026-17459.md)
  `CVE-2026-17459` · CVE record: perwendel spark · CVSS 5.3 Medium · Not analysed yet · Published 26 Jul 2026 · Tags: Path traversal, CWE-61
- [Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter](https://agentprime.io/advisories/CVE-2026-14955.md)
  `CVE-2026-14955` · CVE record: Themehigh Checkout Field Editor for WooCommerce (Pro) · CVSS 6.5 Medium · Not analysed yet · Published 25 Jul 2026 · Tags: Path traversal
- [OpenList: Authenticated users can rename files outside their base path via batch rename \`src_name\` traversal](https://agentprime.io/advisories/GHSA-95cv-r8x4-vh75.md)
  `GHSA-95cv-r8x4-vh75`, `CVE-2026-73509`, `GO-2026-6110` · Go `github.com/OpenListTeam/OpenList/v4`: affected `<4.2.4`, fixed in `4.2.4` · CVSS 7.6 High · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal
- [OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway](https://agentprime.io/advisories/GHSA-68r5-9hpg-7qw9.md)
  `GHSA-68r5-9hpg-7qw9` · Maven `org.openidentityplatform.opendj:opendj-dsml-servlet`: affected `<5.1.2`, fixed in `5.1.2` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Denial of service, Server-side request forgery (SSRF)
- [Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak](https://agentprime.io/advisories/GHSA-mqhr-6j6h-74p5.md)
  `GHSA-mqhr-6j6h-74p5`, `CVE-2026-73407` · npm `@budibase/server`: affected `<=3.38.1`, no fixed version yet · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Information disclosure
- [open-webui terminal proxy path traversal guard bypass via 9x encoded traversal](https://agentprime.io/advisories/GHSA-frvj-c5qp-xj4w.md)
  `GHSA-frvj-c5qp-xj4w`, `CVE-2026-59221`, `PYSEC-2026-3597` · PyPI `open-webui`: affected `>=0.9.6, <0.10.0`, fixed in `0.10.0` · CVSS 7.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Server-side request forgery (SSRF)
- [Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account](https://agentprime.io/advisories/GHSA-49h3-cwhj-4737.md)
  `GHSA-49h3-cwhj-4737`, `CVE-2026-55495`, `GO-2026-6097` · Go `github.com/cloudreve/Cloudreve/v4` and 1 more: affected `<4.0.0-20260613023150-7968e50429ef`, fixed in `4.0.0-20260613023150-7968e50429ef` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal
- [Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution](https://agentprime.io/advisories/GHSA-7835-87q9-rgvv.md)
  `GHSA-7835-87q9-rgvv`, `CVE-2026-55607` · npm `@anthropic-ai/claude-code`: affected `>=2.1.38, <2.1.163`, fixed in `2.1.163` · CVSS 7.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Command injection
- [@fastify/static vulnerable to route guard bypass via path traversal](https://agentprime.io/advisories/GHSA-83w8-p2f5-377r.md)
  `GHSA-83w8-p2f5-377r`, `CVE-2026-15074` · npm `@fastify/static`: affected `<10.1.1`, fixed in `10.1.1` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal
- [PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure](https://agentprime.io/advisories/GHSA-r28c-9q8g-f849.md)
  `GHSA-r28c-9q8g-f849`, `CVE-2026-73646` · npm `postcss`: affected `<8.5.18`, fixed in `8.5.18` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal
- [PyMdown Extensions: Path traversal in the b64 extension lets \<img src> read files outside base_path](https://agentprime.io/advisories/GHSA-9xwg-3r6f-jcx2.md)
  `GHSA-9xwg-3r6f-jcx2`, `CVE-2026-61632`, `PYSEC-2026-3609` · PyPI `pymdown-extensions`: affected `<11.0.0`, fixed in `11.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal
- [Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)](https://agentprime.io/advisories/GHSA-p5rm-jg5c-8c77.md)
  `GHSA-p5rm-jg5c-8c77`, `CVE-2026-73851` · NuGet `Microsoft.OpenApi.Kiota`: affected `<1.29.1 || >=1.30.0, <1.34.0`, fixed in `1.29.1`, `1.34.0` · CVSS 6.1 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, CWE-829
- [Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName](https://agentprime.io/advisories/GHSA-4vv7-jj25-4gh6.md)
  `GHSA-4vv7-jj25-4gh6`, `CVE-2026-59866` · NuGet `Microsoft.OpenApi.Kiota` and 1 more: affected `<1.29.1 || >=1.30.0, <1.32.5`, fixed in `1.29.1`, `1.32.5` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Code injection
- [Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF](https://agentprime.io/advisories/GHSA-4rj6-vrwv-wr8m.md)
  `GHSA-4rj6-vrwv-wr8m`, `CVE-2026-59863` · NuGet `Microsoft.OpenApi.Kiota` and 1 more: affected `<1.29.1 || >=1.30.0, <1.32.5`, fixed in `1.29.1`, `1.32.5` · CVSS 7.0 High · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Server-side request forgery (SSRF), CWE-829
- [Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref](https://agentprime.io/advisories/GHSA-rg4h-fpcp-2qm8.md)
  `GHSA-rg4h-fpcp-2qm8`, `CVE-2026-59867` · NuGet `Microsoft.OpenApi.Kiota` and 1 more: affected `<1.29.1 || >=1.30.0, <1.32.5`, fixed in `1.29.1`, `1.32.5` · CVSS 7.1 High · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Server-side request forgery (SSRF), CWE-829
- [Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-\* extensions](https://agentprime.io/advisories/GHSA-4jwf-m4wg-8p66.md)
  `GHSA-4jwf-m4wg-8p66`, `CVE-2026-59864` · NuGet `Microsoft.OpenApi.Kiota` and 1 more: affected `<1.29.1 || >=1.30.0, <1.32.5`, fixed in `1.29.1`, `1.32.5` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, CWE-829
- [BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes](https://agentprime.io/advisories/GHSA-4h8q-hh2j-755w.md)
  `GHSA-4h8q-hh2j-755w`, `CVE-2026-66004`, `PYSEC-2026-4203` · PyPI `blender-mcp`: affected `<1.6.5`, fixed in `1.6.5` · CVSS 6.0 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal
- [Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being j...](https://agentprime.io/advisories/GHSA-379c-qx7v-6h59.md)
  `GHSA-379c-qx7v-6h59`, `CVE-2026-66007`, `PYSEC-2026-3716` · PyPI `datasets`: affected `<5.0.1`, fixed in `5.0.1` · CVSS 6.9 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal
- [ImageMagick: Policy Bypass in script operation due to missing checks](https://agentprime.io/advisories/GHSA-vghg-5jrg-2398.md)
  `GHSA-vghg-5jrg-2398`, `CVE-2026-61859` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 4.8 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Broken access control
- [ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check](https://agentprime.io/advisories/GHSA-v3j6-27vc-7pw2.md)
  `GHSA-v3j6-27vc-7pw2`, `CVE-2026-61858` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 4.8 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Broken access control
- [ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219](https://agentprime.io/advisories/GHSA-56m6-8q75-f2rw.md)
  `GHSA-56m6-8q75-f2rw` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 4.7 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Race condition, Broken access control
- [ImageMagick: Policy Bypass in concatenate operation due to missing checks](https://agentprime.io/advisories/GHSA-82mp-vp5c-9pf7.md)
  `GHSA-82mp-vp5c-9pf7`, `CVE-2026-55628` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 5.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Broken access control
- [Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter](https://agentprime.io/advisories/CVE-2026-12503.md)
  `CVE-2026-12503` · CVE record: Loytec LIP-ME20xC and 4 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal
- [Path traversal in Exim](https://agentprime.io/advisories/CVE-2026-66140.md)
  `CVE-2026-66140` · CVE record: Exim Exim · CVSS 8.4 High · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal
- [Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter](https://agentprime.io/advisories/CVE-2026-15420.md)
  `CVE-2026-15420` · CVE record: posimyththemes Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder · CVSS 4.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/tag/path-traversal.md>
Older: <https://agentprime.io/advisories/tag/path-traversal.md?cursor=WyIyMDI2LTA3LTI0VDAyOjMxOjU5LjU0OTAwMFoiLCJDVkUtMjAyNi0xNTQyMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=path-traversal&cursor=WyIyMDI2LTA3LTI4VDIyOjI1OjI5LjAwMDAwMFoiLCJHSFNBLTJ4bXctZjhqOC13ZnhjIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/path-traversal/?cursor=WyIyMDI2LTA3LTI4VDIyOjI1OjI5LjAwMDAwMFoiLCJHSFNBLTJ4bXctZjhqOC13ZnhjIl0>. Everything for agents: <https://agentprime.io/llms.txt>.